New answers tagged ghidra
3
From Ghidra.re:
Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable.
One reason for this is that there actually is a jump table, but the decompiler can’t determine bounds on the switch variable
For your example, this is saying there may a jump table (which is really just an array of ...
2
You can add an uninitialized block of memory in the Memory Map window. Hit the little green "Add a new block to memory" button.
Change the start address to an area not currently mapped, specify the length of the block you wish to allocate, and select Uninitialized.
0
If you are trying to change and individual string, you can right click on the first character of the string and under Data, convert it to TerminatedCString.
If you have a problem with how Ghidra is recognizing strings, you can tweak the settings in the ASCII Strings analyzer to have it recognize shorter strings, change alignments ettings or use a different ...
1
You do it from the menu of this window.
Click on this icon:
Later go to Instruction/Data tab and adjust the Operands.
1
The IEEE definition of Reverse Engineering ("Reverse Engineering and Design Recovery: A Taxonomy", IEEE, 1990) is "the process of analyzing a subject system to identify the system's components and their interrelationships and to create representations of the system in another form or at a higher level of abstraction".
However, you already ...
0
You should check the EFF RE FAQ. It might help you wrap your head around some of the legal aspects and definitions.
From where I see it, yes, it is reverse engineering. But, it's not clean room reverse engineering.
There are many layers/levels of RE. You can target the hardware, the firmware, the software, the algorithms, the architecture, ... The higher you ...
0
It's not certain that the particular map file you have is supported out of the box, but you should be able to use the Script Manager from the Window menu in Ghidra (in the Code Browser!).
A good start for your endeavor would likely be the Ghidra/Features/Python/ghidra_scripts/ImportSymbolsScript.py script aka ImportSymbolsScript (from the Script Manager).
...
0
Looks like full bitfield support for the decompiler is slated for a future release according to a comment on Ghidra's github issues: Bitfields don't seem to decompile very well #1059
Top 50 recent answers are included
