Search the Community

Ghidra: NSA Reverse Engineering Software Ghidra is a software reverse engineering (SRE) framework developed by NSA's Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, MacOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using the exposed API. In addition there are numerous ways to extend Ghidra such as new processors, loaders/exporters, automated analyzers, and new visualizations. In support of NSA's Cybersecurity mission, Ghidra was built to solve scaling and teaming problems on complex SRE efforts, and to provide a customizable and extensible SRE research platform. NSA has applied Ghidra SRE capabilities to a variety of problems that involve analyzing malicious code and generating deep insights for NSA analysts who seek a better understanding of potential vulnerabilities in networks and systems. Ghidra 10.0.2 Change History (August 2021) New Features Scripting. Created an example script which demonstrates how to use the FileBytes class to do a binary export of the current program. (GP-1157) Improvements Data Types. When creating a substructure from existing components, the new structure will adopt the pack setting of the parent structure from which it was created. Note that a packed structure may still move based upon component alignment rules. (GP-1111, Issue #3193) Decompiler. Added E key binding to the Decompiler's Equate action. (GP-1146, Issue #3195) GUI. Added Apply button to analysis options dialog. Also added a last chance save/cancel dialog that is shown when a user cancels an options dialog that has unsaved changes. (GP-1169, Issue #3274) Scripting. For stripped gcc binaries, improved prototype RecoverClassesFromRTTIScript identification of vtables and simple class data, constructors, and destructors. (GP-1055, Issue #3266) Bugs Basic Infrastructure. Fixed regression that prevented Ghidra from launching on Windows when its path contained spaces. (GP-1113, Issue #3201, #3205) Data Types. Fixed IllegalArgumentException error message when adding a duplicate enumerate name for EnumDataType. (GP-1173, Issue #3246) Debugger. Changed diagnostics to write GDB.log to user directory, not installation. Clarified an error message. (GP-1133, Issue #3218) Debugger. Improved error reporting when failing to start a Debugger GADP agent. (GP-1136, Issue #3175) Debugger. Added system property to toggle alternative icons/colors for breakpoints. (GP-1139, Issue #3204) Debugger. Applying a default everything memory map for GDB targets if info proc mappings fails or produces an empty list. (GP-1142, Issue #3071, #3074, #3161, #3169) Debugger. Fixed issue with Debugger ignoring JAVA_HOME when launching child JVM. (GP-1143, Issue #3231) Debugger. Fixed command-reply matching issue when using GDB via SSH. (GP-1153, Issue #3238) Debugger:Emulator. Fixed bug in Trace Emulation causing ArrayIndexOutOfBoundsExceptions. (GP-1058) Decompiler. Fixed issue causing Offset must be between... AddressOutOfBoundsException, when decompiling real-mode x86 programs. (GP-1163, Issue #239, #2948) Decompiler. The decompiler now shows results when a HighGlobal has no associated symbol reference in the program. (GP-1184) DWARF. Changed processing to ignore incomplete DWARF parameter lists in Rust binaries. (GP-1121, Issue #3060) Exporter. The C/C++ Exporter now emits semicolons after function prototypes when using the Create Header File option. (GP-1145, Issue #1644) Framework. Corrected address comparison for 64-bit signed address spaces (e.g., stack space, constant space) which could produce non-transitive comparison results. (GP-1178, Issue #3302) Graphing. Corrected graph magnification behavior when using a high resolution mouse wheel. (GP-1181, Issue #3281, #3284) GUI. Fixed NullPointerException when Hovering in Decompiler over a function that is not in memory. (GP-1131) GUI. Fixed bug in Find References to search results that prevented '<' characters from being rendered. (GP-1137, Issue #3217) GUI. Fixed issue where duplicate label names could cause the symbol tree to become unstable, evidenced by broken display and scrolling actions. Also, improved grouping algorithm. (GP-1159, Issue #3263) GUI. Fixed Enter key in Set Equates dialog to choose the selected table row. Updated the Function Signature Editor dialog to allow the Cancel key to close the dialog when the focus is in the top text editor. (GP-1162, Issue #3235) Headless. Fixed a regression in analyzeHeadless.bat that prevented the headless analyzer from running on Windows in some cases. (GP-1156, Issue #3261) Importer. The MzLoader now populates the relocation table when relocations are performed. (GP-1160) Importer:ELF. Corrected dynamic GOT/PLT markup problem for images which do not contain section headers. In cases where image does not define symbols within the PLT, analysis may be relied upon for its disassembly. ELF Importer's goal is to migrate symbols which may be defined within the PLT to the External symbol space. (GP-1110, Issue #3198) Importer:Mach-O. The Mach-O importer now correctly interprets indirect symbols as references to symbols within another .dylib. (GP-1120) Importer:PE. Improved ControlFlowGuard markup and creation of functions (GP-1179, Issue #1547, #1565) Processors. Fixed bug in SuperH4 fmov.s pcode. (GP-1152) Processors. The ARM instruction semantics for the mulitple-single-element forms of the vld1/vst1 vector instructions have been corrected. (GP-1167) Sleigh. Fixed a string formatting error in the sleigh compiler. (GP-1124, Issue #3168) [hide][Hidden Content]]

Professional Text Editor + World's Best Hex Editor 010 Editor: Professional Text Editor Edit text files, XML, HTML, Unicode and UTF-8 files, C/C++ source code, PHP, etc. Unlimited undo and powerful editing and scripting tools. Huge file support (50 GB+). Column mode editing. 010 Editor: World's Best Hex Editor Unequalled binary editing performance for files of any size. Use powerful Binary Templates technology to understand binary data. Edit 80+ formats. Find and fix problems with hard drives, memory keys, flash drives, CD-ROMs, etc. Investigate and modify memory from processes. Binary Templates - Hex Editing to a New Level Why is 010 Editor so powerful? Unlike traditional hex editors which only display the raw hex bytes of a file (1), 010 Editor can also parse a file into a hierarchical structure using a Binary Template (2). The results of running a Binary Template are much easier to understand and edit than using just the raw hex bytes. Binary Templates are easy to write and look similar to C/C++ structs except they may contain if, for, or while statements as well as functions or complex expressions. Powerful enough to parse almost any binary file format. Can be set to run automatically when files are opened. Templates may be shared and a list of templates for download is available in our Template Repository. [Hidden Content] [HIDE][Hidden Content]]