Hot answers tagged

14 votes
Accepted

Why do reversers nowadays reverse engineer using decompilers and not disassemblers?

Although these terms are being used interchangeably, there is an intrinsic difference between disassembler and decompiler definitions traditionally. Let's first consider common steps involved in ...
  • 1,557
13 votes
Accepted

concat22 in ghidra decompiler

I wanted to comment but it grew up so answering CONCAT is Concatenation 22 is a suffix that denotes concatenate two bytes with two bytes it takes two bytes from first location two bytes from ...
  • 15.6k
10 votes
Accepted

How to display the CFG of a function in Ghidra?

Try Window -> Function Graph Its even conveniently zoomable.
  • 2,876
9 votes

Use ghidra decompiler with command line

Check my answer here. All you have to do is to use ./analyzeHeadless script, which comes with ghidra: ./analyzeHeadless ghidra-project-directory -import binary-file -postscript yourpythonscript You ...
  • 1,557
9 votes
Accepted

Ghidra can't see basic functions in my files?

Visual Studio is inlining the function. You will need to tell VS to not do that: __declspec(noinline) void someFunction() { printf("im scared world, i dont understand.\n"); }
  • 441
9 votes
Accepted

Correct way to understand local_ in ghidra disassembly

Since local variables are usually placed on the stack in x86 and esp register can change during function execution, it is more convenient to save the value of esp register on function entry and access ...
  • 3,289
8 votes

Ghidra rename variable below current line

As of 2020.11.13 the 9.2 release is available which includes this feature. For registers you can do it: Right click in the Decompiler → Commit Locals. Right click on the variable → Split out as New ...
8 votes
Accepted

Is there documentation on the Ghidra 9.1 SleighDevTools?

In the SleighDevTools folder, there is a pcodetest folder, with a README.txt (which is unfortunately very brief). The documentation on SLEIGH can be found in <ghidra install dir>/docs/languages/...
8 votes
Accepted

Ghidra + IDA cant detect a string but Radare2 can

I don't know the exact length of string. But, few things to note here are as follows: Ghidra and IDA has a minimum bound on size of string to recover correct type (ghidra has a limit - or lower bound ...
  • 1,557
7 votes

How to export a working elf binary from Ghidra?

Ghidra Export Binary Feature UPDATE AS OF June 2021: The preliminary release notes list this as a feature for Ghidra 10, which should be released "mid to end of June 2021": New exporters ...
7 votes

How do I import function signatures to Ghidra?

"File" -> "Parse C Source..." ... then parse the ddraw.h But warning it doesn't work as smooth as expected. I could only get small headers to parse correctly. A good video about it: https://www....
7 votes
Accepted

Ghidra does not display whole strings

You need to edit the field width. First, click the "Edit the Listing fields" button: Then, drag the "Field Name" border to the right until the text is fully displayed:
  • 519
7 votes

Is there a list of Ghidra's variable prefixes?

This is annoyingly hard to find the answer to. This is a good starting point, but I don't think I found everything yet. Variable names From Function.java: param_ local_ local_res temp_ From ...
7 votes
Accepted

How to prevent Ghidra from removing unreachable blocks?

By default, there is a setting in Code Browser that allows Ghidra to eliminate unreachable code, you would have to change the setting by editing the options for Code Browser. This can be done by going ...
  • 88
7 votes

Why can't you edit pseudo code?

From everything I've read pseudo code can't be edited in realtime but can be edited as assembly This is not entirely correct. Quite the opposite even: Decompilers cannot be perfect (the compilation ...
  • 198
7 votes

What do these 2 Ghidra warnings mean?

From Ghidra.re: Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable. One reason for this is that there actually is a jump table, but ...
7 votes
Accepted

How to make ghidra display the real offset from rbp

The offsets are listed at the top of the function: You can also hover over the local variable name for a few seconds to see a popup with the offset. If you want to permanently disable the variable ...
  • 519
7 votes

Finding AES Key in binary using Ghidra and FindCrypt

FindCrypt is not supposed to find your key, it's supposed to find fixed, known constants associated with well-known cryptographic algorithms. You can see the byte patterns it's looking for in its ...
  • 8,389
6 votes
Accepted

In Ghidra what do I need to set so disassembler is in Thumb mode instead of ARM

So once in an architecture that has Thumb (ARMv7+) selecting the region of interest and pressing CTRL+R will bring up the Set Register Value editor, and selecting TMode and setting value 1. If you ...
6 votes
Accepted

Ghidra Control Flow Graph

I'm looking for the same thing and for now I found the class PcodeSyntaxTree having a method called getBasicBlocks(), which returns an array of PcodeBlockBasic elements. This second class has methods ...
6 votes
Accepted

How to increase decompilation timeout in ghidra?

You can configure the timeout in decompiler options. Go to Edit->Tool Options...->Decompiler and change "Decompiler Timeout (seconds)" to the desired value.
  • 141
6 votes

Can Ghidra show me the p-code generated for an instruction?

For an individual instruction, yes, sure. See this recent blog post of mine and search for "Jenga". If you're talking about inspecting the pcode after the decompiler has done its business with it, ...
  • 8,389
6 votes
Accepted

ghidra: how to run a python 3 script with headless analyzer

I turns out that the python script can be used with headless analyzer script. Using the following command I can run it, just like the java file: ./analyzeHeadless ghidra-project-directory -import ...
  • 1,557
6 votes
Accepted

ghidra-python: create struct with big endian field

The following script shows hows to create a structure and set its field to Big Endian byte order using the Ghidra Python API. from ghidra.program.model.data import DataTypeConflictHandler from ...
  • 5,950
6 votes
Accepted

Ghidra python - get program base address

You can use currentProgram.getImageBase() to obtain the base address. This returns an Address object. Example >>> currentProgram.getImageBase() 00400000 >>> type(currentProgram....
  • 5,950
6 votes
Accepted

Way to get basic blocks of a binary using Ghidra

You can obtain the list of all defined basic blocks using BasicBlockModel Example from ghidra.program.model.block import BasicBlockModel from ghidra.util.task import TaskMonitor bbm = ...
  • 5,950
6 votes
Accepted

Way to get all the function prototype using Ghidra

You can use FunctionManager to get all the functions in the current program and then, from it iterate and get signatures of each. fm = currentProgram.getFunctionManager() functions = fm.getFunctions(...
6 votes

IDA and Ghidra Reversing

I can only properly answer your first question: I think this is fundamentally impossible to achieve with IDA, but in Ghidra it works and is fairly easy to use (though a bit hard to find) If your "...
6 votes
Accepted

Is it possible to load multiple files into a single Ghidra memory map?

Yes it is! After puzzling over this for a day and a bit I figured it out after posting the question here. Instead of using File/Import use File/Add To Program From there it seems to work as ...
6 votes
Accepted

Ghidra: equivalent to IDA-Pro's "Reset desktop"

The only way I'm aware of is to reimport the tool. Specifically: From the Ghidra Project window, right click on the code browser tool and click Delete... Tools -> Import Default Tools... Select ...

Only top scored, non community-wiki answers of a minimum length are eligible