New answers tagged ghidra
2
While searching solution for my question I found related issue in GitHub repository of project: NationalSecurityAgency/ghidra#issue-19.
According to many comments, community around ghidra are waiting for this functionality allowing patching binaries.
In this comment: NationalSecurityAgency/ghidra/issue-19#issuecomment-560485351 @schlafwandler offers own ...
1
The solution that I found that suffices for my current issue of debugging the EXT4 parser is is the following Ghidra Script, saved as ImportFS.java:
import ghidra.app.script.GhidraScript;
import ghidra.formats.gfilesystem.FSRL;
import ghidra.formats.gfilesystem.FileSystemRef;
import ghidra.formats.gfilesystem.FileSystemService;
import java.io.File;
public ...
0
For starters you could start by geting rid of most of the casts then start carving out the stack and heap structs where possible, then try to change the name of variables where possible to more type oriented ones, this will show most of the "duplicate" variables.
Then start following the main flow following labels and maybe change their name to ...
5
you can right click the file you import at Active Project tab in ghidra main window, and select Set Language
1
This is a helper function used by PPC EABI conforming compilers for reducing code size. From ctrsavres.asm:
/* Routines for saving integer registers, called by the compiler. */
/* Called with r11 pointing to the stack header word of the caller of the */
/* function, just beyond the end of the integer save area. */
Because it is called by the compiler, it ...
1
Just press the Edit the listing fields button
Then go to the Instruction/Data section
Right-click on XRef Header and XRef and from the menu choose Disable field.
3
Regarding unaff_ and in_ prefixes (source):
in or unaff : this typically indicates that a register is read
before it is written (and it does not contain a parameter
passed to the function)
So, if you encounter them in decompilator, it means that their values are used before they are initialised in the function (they contain the values assigned earlier, in ...
0
In order to run a script in Ghidra you can run the following:
analyzeHeadless <project_location> <project_name> -import <path/to/file> -scriptPath <path/to/scripts> -preScript <preScript_name> <preScript_params> -postScript <postScript_name> <postScript_params>
analyzeHeadless is the Ghidra GUI-less executable ...
1
I came up with this after I read the post but couldn't find a way to make it neat and clean
just recording the thought process as pawel created an answer that is nice
>>> inst = currentProgram.listing.getCodeUnitAt(currentAddress)
>>> print (inst,inst.getReferencesFrom()[1])
(CALL qword ptr [0x1c0007050], ->NTOSKRNL.EXE::EtwRegister)
...
3
So, the answer was provided in the OP's ticket #1994, just transferring it here for the future seekers:
from ghidra.program.model.listing import CodeUnitFormat, CodeUnitFormatOptions
codeUnitFormat = CodeUnitFormat(CodeUnitFormatOptions(CodeUnitFormatOptions.ShowBlockName.ALWAYS,CodeUnitFormatOptions.ShowNamespace.ALWAYS,"",True,True,True,True,True,...
0
Indeed, it seems to be incorrect. The syntax [R0],#1 is called post-indexed: first the store (or load) is performed, and then the base address is incremented (or decremented) by the value specified. So the assignment and increment should be swapped.
As for 00 BF, it is the opcode for the NOP instruction, probably inserted to align next function on a 4-byte ...
6
By default, there is a setting in Code Browser that allows Ghidra to eliminate unreachable code, you would have to change the setting by editing the options for Code Browser. This can be done by going to Edit -> Tools Options. This would bring you to a page as seen in the screenshot below
Under the Analysis options in the Decompiler folder, there is a ...
Top 50 recent answers are included
