Hot answers tagged

8

Visual Studio is inlining the function. You will need to tell VS to not do that: __declspec(noinline) void someFunction() { printf("im scared world, i dont understand.\n"); }


6

You can configure the timeout in decompiler options. Go to Edit->Tool Options...->Decompiler and change "Decompiler Timeout (seconds)" to the desired value.


5

Try Window -> Function Graph Its even conveniently zoomable.


5

Check my answer here. All you have to do is to use ./analyzeHeadless script, which comes with ghidra: ./analyzeHeadless ghidra-project-directory -import binary-file -postscript yourpythonscript You can either use java or python 2.7. You can check the ghidra api here. You can write the script (in python) in the following way: from ghidra.app.decompiler ...


5

I wanted to comment but it grew up so answering CONCAT is Concatenation 22 is a suffix that denotes concatenate two bytes with two bytes it takes two bytes from first location two bytes from second location and produces a 4 byte result here it is probably making a wide character string you can see the difference of two bytes in the address too ...


5

You can use currentProgram.getImageBase() to obtain the base address. This returns an Address object. Example >>> currentProgram.getImageBase() 00400000 >>> type(currentProgram.getImageBase()) <type 'ghidra.program.model.address.GenericAddress'> >>> currentProgram.getImageBase().getOffset() 4194304L >>> hex(...


5

The firmware is incorrectly dumped. In your file all occurrences of the byte 0A have been replaced with 0D 0A. Looks like a line ending issue. May be the tool which you have used to dump the firmware have prepended a 0D to each 0A. After replacing all instances of 0D 0A with 0A, it has an exact size of 256 KiB (262144 bytes) as it should be. Previously it ...


4

So once in an architecture that has Thumb (ARMv7+) selecting the region of interest and pressing CTRL+R will bring up the Set Register Value editor, and selecting TMode and setting value 1. If you have the Edit -> Tool Options -> Options | Listing Fields | Register Field | Display Hidden Registers set, you will have annotations like assume TMode = 0x1 in ...


4

For an individual instruction, yes, sure. See this recent blog post of mine and search for "Jenga". If you're talking about inspecting the pcode after the decompiler has done its business with it, there's a couple of scripts that user d-millar has repeatedly linked on the Ghidra GitHub that demontrate how to use that form of the pcode from the API, as well ...


4

I'm looking for the same thing and for now I found the class PcodeSyntaxTree having a method called getBasicBlocks(), which returns an array of PcodeBlockBasic elements. This second class has methods like getIn and getOut which retrieve incoming and outgoing nodes (basic blocks), respectively. So I think using this methods should be the interface for ...


4

Well, rubber ducking really works. I found it myself, go to Edit > Tool Options > Listing Fields > Address Field and check Show Block Name


4

When you have just raw bytes without proper headers tools might not know how to process as the code might not start from offset 0. They could try to analyze the bytes to detect if there's code, data or something else but you might also get some false-positives. In your case, you instruct r2 to display those bytes as code (pd - print disassembly) and it does ...


4

1) you demangle the function names for these which are called within the function 2) you learn the arguments of these functions and apply the names to local variables which are passed as arguments to the functions 3) you learn the structures and apply them to stack variables, so that you can name more stack variables which are assigned to the structure ...


3

This has something to do with the way Ghidra handles relocations. Loading the SLUS_204.99 binary with the following processor options and relocations disabled. Processor: MIPS Variant: 64-32addr Size: 32 Endian: little Compiler: default The disassembly is the same as that of IDA. Using readelf shows that there are relocations of type R_MIPS_26 at the said ...


3

0xCC stands for int 3 in x86 architecture, that is a special interrupt used to implement software breakpoint by debuggers. So, this code sets the memory to int 3 interrupts for debugging purposes. Imagine that the code accidentally jumps to some random location. If some garbage bytes are there, the behaviour is undefined. However, in case where such a ...


