Skip to main content
4 votes
Accepted

How to search a sequence of instructions in Ghidra?

I'll post an answer here with the conclusions we came to in the chat, in case anyone finds it useful in the future. There seems to be a limitation of the Instruction Pattern Search tool in that the ...
ynwarcs's user avatar
  • 441
3 votes

Is it possible to use GHIDRA to decode .NET ? (1 lvl crackmes with solution, but not in GHIDRA)

You mentioned that you are a beginner so I'll give you a more generic answer with a concrete recommendation in the end. Compared to other industries, like software development, or generally white-...
born's user avatar
  • 252
3 votes
Accepted

Ghidra scripting: get indirect operand address

This is done with the code/data references related API. See the code below (not checked too much, but runs on my last project, in python): # These imports are accessible when you run the script inside ...
w s's user avatar
  • 8,508
2 votes

How to define a 28-bit integer in Ghidra

I'm not sure what exactly you want, but my best guess that defining a struct with a 28 bits long bitfield is the way to correctly model this.
Florian Magin's user avatar
2 votes
Accepted

Ghidra with Swift/Objective-C datatypes (NSString)

I followed this guide on PoomSmart's GitHub page (https://github.com/PoomSmart/IDAObjcTypes) and it seems to have worked. PoomSmart is quite respected in the jailbreak community and I have used their ...
George Katsikas's user avatar
2 votes
Accepted

Identifying C/C++ Library Functions

You could make use of FLIRT signatures. There's a Python script porting IDA FLIRT for Ghidra. You can use existing signature sets, for instance github.com/Maktm/FLIRTDB (or make and apply your own ...
mimak's user avatar
  • 579
2 votes

How can I tell ghidra what structure an address register points to?

In Windows Assuming code as below is compiled without debugging info (no PDB) and loaded in ghidra. disabled analysis on loading. followed label entry to find the address of function main went to ...
blabb's user avatar
  • 16.4k
2 votes
Accepted

convert a memory location to string in Ghidra

Probably this DAT_4c447798 is a pointer and it should point to the string. Ghidra acts much better, if you specify that some memory areas are constant. In the menu check Window -> Memory map and ...
Alexey Esaulenko's user avatar
2 votes

Ghidra is missing known code sections found in Binary Ninja. What settings to change in analysis?

Judging from some GitHub issues, it seems like Ghidra relies on PE headers for analysis and is sensitive to corrupt headers. https://github.com/NationalSecurityAgency/ghidra/issues/327 One solution ...
Ariel Gadbois Roy's user avatar
1 vote

Reverse engineering AES128 Key Derrivation from MAC Address

ELF 32-bit LSB executable, ARM aarch64, version 1 (SYSV) I guess you meant 64-bit ELF, but it's not important. n = 12; // Not sure where 12 comes from, perhaps 2 * number of bytes in a MAC address? /...
wisk's user avatar
  • 1,164
1 vote
Accepted

Ghidra not displaying member function call

The problem is that Ghidra for whatever reason cannot determine what the actual target of this call is. This might just be a limitation of the C++ support in Ghidra. There are plugins that try to ...
Florian Magin's user avatar
1 vote

Ghidra API: Getting the parameter storage locations given a FunctionSignature

There seems to be no ready-made function to solve the question, but looking at the implemenation of the function editor points out the way how to do it. I wrote this utilitiy function to get the ...
Michael Karcher's user avatar
1 vote

Ghidra 11.0 - What does Function > Analyze Stack option do?

How well Analyze Stack works on any particular function in a program is based on: The calling convention selected for the given function, and, How well that calling convention actually models the way ...
g1l1t1's user avatar
  • 31
1 vote

Symbols in Ghidra based on r/w possible?

You can use ghidra's Overlay memory blocks to achieve this. How much work this involves will depend on how many such memory locations are involved and whether they are in contiguous range(s). To get ...
g1l1t1's user avatar
  • 31
1 vote
Accepted

How can I locate where a specific function is being called within the Program using Ghidra?

The comments in green, XREFs, are all of the references to that function that Ghidra could identify. Start with those to find what you are looking for.
ZRucker's user avatar
  • 26
1 vote

What does adding to a function pointer do?

SeedEncrypt's code is ARM Thumb code, a compressed subset of the ARM istruction set with 2-byte opcodes. To differentiate between normal and Thumb code, the least significant bit of code pointers is ...
Dario Petrillo's user avatar
1 vote
Accepted

What does adding to a function pointer do?

Tl;dr: The function SendEncrypt is written using the Thumb instruction set. Many (most?) ARM processors support two instruction sets: the ARM instruction set, and the Thumb instruction set. In the ...
user49822's user avatar
  • 156
1 vote

MachO chained fixups parsing

(short answer that targets what I think is your main confusion for now) I know rebase is used for ASLR when loading other libs so if the objective-c class list is the binary owned class list there's ...
Florian Magin's user avatar
1 vote
Accepted

How can I find the buffer of CryptGenRandom?

This is not a ghidra answer but done using windbg Assuming You Have Code as below #include <windows.h> #include <stdio.h> #pragma comment(lib, "Advapi32.lib") void hexdump(byte *...
blabb's user avatar
  • 16.4k
1 vote

How can I find the buffer of CryptGenRandom?

This seems to be a simple exercise in following the stubs/imports in different DLLs. This is the flow that I see CRYPTSP!CryptGenRandom -> rsaenh!CPGenRandom -> CRYPTBASE!SystemFunction036(on my ...
sudhackar's user avatar
  • 2,709
1 vote

Removing Ghidra auto-generated labels and create function. Overlapping namespace error

Turn off auto analysis options before running script. This gets in the way as it reacts to changes
Ben's user avatar
  • 11
1 vote

Understanding pointer indirection for accessing static variables in Cortex M0 firmware

Right click PTR_DAT_00003d24 and retype it to be a pointer** and it should show up correctly
Jake Ashmore's user avatar
1 vote

Decompiling an executable compiled by vercel/pkg

The vercel/pkg tool takes javascript (node.js) code, compiles it into v8 bytecode and wraps it in an executable code that matches the platform. As the Github page of the pkg-unpacker tool states: ...
Yotamz's user avatar
  • 1,272
1 vote

Way to get basic blocks of a binary using Ghidra

Pyhidra (github, website) is another API for interacting with Ghidra using Python. Pyhidra can be used within Ghidra in addition to the built-in Python runtime, but when used standalone as in these ...
Alex Shroyer's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible