Skip to main content
16 votes
Accepted

concat22 in ghidra decompiler

I wanted to comment but it grew up so answering CONCAT is Concatenation 22 is a suffix that denotes concatenate two bytes with two bytes it takes two bytes from first location two bytes from ...
blabb's user avatar
  • 16.4k
14 votes
Accepted

Why do reversers nowadays reverse engineer using decompilers and not disassemblers?

Although these terms are being used interchangeably, there is an intrinsic difference between disassembler and decompiler definitions traditionally. Let's first consider common steps involved in ...
R4444's user avatar
  • 1,807
10 votes

Use ghidra decompiler with command line

Check my answer here. All you have to do is to use ./analyzeHeadless script, which comes with ghidra: ./analyzeHeadless ghidra-project-directory -import binary-file -postscript yourpythonscript You ...
R4444's user avatar
  • 1,807
10 votes
Accepted

How to display the CFG of a function in Ghidra?

Try Window -> Function Graph Its even conveniently zoomable.
Nordwald's user avatar
  • 2,906
9 votes
Accepted

Ghidra can't see basic functions in my files?

Visual Studio is inlining the function. You will need to tell VS to not do that: __declspec(noinline) void someFunction() { printf("im scared world, i dont understand.\n"); }
mumbel's user avatar
  • 441
9 votes

Is there a list of Ghidra's variable prefixes?

This is annoyingly hard to find the answer to. This is a good starting point, but I don't think I found everything yet. Variable names From Function.java: param_ local_ local_res temp_ From ...
hairlessbear's user avatar
9 votes
Accepted

Correct way to understand local_ in ghidra disassembly

Since local variables are usually placed on the stack in x86 and esp register can change during function execution, it is more convenient to save the value of esp register on function entry and access ...
bart1e's user avatar
  • 3,399
8 votes

Ghidra rename variable below current line

As of 2020.11.13 the 9.2 release is available which includes this feature. For registers you can do it: Right click in the Decompiler → Commit Locals. Right click on the variable → Split out as New ...
Florian Magin's user avatar
8 votes

How to export a working elf binary from Ghidra?

Ghidra Export Binary Feature UPDATE AS OF June 2021: The preliminary release notes list this as a feature for Ghidra 10, which should be released "mid to end of June 2021": New exporters ...
Florian Magin's user avatar
8 votes
Accepted

ghidra: how to run a python 3 script with headless analyzer

I turns out that the python script can be used with headless analyzer script. Using the following command I can run it, just like the java file: ./analyzeHeadless ghidra-project-directory -import ...
R4444's user avatar
  • 1,807
8 votes
Accepted

Ghidra does not display whole strings

You need to edit the field width. First, click the "Edit the Listing fields" button: Then, drag the "Field Name" border to the right until the text is fully displayed:
Dvd848's user avatar
  • 559
8 votes
Accepted

Way to get basic blocks of a binary using Ghidra

You can obtain the list of all defined basic blocks using BasicBlockModel Example from ghidra.program.model.block import BasicBlockModel from ghidra.util.task import TaskMonitor bbm = ...
0xec's user avatar
  • 6,090
8 votes
Accepted

Ghidra interpreting stack pointers wrongly

TL;DR: This is not an error from Ghidra. The values are just a naming convention, and the real instructions are correctly disassembled. Ghidra assigns variable names based on the function entry point,...
user1156544's user avatar
8 votes
Accepted

Is it possible to load multiple files into a single Ghidra memory map?

Yes it is! After puzzling over this for a day and a bit I figured it out after posting the question here. Instead of using File/Import use File/Add To Program From there it seems to work as ...
hippietrail's user avatar
8 votes
Accepted

Is there documentation on the Ghidra 9.1 SleighDevTools?

In the SleighDevTools folder, there is a pcodetest folder, with a README.txt (which is unfortunately very brief). The documentation on SLEIGH can be found in <ghidra install dir>/docs/languages/...
auspicious99's user avatar
8 votes
Accepted

How to prevent Ghidra from removing unreachable blocks?

