Search the Community

Ghidra Software Reverse Engineering Framework Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra extension components and/or scripts using Java or Python. In support of NSA's Cybersecurity mission, Ghidra was built to solve scaling and teaming problems on complex SRE efforts, and to provide a customizable and extensible SRE research platform. NSA has applied Ghidra SRE capabilities to a variety of problems that involve analyzing malicious code and generating deep insights for SRE analysts who seek a better understanding of potential vulnerabilities in networks and systems. If you are a U.S. citizen interested in projects like this, to develop Ghidra and other cybersecurity tools for NSA to help protect our nation and its allies, consider applying for a career with us. Ghidra 10.1.3 Change History (April 2022) Improvements API. Added the getActiveGraphDisplay() API method to GraphDisplayProvider to get the active graph. (GP-1804, Issue #4060) Debugger. Created better comment in Dynamic Listing Go To dialog so users don't default to *:4 EAX syntax. (GP-1820) Debugger. Created new navigation methods for Objects representing addresses. (GP-1822) Debugger. Switched to DomainFile name in Debugger dialogs to avoid confusion. (GP-1872) Debugger:Trace. Improved performance of trace database. (GP-1727) FID. Updated stale signatures in the FID database files. (GP-1853, Issue #2877) Importer:ELF. Added support for additional ELF ARM-32 relocations not previously handled (R_ARM_THM_JUMP8, R_ARM_THM_JUMP11, R_ARM_THM_MOVW_ABS_NC, R_ARM_THM_MOVT_ABS, R_ARM_THM_MOVW_PREL_NC, R_ARM_THM_MOVT_PREL, R_ARM_THM_MOVW_BREL_NC, R_ARM_THM_MOVW_BREL, R_ARM_THM_MOVT_BREL). (GP-1742, Issue #2794) Processors. Refactored the 6805/6809 processor to better allow variants of MC6800 processor line. (GP-1695, Issue #3673) Processors. Added 16-byte return values for AARCH64 in X0, X1. (GP-1739) Scripting. Improved RecoverClassesFromRTTIScript's method to validate GCC programs. (GP-1832) Bugs Analysis. Fixed FID Analyzer to run only once on programs with call-fixups or identified non-returning flow. (GP-1502) Analysis. Corrected the creation of Objective-C structures when structures collided with existing generic pointers laid down by chained-pointer processing during import. (GP-1841) Analysis. Corrected stack reference creation and the display of current instruction stack depth in the stack-depth browser field for MIPS 64-bit language processor with 32-bit addressing. (GP-1862) Analysis. Fixed placement of constant references when a parent register's value is built up using the smaller sub-registers (hi/low). This is common on MIPS and other 8-bit processors such as AVR8. This would occasionally cause a reference to be placed incorrectly on a previous function call. (GP-1942) Basic Infrastructure. Fixed a NoClassDefFoundError that occurred when launching Ghidra in single-jar mode. (GP-1741, Issue #3961) C Parsing. CParser fixes for pragma(push), re-included header files, #if/defined() tests on define values, unicode BOM files, and full evaluation of macro expansion. Added more information to the CParserPlugin.out file prefixed with /// comments which should enable easier diagnosis of parsing issues. Reparsed current standard data archives with correct 64/32 data organizations. Fixed issue where many data types had incorrect pack() values in Windows archives, such as WNDCLASSEXW. To make use of the corrected data types, programs data types will need to be re-synchronized if they depend on the included Windows or clib data type archives. Windows VS2022 and Windows 11 SDK header files can now parse and will be included in the next feature release. (GP-1744, Issue #3756) Data Types. Corrected UnsupportedOperationException error which could occur when dragging a datatype from one archive to another. (GP-1758) Data Types. Fixed Data Types filter not being applied when using the various Find actions. (GP-1799) Debugger. Fixed the defaults for log4j file locations; template patterns for empty values were crashing the process on Windows. (GP-1731, Issue #3965) Debugger. Fixed NullPointerException caused by Debugger Console's preferred height. (GP-1766) Debugger. Fixed race condition on right-click of non-selected tree node. (GP-1845, Issue #4093) Debugger. Fixed missing eflags in Register View for dbgeng. (GP-1873) Debugger. Fixed IllegalArgumentException in TraceObjectManager. (GP-1874) Debugger:Breakpoints. Fixed issue with toggling breakpoints from within the Dynamic Listing. (GP-1706) Debugger:Memory. Fixed timing issue where Debugger Memory view may have incorrect location label. (GP-1882) Debugger:Trace. Fixed issue with StringDataType null terminators in stale trace ranges. (GP-1737) Decompiler. Updated the Decompiler Find dialog's default text when showing the dialog with comment text selected. (GP-1721, Issue #3946) Decompiler. Fixed the Decompiler Find dialog's sometimes incorrect result highlighting. (GP-1765, Issue #3928) Decompiler. Fixed a bug in the Decompiler preventing prototype overrides from being applied to calls produced by Call-Fixup injection. (GP-1792, Issue #3319) Decompiler. Updated the Decompiler hover for structure fields to show the parent name and the offset in the parent. (GP-1793, Issue #3920) Decompiler. Eliminated infinite loop in the Decompiler encountered when applying convert/equate. (GP-1924, Issue #4121) FID. Fixed bug causing Program ... has different compiler spec... exception when populating FID signatures. (GP-1839, Issue #4042) FileSystems. Fixed problem opening files in paths that start with a UNC location (\\location\path). (GP-1696, Issue #3912) Framework. Fixed bug that could cause a NullPointerException when removing custom Compiler Specification extensions from a Program. (GP-1715, Issue #3906) GUI. Fixed default function Plate Comment formatting. (GP-1717) GUI. Fixed the Search Memory Dialog buttons to re-enable after closing a long-running search results table. (GP-1753, Issue #4014) GUI. Updated Symbol Edit dialog to not allow namespaces editing with a blank name. (GP-1754, Issue #4015) GUI. Fixed table CSV export of boolean values. (GP-1764, Issue #3947, #4026) Headless. Corrected potential NullPointerException for Headless Analyzer when a specified filename to process does not exist in a searched project folder. (GP-1916) Help. Fixed Help Viewer Find feature, clearing search result highlights when the search dialog is closed. (GP-1718) Importer:ELF. Corrected MIPS type 5/6 relocation calculation. Previously, the LO16 value, extracted as an addend from the instruction, was not sign-extended. (GP-1834) Importer:PE. Fixed a bug that prevented certain types of PE files from being recognized by the PeLoader. (GP-1713, Issue #3830, #3902) Importer:PE. Detect .NET managed code in mixed Native/MangedCode binaries and only disassemble the correct x86 or CLR routines based on the current processor. (GP-1938, Issue #4159) Processors. ARM BL conditional call instruction, which calls to the next instruction, has been changed to a branch instead of a call. Calling the next instruction on ARM is generally only to get the LR register loaded for PIC code. (GP-1752) Processors. Fix bug in MIPS rdhwr instruction to use correct hardware registers. (GP-1879) Scripting. Fixed the Bytes table column rendering in the scripting TableChooserDialog. (GP-1714) Scripting. Fixed two bugs in RecoverClassesFromRTTIScript.java encountered when creating class structures. (GP-1781) Scripting. OSGI jar bundles now correctly load on Windows. (GP-1846, Issue #3995) Sleigh. Fixed bug preventing prototype model extensions with p-code from being imported. (GP-1915) [hide][Hidden Content]]