Hot answers tagged

13

Although these terms are being used interchangeably, there is an intrinsic difference between disassembler and decompiler definitions traditionally. Let's first consider common steps involved in converting low level code to high level human readable code. This is similar to compilation where you convert high level code to low level machine code or an ...


7

I don't know the exact length of string. But, few things to note here are as follows: Ghidra and IDA has a minimum bound on size of string to recover correct type (ghidra has a limit - or lower bound of 5). This is necessary to avoid any false positives or conflicting types. And recover correct types without marking a pointer as a string. Check out this ...


7

FindCrypt is not supposed to find your key, it's supposed to find fixed, known constants associated with well-known cryptographic algorithms. You can see the byte patterns it's looking for in its database.json. It has done exactly what it was supposed to do. Your job as a reverse engineer is to look at the cross-references to the tables that it found and see ...


6

The only way I'm aware of is to reimport the tool. Specifically: From the Ghidra Project window, right click on the code browser tool and click Delete... Tools -> Import Default Tools... Select defaultsTools/CodeBrowser.tool, then OK Worth noting, while in your case it makes sense to delete the current (i.e. broken) tool, that's not a strict requirement....


6

select SCALAR in decompiler window right click ->Set Equate ("E" short cut) type or select if available a sample EQUATE as below uVar6 = *(ushort *)param_2 & THIS_IS_MY_BAD;


5

The offsets are listed at the top of the function: You can also hover over the local variable name for a few seconds to see a popup with the offset. If you want to permanently disable the variable offset translation, uncheck Markup Stack Variable References under Edit -> Tool Options -> Options -> Listing Fields -> Operands Fields.


5

The second piece of code is a so-called PLT (program linkage table) thunk. It retrieves the pointer to the target function from the GOT (Global offset table) and jumps to it. The GOT pointer is usually filled in by the dynamic loader (ld.so or an analog) at the program's startup. So indeed, the real function should be in one of the dependent shared libraries....


4

The C parser of Ghidra has various issues, e.g. it has a less extensive list of sane preprocessor variables and it just completely chokes on GCC attributes. I personally tried some approaches to make this work better, e.g. using the clang/gcc preprocessor to dump one giant header file, but they are still highly experimental and probably require a lot of ...


4

It sounds like you are looking for proper debugger integration in Ghidra. This has recently been published to the GitHub repository in the debugger branch. There is also a good blogpost showcasing it. Sadly there does not seem to be a x64dbg backend yet, but I would expect that this will appear as either an official backend or a community plugin at some ...


4

Since local variables are usually placed on the stack in x86 and esp register can change during function execution, it is more convenient to save the value of esp register on function entry and access data relatively to that value. ebp register is used for this purpose. So you will often see push ebp mov ebp, esp lines at the begining of functions. In the ...


4

if I understand the question correctly, then analyzeHeadless documentation will help you. Headless Scripts: Passing Values Between Scripts If you are running multiple scripts in headless operation and would like to store a value in one script that is accessible by another script, use the HeadlessScript methods below. They facilitate the storage and ...


4

I've figured it out. One of my earlier tests had been done wrong, it turns out it is just a simple case of "add up all the firmware bytes and make sure it equals X".


3

Theory The first important thing to understand is that the decompiler always decompiles only a single function at once and that the results of this analysis are not propagated by default. So the decompiler will happily analyse a function like charTranslateToHex and come to the conclusion that it uses 3 parameters and returns none, but decompile a function ...


3

IIRC the typeid operator returns a pointer to a type info instance. Overall the code looks like a lambda expression implementation; the “constructor” captures the context so that the “handler” (lambda body) can access the variables it needs from the outer scope.


3

Press t and it should be in the expanded view for the generic lib.


3

I think you should debug your script on smaller programs first. It is possible that the arguments you are passing are incorrect (I don't have your complete program so that I can tell). It is also possible that the dwarf section is damaged on unrecognizable. The following program runs fine on my machine. monitor = ConsoleTaskMonitor() options = ...


