16
votes
Accepted
concat22 in ghidra decompiler
I wanted to comment but it grew up so answering
CONCAT is Concatenation
22 is a suffix that denotes concatenate two bytes with two bytes
it takes two bytes from first location two bytes from ...
- 16.5k
14
votes
Accepted
Why do reversers nowadays reverse engineer using decompilers and not disassemblers?
Although these terms are being used interchangeably, there is an intrinsic difference between disassembler and decompiler definitions traditionally. Let's first consider common steps involved in ...
- 1,807
10
votes
Use ghidra decompiler with command line
Check my answer here.
All you have to do is to use ./analyzeHeadless script, which comes with ghidra:
./analyzeHeadless ghidra-project-directory -import binary-file -postscript yourpythonscript
You ...
- 1,807
10
votes
Accepted
How to display the CFG of a function in Ghidra?
Try Window -> Function Graph
Its even conveniently zoomable.
- 2,906
9
votes
Accepted
Ghidra can't see basic functions in my files?
Visual Studio is inlining the function. You will need to tell VS to not do that:
__declspec(noinline) void someFunction()
{
printf("im scared world, i dont understand.\n");
}
- 441
9
votes
Accepted
Is it possible to load multiple files into a single Ghidra memory map?
Yes it is!
After puzzling over this for a day and a bit I figured it out after posting the question here.
Instead of using File/Import use File/Add To Program
From there it seems to work as ...
- 581
9
votes
Is there a list of Ghidra's variable prefixes?
This is annoyingly hard to find the answer to. This is a good starting point, but I don't think I found everything yet.
Variable names
From Function.java:
param_
local_
local_res
temp_
From ...
- 957
9
votes
Accepted
How to prevent Ghidra from removing unreachable blocks?
By default, there is a setting in Code Browser that allows Ghidra to eliminate unreachable code, you would have to change the setting by editing the options for Code Browser. This can be done by going ...
- 108
9
votes
Accepted
Correct way to understand local_ in ghidra disassembly
Since local variables are usually placed on the stack in x86 and esp register can change during function execution, it is more convenient to save the value of esp register on function entry and access ...
- 3,429
8
votes
Ghidra rename variable below current line
As of 2020.11.13 the 9.2 release is available which includes this feature.
For registers you can do it:
Right click in the Decompiler → Commit Locals.
Right click on the variable → Split out as New ...
- 1,459
8
votes
How to export a working elf binary from Ghidra?
Ghidra Export Binary Feature
UPDATE AS OF June 2021:
The preliminary release notes list this as a feature for Ghidra 10, which should be released "mid to end of June 2021":
New exporters ...
- 1,459
8
votes
Accepted
ghidra: how to run a python 3 script with headless analyzer
I turns out that the python script can be used with headless analyzer script.
Using the following command I can run it, just like the java file:
./analyzeHeadless ghidra-project-directory -import ...
- 1,807
8
votes
Accepted
Ghidra does not display whole strings
You need to edit the field width.
First, click the "Edit the Listing fields" button:
Then, drag the "Field Name" border to the right until the text is fully displayed:
- 559
8
votes
Accepted
Way to get basic blocks of a binary using Ghidra
You can obtain the list of all defined basic blocks using BasicBlockModel
Example
from ghidra.program.model.block import BasicBlockModel
from ghidra.util.task import TaskMonitor
bbm = ...
- 6,110
8
votes
Accepted
Ghidra interpreting stack pointers wrongly
TL;DR:
This is not an error from Ghidra. The values are just a naming convention, and the real instructions are correctly disassembled.
Ghidra assigns variable names based on the function entry point,...
- 319
8
votes
Accepted
Is there documentation on the Ghidra 9.1 SleighDevTools?
In the SleighDevTools folder, there is a pcodetest folder, with a README.txt (which is unfortunately very brief).
The documentation on SLEIGH can be found in <ghidra install dir>/docs/languages/...
- 474
8
votes
Why can't you edit pseudo code?
From everything I've read pseudo code can't be edited in realtime but can be edited as assembly
This is not entirely correct. Quite the opposite even: Decompilers cannot be perfect (the compilation ...
- 272
8
votes
Accepted
Ghidra + IDA cant detect a string but Radare2 can
I don't know the exact length of string. But, few things to note here are as follows:
Ghidra and IDA has a minimum bound on size of string to recover correct type (ghidra has a limit - or lower bound ...
- 1,807
8
votes
Accepted
Is there a way to name a flag for a bit field in Ghidra?
select SCALAR in decompiler window
right click ->Set Equate ("E" short cut)
type or select if available
a sample EQUATE as below
uVar6 = *(ushort *)param_2 & THIS_IS_MY_BAD;
- 16.5k
7
votes
Accepted
How to increase decompilation timeout in ghidra?
You can configure the timeout in decompiler options. Go to Edit->Tool Options...->Decompiler and change "Decompiler Timeout (seconds)" to the desired value.
- 151
7
votes
How do I import function signatures to Ghidra?
"File" -> "Parse C Source..." ... then parse the ddraw.h
But warning it doesn't work as smooth as expected. I could only get small headers to parse correctly.
A good video about it: https://www....
- 71
7
votes
Accepted
ghidra-python: create struct with big endian field
The following script shows hows to create a structure and set its field to Big Endian byte order using the Ghidra Python API.
from ghidra.program.model.data import DataTypeConflictHandler
from ...
- 6,110
7
votes
What do these 2 Ghidra warnings mean?
From Ghidra.re:
Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable.
One reason for this is that there actually is a jump table, but ...
- 386
7
votes
Accepted
How to make ghidra display the real offset from rbp
The offsets are listed at the top of the function:
You can also hover over the local variable name for a few seconds to see a popup with the offset.
If you want to permanently disable the variable ...
- 559
7
votes
Finding AES Key in binary using Ghidra and FindCrypt
FindCrypt is not supposed to find your key, it's supposed to find fixed, known constants associated with well-known cryptographic algorithms. You can see the byte patterns it's looking for in its ...
- 9,198
6
votes
Accepted
In Ghidra what do I need to set so disassembler is in Thumb mode instead of ARM
So once in an architecture that has Thumb (ARMv7+) selecting the region of interest and pressing CTRL+R will bring up the Set Register Value editor, and selecting TMode and setting value 1.
If you ...
- 952
6
votes
Accepted
Ghidra Control Flow Graph
I'm looking for the same thing and for now I found the class PcodeSyntaxTree having a method called getBasicBlocks(), which returns an array of PcodeBlockBasic elements. This second class has methods ...
6
votes
Can Ghidra show me the p-code generated for an instruction?
For an individual instruction, yes, sure. See this recent blog post of mine and search for "Jenga". If you're talking about inspecting the pcode after the decompiler has done its business with it, ...
- 9,198
6
votes
Accepted
Why Ghidra doesn't load the disassembly correctly while radare2 does?
When you have just raw bytes without proper headers tools might not know how to process as the code might not start from offset 0. They could try to analyze the bytes to detect if there's code, data ...
- 4,942
6
votes
Accepted
Ghidra python - get program base address
You can use currentProgram.getImageBase() to obtain the base address. This returns an Address object.
Example
>>> currentProgram.getImageBase()
00400000
>>> type(currentProgram....
- 6,110
Only top scored, non community-wiki answers of a minimum length are eligible