By default, there is a setting in Code Browser that allows Ghidra to eliminate unreachable code, you would have to change the setting by editing the options for Code Browser. This can be done by going ...
Frost's user avatar
  • 98
8 votes

Why can't you edit pseudo code?

From everything I've read pseudo code can't be edited in realtime but can be edited as assembly This is not entirely correct. Quite the opposite even: Decompilers cannot be perfect (the compilation ...
born's user avatar
  • 252
8 votes
Accepted

Ghidra + IDA cant detect a string but Radare2 can

I don't know the exact length of string. But, few things to note here are as follows: Ghidra and IDA has a minimum bound on size of string to recover correct type (ghidra has a limit - or lower bound ...
R4444's user avatar
  • 1,807
8 votes
Accepted

Is there a way to name a flag for a bit field in Ghidra?

select SCALAR in decompiler window right click ->Set Equate ("E" short cut) type or select if available a sample EQUATE as below uVar6 = *(ushort *)param_2 & THIS_IS_MY_BAD;
blabb's user avatar
  • 16.4k
7 votes
Accepted

How to increase decompilation timeout in ghidra?

You can configure the timeout in decompiler options. Go to Edit->Tool Options...->Decompiler and change "Decompiler Timeout (seconds)" to the desired value.
xyz's user avatar
  • 151
7 votes

How do I import function signatures to Ghidra?

"File" -> "Parse C Source..." ... then parse the ddraw.h But warning it doesn't work as smooth as expected. I could only get small headers to parse correctly. A good video about it: https://www....
John Doe's user avatar
7 votes
Accepted

ghidra-python: create struct with big endian field

The following script shows hows to create a structure and set its field to Big Endian byte order using the Ghidra Python API. from ghidra.program.model.data import DataTypeConflictHandler from ...
0xec's user avatar
  • 6,090
7 votes

What do these 2 Ghidra warnings mean?

From Ghidra.re: Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable. One reason for this is that there actually is a jump table, but ...
Shane Reilly's user avatar
7 votes
Accepted

How to make ghidra display the real offset from rbp

The offsets are listed at the top of the function: You can also hover over the local variable name for a few seconds to see a popup with the offset. If you want to permanently disable the variable ...
Dvd848's user avatar
  • 559
7 votes

Finding AES Key in binary using Ghidra and FindCrypt

FindCrypt is not supposed to find your key, it's supposed to find fixed, known constants associated with well-known cryptographic algorithms. You can see the byte patterns it's looking for in its ...
Rolf Rolles's user avatar
  • 9,198
6 votes
Accepted

In Ghidra what do I need to set so disassembler is in Thumb mode instead of ARM

So once in an architecture that has Thumb (ARMv7+) selecting the region of interest and pressing CTRL+R will bring up the Set Register Value editor, and selecting TMode and setting value 1. If you ...
Simeon Pilgrim's user avatar
6 votes
Accepted

Ghidra Control Flow Graph

I'm looking for the same thing and for now I found the class PcodeSyntaxTree having a method called getBasicBlocks(), which returns an array of PcodeBlockBasic elements. This second class has methods ...
Mauricio Sanfilippo's user avatar
6 votes

Can Ghidra show me the p-code generated for an instruction?

For an individual instruction, yes, sure. See this recent blog post of mine and search for "Jenga". If you're talking about inspecting the pcode after the decompiler has done its business with it, ...
Rolf Rolles's user avatar
  • 9,198
6 votes
Accepted

Why Ghidra doesn't load the disassembly correctly while radare2 does?

When you have just raw bytes without proper headers tools might not know how to process as the code might not start from offset 0. They could try to analyze the bytes to detect if there's code, data ...
Paweł Łukasik's user avatar
6 votes
Accepted

Ghidra python - get program base address

You can use currentProgram.getImageBase() to obtain the base address. This returns an Address object. Example >>> currentProgram.getImageBase() 00400000 >>> type(currentProgram....
0xec's user avatar
  • 6,090

Only top scored, non community-wiki answers of a minimum length are eligible