2
Looks like you also asked the question over on the Ghidra GitHub page and the answer there is the same.
Essentially, no, Ghidra does not do that. But you should investigate Angr, Klee, Bitblaze, or others.
2
I'll present the steps that I would perform in such a case. Note that they aren't necessarily the most efficient and reliable ones although they should work in many cases. I'm assuming that the binary you want to examine isn't packed and obfuscated.
Look for the imports. Sometimes the code you are looking for is just taken from external library. In this ...
1
Is there anything I can do to open the NEC binary dump in Ghidra?
Yes. If Ghidra does not currently support 76F0219F1 NEC processor architecture, Ghidra can be extended using SLEIGH. Here are some examples of how to do this:
Implementing a New CPU Architecture for Ghidra
new 6502 CPU description
Writing a wasm loader for Ghidra. Part 1: Problem statement ...
1
No, unfortunately not. Look at this question, among the frequently asked questions.
According to that:
X86 16/32/64, ARM/AARCH64, PowerPC 32/64/VLE, MIPS 16/32/64/micro,
68xxx, Java / DEX bytecode, PA-RISC, PIC 12/16/17/18/24, Sparc 32/64,
CR16C, Z80, 6502, 8051, MSP430, AVR8, AVR32 and the variants of these
processors
are currently supported.
1
if eax = 1000 ecx will be 1004 in first part
uf ebp = 1000 ecx will be *(dword *) 100c in second part
simply put in pseudo c
ecx = foo in first part it is simple assignment
ecx = * foo in second part it is dereferencing
notice the difference of & ( addressof operator) in both comments
the Function in Question Has A prototype of
NTSYSAPI ...
Only top voted, non community-wiki answers of a minimum length are eligible