3

"File" -> "Parse C Source..." ... then parse the ddraw.h But warning it doesn't work as smooth as expected. I could only get small headers to parse correctly. A good video about it: https://www.youtube.com/watch?v=u15-r5Erfnw Maybe you could ask that guy on Github to include the ddraw.h into his data type collection: https://github.com/0x6d696368/ghidra-...


3

I turns out that the python script can be used with headless analyzer script. Using the following command I can run it, just like the java file: ./analyzeHeadless ghidra-project-directory -import binary-file -postscript yourpythonscript Apparently all the classes defined for java can be used directly in the python script. Particular class can be imported ...


3

You may achieve that by choosing: Edit->Tool Options->Listing Fields->Format Code and selecting Flag Function Exits field. An example how it works is given below:


3

Try to do ctrl + A - select all and then press D to disassemble. good chance it will solve your problem.


3

It is being used when there's a mismatch between type sizes in the decompiled code and Ghidra cannot show you that the whole variable is being modified. Your PUCHAR - since it is a pointer and this is (probably) 64-bit is 8 bytes. But analyzing the disassembly Ghidra sees that only 4 bytes are being set to 0 in this line (for example a 32 bit register is ...


3

You can obtain the list of all defined basic blocks using BasicBlockModel Example from ghidra.program.model.block import BasicBlockModel from ghidra.util.task import TaskMonitor bbm = BasicBlockModel(currentProgram) blocks = bbm.getCodeBlocks(TaskMonitor.DUMMY) block = blocks.next() while block: print "Label: {}".format(block.name) print "Min ...


3

TL;DR: This is not an error from Ghidra. The values are just a naming convention, and the real instructions are correctly disassembled. Ghidra assigns variable names based on the function entry point, and displays offsets based on that. It seems Ghidra behaviour is like this to have a universal way to assign names, independently from the compiler. As ...


2

To get rid of these references, you need to disable the "Basic Constant Reference Analyzer" located in the Analysis Options (Analysis -> Auto Analyze ...) After this, select your code and clear it (C hotkey by default) and then disassemble again.


2

I guess that the debugger part of the IDE needed to be close to the system at some point in order to trigger a ptrace() call or equivalent in other systems. So, these binary libraries are perfectly legitimate to me (there is probably no other way around, I think in my humble opinion). It will be Open Source with an Apache 2.0 License. But, the code is still ...


2

Right click on the number Convert -> Unsigned Decimal:


2

What should I learn before I start to learn reverse engineering? Assembly is a must. Without deep understanding of assembly you cannot reverse engineer anything seriously. Additionally, you'll have to become familiar with relevant tools, depending on the platform; not knowing every detail of them, just basic use - you will learn more complex things in ...


2

First of all, welcome to the fascinating and frustrating world of malware reversing. What should I learn before I start to learn reverse engineering? I believe that the best way is start to learn basic reverse engineering and improve as you go. Is learning programming with C/C++ a MUST? No, it's not a "MUST." However, if you don't know how to program,...


2

This is probably code compiled by Visual C++ in debug build setting. In such case, the compiler generates code which fills all stack variables with the byte 0xCC, so that any uninitialized value is clearly visible during debugging. See also https://stackoverflow.com/a/11865164


2

One way is using Ghidra's CppExporter class within a Java class that extends GhidraScript class. Ghidra's source code contains some sample codes that could be found at the following link : Decompiler samples. I took one of them and improved a bit the code. The code below has to be copied in a file called Decompile.java Then, you have to run Ghidra's ...


2

Yaldi already mentioned the important first step of Commit Locals for finer variable scoping. If your Ghidra version has at least the commit https://github.com/NationalSecurityAgency/ghidra/commit/885402bbc3618b895c4b9b8f09300d3120a9abe8 which will probably be in the 9.2 release you can explicitly split a variable after Commit Locals, by right clicking the ...


Only top voted, non community-wiki answers of a minimum length are eligible