Hot answers tagged

13 votes
Accepted

Why do reversers nowadays reverse engineer using decompilers and not disassemblers?

Although these terms are being used interchangeably, there is an intrinsic difference between disassembler and decompiler definitions traditionally. Let's first consider common steps involved in ...
user avatar
  • 1,437
12 votes
Accepted

concat22 in ghidra decompiler

I wanted to comment but it grew up so answering CONCAT is Concatenation 22 is a suffix that denotes concatenate two bytes with two bytes it takes two bytes from first location two bytes from ...
user avatar
  • 14.9k
9 votes
Accepted

Ghidra can't see basic functions in my files?

Visual Studio is inlining the function. You will need to tell VS to not do that: __declspec(noinline) void someFunction() { printf("im scared world, i dont understand.\n"); }
user avatar
  • 336
8 votes

Ghidra rename variable below current line

As of 2020.11.13 the 9.2 release is available which includes this feature. For registers you can do it: Right click in the Decompiler → Commit Locals. Right click on the variable → Split out as New ...
user avatar
8 votes

Use ghidra decompiler with command line

Check my answer here. All you have to do is to use ./analyzeHeadless script, which comes with ghidra: ./analyzeHeadless ghidra-project-directory -import binary-file -postscript yourpythonscript You ...
user avatar
  • 1,437
8 votes
Accepted

How to display the CFG of a function in Ghidra?

Try Window -> Function Graph Its even conveniently zoomable.
user avatar
  • 2,826
8 votes
Accepted

Is there documentation on the Ghidra 9.1 SleighDevTools?

In the SleighDevTools folder, there is a pcodetest folder, with a README.txt (which is unfortunately very brief). The documentation on SLEIGH can be found in <ghidra install dir>/docs/languages/...
user avatar
8 votes
Accepted

Ghidra + IDA cant detect a string but Radare2 can

I don't know the exact length of string. But, few things to note here are as follows: Ghidra and IDA has a minimum bound on size of string to recover correct type (ghidra has a limit - or lower bound ...
user avatar
  • 1,437
7 votes

How to export a working elf binary from Ghidra?

Ghidra Export Binary Feature UPDATE AS OF June 2021: The preliminary release notes list this as a feature for Ghidra 10, which should be released "mid to end of June 2021": New exporters ...
user avatar
7 votes

Is there a list of Ghidra's variable prefixes?

This is annoyingly hard to find the answer to. This is a good starting point, but I don't think I found everything yet. Variable names From Function.java: param_ local_ local_res temp_ From ...
user avatar
7 votes
Accepted

How to prevent Ghidra from removing unreachable blocks?

By default, there is a setting in Code Browser that allows Ghidra to eliminate unreachable code, you would have to change the setting by editing the options for Code Browser. This can be done by going ...
user avatar
  • 88
7 votes

Why can't you edit pseudo code?

From everything I've read pseudo code can't be edited in realtime but can be edited as assembly This is not entirely correct. Quite the opposite even: Decompilers cannot be perfect (the compilation ...
user avatar
  • 198
7 votes

What do these 2 Ghidra warnings mean?

From Ghidra.re: Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable. One reason for this is that there actually is a jump table, but ...
user avatar
7 votes
Accepted

Correct way to understand local_ in ghidra disassembly

Since local variables are usually placed on the stack in x86 and esp register can change during function execution, it is more convenient to save the value of esp register on function entry and access ...
user avatar
  • 3,189
7 votes

Finding AES Key in binary using Ghidra and FindCrypt

FindCrypt is not supposed to find your key, it's supposed to find fixed, known constants associated with well-known cryptographic algorithms. You can see the byte patterns it's looking for in its ...
user avatar
  • 7,814
6 votes

Can Ghidra show me the p-code generated for an instruction?

For an individual instruction, yes, sure. See this recent blog post of mine and search for "Jenga". If you're talking about inspecting the pcode after the decompiler has done its business with it, ...
user avatar
  • 7,814
6 votes

How do I import function signatures to Ghidra?

"File" -> "Parse C Source..." ... then parse the ddraw.h But warning it doesn't work as smooth as expected. I could only get small headers to parse correctly. A good video about it: https://www....
user avatar
6 votes
Accepted

In Ghidra what do I need to set so disassembler is in Thumb mode instead of ARM

So once in an architecture that has Thumb (ARMv7+) selecting the region of interest and pressing CTRL+R will bring up the Set Register Value editor, and selecting TMode and setting value 1. If you ...
user avatar
6 votes
Accepted

How to increase decompilation timeout in ghidra?

You can configure the timeout in decompiler options. Go to Edit->Tool Options...->Decompiler and change "Decompiler Timeout (seconds)" to the desired value.
user avatar
  • 131
6 votes
Accepted

Way to get all the function prototype using Ghidra

You can use FunctionManager to get all the functions in the current program and then, from it iterate and get signatures of each. fm = currentProgram.getFunctionManager() functions = fm.getFunctions(...
user avatar
6 votes

IDA and Ghidra Reversing

I can only properly answer your first question: I think this is fundamentally impossible to achieve with IDA, but in Ghidra it works and is fairly easy to use (though a bit hard to find) If your "...
user avatar
6 votes
Accepted

How to make ghidra display the real offset from rbp

The offsets are listed at the top of the function: You can also hover over the local variable name for a few seconds to see a popup with the offset. If you want to permanently disable the variable ...
user avatar
  • 469
6 votes
Accepted

Ghidra: equivalent to IDA-Pro's "Reset desktop"

The only way I'm aware of is to reimport the tool. Specifically: From the Ghidra Project window, right click on the code browser tool and click Delete... Tools -> Import Default Tools... Select ...
user avatar
6 votes
Accepted

Is there a way to name a flag for a bit field in Ghidra?

select SCALAR in decompiler window right click ->Set Equate ("E" short cut) type or select if available a sample EQUATE as below uVar6 = *(ushort *)param_2 & THIS_IS_MY_BAD;
user avatar
  • 14.9k
5 votes
Accepted

Ghidra Control Flow Graph

I'm looking for the same thing and for now I found the class PcodeSyntaxTree having a method called getBasicBlocks(), which returns an array of PcodeBlockBasic elements. This second class has methods ...
user avatar
5 votes
Accepted

Can you change the architecture in Ghidra after importing?

you can right click the file you import at Active Project tab in ghidra main window, and select Set Language
user avatar
5 votes
Accepted

ghidra: how to run a python 3 script with headless analyzer

I turns out that the python script can be used with headless analyzer script. Using the following command I can run it, just like the java file: ./analyzeHeadless ghidra-project-directory -import ...
user avatar
  • 1,437
5 votes
Accepted

Any reason why Ghidra is screwing with this byte in this dissassembly?

This has something to do with the way Ghidra handles relocations. Loading the SLUS_204.99 binary with the following processor options and relocations disabled. Processor: MIPS Variant: 64-32addr Size:...
user avatar
  • 5,850
5 votes

Ghidra: Prepend memory segment in assembly listing view

Well, rubber ducking really works. I found it myself, go to Edit > Tool Options > Listing Fields > Address Field and check Show Block Name
user avatar
  • 164
5 votes
Accepted

Simple C program disassembled with Ghidra

Program entry point != main You're seeing disassembly of a few of the functions automatically linked to the program by the compiler toolchain that are responsible for setting up the C Run-Time (CRT) ...
user avatar
  • 6,859

Only top scored, non community-wiki answers of a minimum length are eligible