3

The cleanest way to do this is to click on Options when importing a file: then activate Load External Libraries and make sure that the paths where the libraries are located appear in the list you can change with Edit Paths This will import all required libraries into Ghidra: and resolve the external symbols to the providing library: You can now (auto) ...


3

LEA means "Load Effective Address", i.e. instead of loading into the EAX register the content at the address ESP+8, it loads directly the address, i.e. the content of the register ESP increased by 8. For illustration, if in the ESP register (Extended Stack Pointer) is the value 1000, the situation may be as this: Then your instruction LEA EAX, [...


2

As Rolf Rolles already mentioned there are two distinct kinds of P-Code that can be displayed and accessed. The first kind is the lifted instruction information. You can display it by opening by clicking the "Edit the Listing Fields" button at the top of the Listing: and then right click the PCode bar and Enable Field: Once this is enabled you ...


2

For posterity: the decompiler was open-sourced not too long after the initial release of Ghidra. Its code is here.


2

This is one method to do it. from ghidra.program.util import DefinedDataIterator from ghidra.app.util import XReferenceUtil for string in DefinedDataIterator.definedStrings(currentProgram): for ref in XReferenceUtil.getXRefList(string): print(string, ref) There are alternative definedStrings iterators and other ways to use XReferenceUtil in the docs.


2

Seems like you've already figured this out, but this is a Ghidra markup. It can be enabled/disabled via Edit -> Tool Options -> Listing Fields -> Operands Field -> Always Show Primary Reference Here's what the help says about the option: Always Show Primary Reference - Option to force the display of the primary reference on all operands.  If a ...


2

You can do something like: # get all functions functions = program.getFunctionManager().getFunctions(True) for function in functions: cur = function.getEntryPoint() while cur: inst = getInstructionAt(cur) if inst: # add similar check for call instruction if "RET" in inst.getMnemonicString(): ...


2

It's not possible currently (Ghidra 9.2.2) to do what you're asking. Each processor is identified by a 4-tuple of architecture, endianness, size, and variant. You can only specify an ID once. So unfortunately, you can't just add another .ldefs file somewhere and "open up" the language (internal name for a processor) to add new compiler spec ...


2

This is possible. You can select desired analysis options in the prescript. Checkout this function - setAnalysisOption in GhidraScript class. You can also look @ this example script. So, in your case you can do something like: from ghidra.app.script import GhidraScript setAnalysisOption(currentProgram, "ARM Constant Reference Analyzer", "false&...


2

As Paweł Łukasik point out, it looks like RC4 indeed. That's especially true for the KSA that you can immediately recognize: local_14 = 0; while (local_14 < 0x100) { local_12c[local_14] = (byte)local_14; local_14 = local_14 + 1; } If you rename the variables by keeping in mind that this is a Key-Scheduling Algorithm, you end up with the ...


2

0005b0c2 40 f2 38 41 movw r1,#0x438 0005b0c6 04 46 mov r4,god 0005b0c8 c0 f2 70 01 movt r1=>god_size_marker?,#0x70 The movw and movt together will set r1 to 0x700438 (0x70<<16 + 0x438) so this is the amount being cleared and likely the amount being allocated. It seems that Ghidra replaces it by the address ...


2

I want to get the value of e.g. e_cp, the "Pages in file", in this case 3, ideally as a proper Ghidra datatype in case that is a pointer, address or some more complex datatype You have to access a member of a struct (or an array) with the getComponent method, e.g. in Kotlin code( easily changed to Python or Java): var struct: DataDB = getDataAt(...


2

According to the official documentation unzipping the extension .zip into the <GhidraInstallDir>/Ghidra/Extensions folder should be enough. As you specified in the comments the specific plugin this is about is Ghidra C++ Class and Run Time Type Information Analyzer and it only works after going through the initial "New extension plugins detected....


2

I think you are running into a case of "shifted pointers". For various reasons the compiler might generate code where a pointer to the middle of a struct is returned. There is a Ghidra PR for this, but this isn't merged yet and still has various issues, IDA discusses this feature here


Only top voted, non community-wiki answers of a minimum length are eligible