Hot answers tagged

9

Visual Studio is inlining the function. You will need to tell VS to not do that: __declspec(noinline) void someFunction() { printf("im scared world, i dont understand.\n"); }


7

I wanted to comment but it grew up so answering CONCAT is Concatenation 22 is a suffix that denotes concatenate two bytes with two bytes it takes two bytes from first location two bytes from second location and produces a 4 byte result here it is probably making a wide character string you can see the difference of two bytes in the address too ...


6

Check my answer here. All you have to do is to use ./analyzeHeadless script, which comes with ghidra: ./analyzeHeadless ghidra-project-directory -import binary-file -postscript yourpythonscript You can either use java or python 2.7. You can check the ghidra api here. You can write the script (in python) in the following way: from ghidra.app.decompiler ...


6

You can configure the timeout in decompiler options. Go to Edit->Tool Options...->Decompiler and change "Decompiler Timeout (seconds)" to the desired value.


6

For an individual instruction, yes, sure. See this recent blog post of mine and search for "Jenga". If you're talking about inspecting the pcode after the decompiler has done its business with it, there's a couple of scripts that user d-millar has repeatedly linked on the Ghidra GitHub that demontrate how to use that form of the pcode from the API, as well ...


6

You can use FunctionManager to get all the functions in the current program and then, from it iterate and get signatures of each. fm = currentProgram.getFunctionManager() functions = fm.getFunctions(True) for f in functions: print(f.getSignature().getPrototypeString()) The output: Signatures.py> Running... char * strcpy(char * __dest, char * __src) ...


6

In the SleighDevTools folder, there is a pcodetest folder, with a README.txt (which is unfortunately very brief). The documentation on SLEIGH can be found in <ghidra install dir>/docs/languages/index.html, which explains what goes in the .slaspec file for your new processor. Some documentation on what goes in the other files like .cspec, .ldefs, .., ...


6

By default, there is a setting in Code Browser that allows Ghidra to eliminate unreachable code, you would have to change the setting by editing the options for Code Browser. This can be done by going to Edit -> Tools Options. This would bring you to a page as seen in the screenshot below Under the Analysis options in the Decompiler folder, there is a ...


5

Try Window -> Function Graph Its even conveniently zoomable.


5

you can right click the file you import at Active Project tab in ghidra main window, and select Set Language


5

I'm looking for the same thing and for now I found the class PcodeSyntaxTree having a method called getBasicBlocks(), which returns an array of PcodeBlockBasic elements. This second class has methods like getIn and getOut which retrieve incoming and outgoing nodes (basic blocks), respectively. So I think using this methods should be the interface for ...


5

This is a feature that isn't in the current (March 2020) release (9.1.2) and requires at least the commit https://github.com/NationalSecurityAgency/ghidra/commit/885402bbc3618b895c4b9b8f09300d3120a9abe8 This will most like be contained in the 9.2 release, for now you would need to build from master. For registers you can do it: Right click in the ...


5

Well, rubber ducking really works. I found it myself, go to Edit > Tool Options > Listing Fields > Address Field and check Show Block Name


5

When you have just raw bytes without proper headers tools might not know how to process as the code might not start from offset 0. They could try to analyze the bytes to detect if there's code, data or something else but you might also get some false-positives. In your case, you instruct r2 to display those bytes as code (pd - print disassembly) and it does ...


5

You can use currentProgram.getImageBase() to obtain the base address. This returns an Address object. Example >>> currentProgram.getImageBase() 00400000 >>> type(currentProgram.getImageBase()) <type 'ghidra.program.model.address.GenericAddress'> >>> currentProgram.getImageBase().getOffset() 4194304L >>> hex(...


5

The firmware is incorrectly dumped. In your file all occurrences of the byte 0A have been replaced with 0D 0A. Looks like a line ending issue. May be the tool which you have used to dump the firmware have prepended a 0D to each 0A. After replacing all instances of 0D 0A with 0A, it has an exact size of 256 KiB (262144 bytes) as it should be. Previously it ...


5

I can only properly answer your first question: I think this is fundamentally impossible to achieve with IDA, but in Ghidra it works and is fairly easy to use (though a bit hard to find) If your "firmware" is a filesystem that you can unpack, you can automatically load the libraries by: Opening the regular Import File... dialog Clicking Options inside ...


5

Not sure if you ask about one line or the whole program. One assembly line can be obtain for example by such script: addr = toAddr(<address>) print(currentProgram.getListing().getInstructionAt(addr)) if we are talking about the whole program for instr in currentProgram.getListing().getInstructions(True): print(instr) but I guess the last one ...


4

You may achieve that by choosing: Edit->Tool Options->Listing Fields->Format Code and selecting Flag Function Exits field. An example how it works is given below:


4

So once in an architecture that has Thumb (ARMv7+) selecting the region of interest and pressing CTRL+R will bring up the Set Register Value editor, and selecting TMode and setting value 1. If you have the Edit -> Tool Options -> Options | Listing Fields | Register Field | Display Hidden Registers set, you will have annotations like assume TMode = 0x1 in ...


4

This has something to do with the way Ghidra handles relocations. Loading the SLUS_204.99 binary with the following processor options and relocations disabled. Processor: MIPS Variant: 64-32addr Size: 32 Endian: little Compiler: default The disassembly is the same as that of IDA. Using readelf shows that there are relocations of type R_MIPS_26 at the said ...


4

Program entry point != main You're seeing disassembly of a few of the functions automatically linked to the program by the compiler toolchain that are responsible for setting up the C Run-Time (CRT) environment. From Microsoft's CRT Initialization: By default, the linker includes the CRT library, which provides its own startup code. This startup code ...


4

1) you demangle the function names for these which are called within the function 2) you learn the arguments of these functions and apply the names to local variables which are passed as arguments to the functions 3) you learn the structures and apply them to stack variables, so that you can name more stack variables which are assigned to the structure ...


4

You can obtain the list of all defined basic blocks using BasicBlockModel Example from ghidra.program.model.block import BasicBlockModel from ghidra.util.task import TaskMonitor bbm = BasicBlockModel(currentProgram) blocks = bbm.getCodeBlocks(TaskMonitor.DUMMY) block = blocks.next() while block: print "Label: {}".format(block.name) print "Min ...


4

TL;DR: This is not an error from Ghidra. The values are just a naming convention, and the real instructions are correctly disassembled. Ghidra assigns variable names based on the function entry point, and displays offsets based on that. It seems Ghidra behaviour is like this to have a universal way to assign names, independently from the compiler. As ...


4

So, I found out the reason. By default when the ghidra asks for options when we load the binary, Decompiler Parameter ID option is disabled. Once you enable it, you will have the function parameters correctly. It will take longer time to make the analysis once this option is enabled.


4

code does mean that something is interpreted as code to execute (most likely a function) But more can be recovered from this snippet than just that something is executed: Step 1: (**(code **)(*plVar5 + 0x10)) This is most likely a C++ vtable call. plVar5 should be some variable containing a C++ object, or rather a pointer that should be interpreted as a ...


3

Right click on the number Convert -> Unsigned Decimal:


3

I turns out that the python script can be used with headless analyzer script. Using the following command I can run it, just like the java file: ./analyzeHeadless ghidra-project-directory -import binary-file -postscript yourpythonscript Apparently all the classes defined for java can be used directly in the python script. Particular class can be imported ...


3

This is probably code compiled by Visual C++ in debug build setting. In such case, the compiler generates code which fills all stack variables with the byte 0xCC, so that any uninitialized value is clearly visible during debugging. See also https://stackoverflow.com/a/11865164


Only top voted, non community-wiki answers of a minimum length are eligible