Changes

Page history
Update An Introduction to Ghidra authored by Aaron Scott Pope's avatar Aaron Scott Pope
Hide whitespace changes
Inline Side-by-side
Tool-Guides/An-Introduction-to-Ghidra.md
View page @ 90b76c84
...@@ -73,13 +73,13 @@ Right-clicking in the Decompiler window gives the option `Edit Function Signatur ...@@ -73,13 +73,13 @@ Right-clicking in the Decompiler window gives the option `Edit Function Signatur
We can provide the correct function signature for main, then click `OK`: We can provide the correct function signature for main, then click `OK`:
![fixed-main-signature](uploads/70b2040251dadaa33bef24711986f9d3/fixed-main-signature.png) ![fixed-main-signature](uploads/573b6c322c3ec6e81fe547d7a32fd676/fixed-main-signature.png)
The code in the Decompiler window is updated and references to `argc` and `argv` are corrected throughout. The code in the Decompiler window is updated and references to `argc` and `argv` are corrected throughout.
We can also rename variables and fix their type to make the code more understandable. We can also rename variables and fix their type to make the code more understandable.
Middle-clicking with the mouse on a variable highlights its use throughout the code: Middle-clicking with the mouse on a variable highlights its use throughout the code:
![highlight-variable](uploads/09c0f25aac5033bbcb8633476e00b9f1/highlight-variable.png) ![highlight-variable](uploads/9fe3ec505a78ed86c398169581c3cb6f/highlight-variable.png)
Pressing `l` allows us to change the variable name, and pressing `Ctrl+l` lets us change the variable type. Pressing `l` allows us to change the variable name, and pressing `Ctrl+l` lets us change the variable type.
We can see that `iVar1` is used as a return value, so let's rename it `retvar`. We can see that `iVar1` is used as a return value, so let's rename it `retvar`.
...@@ -87,7 +87,7 @@ This actually splits the uses of `iVar1` into two variables, one of which is use ...@@ -87,7 +87,7 @@ This actually splits the uses of `iVar1` into two variables, one of which is use
We'll rename that to `cmpvar`. We'll rename that to `cmpvar`.
We'll also change the type and name of `size_t __n` to `int password_length` to match its use. We'll also change the type and name of `size_t __n` to `int password_length` to match its use.
![renamed-variables](uploads/e477fc42a8f2162660ad02c5258b0e37/renamed-variables.png) ![renamed-variables](uploads/58963a3347adbfda3b3df32b895301f5/renamed-variables.png)
Once we've identified the intended behavior of a section of code, we can make a comment to save ourselves from repeated work. Once we've identified the intended behavior of a section of code, we can make a comment to save ourselves from repeated work.
Right-click and select `Comments > Set ...` to open the comment dialogue. Right-click and select `Comments > Set ...` to open the comment dialogue.
...@@ -97,12 +97,12 @@ Types of comments possible include end-of-line, pre, post, plate, and repeatable ...@@ -97,12 +97,12 @@ Types of comments possible include end-of-line, pre, post, plate, and repeatable
Depending on the type, an entered comment will show up in the assembly listing, decompiled source, or both. Depending on the type, an entered comment will show up in the assembly listing, decompiled source, or both.
![pre-comment](uploads/6e7236545199081cdceee1133a5324a3/pre-comment.png) ![pre-comment](uploads/beb487b6cb50d7416a223fe5a23fa09a/pre-comment.png)
Double-clicking the name of any function will show the code of the selected function. Double-clicking the name of any function will show the code of the selected function.
Here we'll double-click `strlen` to show the placeholder assembly code used for the external function. Here we'll double-click `strlen` to show the placeholder assembly code used for the external function.
![strlen-assembly](uploads/3c12b1f321d692318797610d6be8da4e/strlen-assembly.png) ![strlen-assembly](uploads/f0b04435daa8842ad422a95260786163/strlen-assembly.png)
There are numerous views that can be used to further analyze a binary. There are numerous views that can be used to further analyze a binary.
`Window > Function Call Graph` shows the calling relationship between functions as a graph. `Window > Function Call Graph` shows the calling relationship between functions as a graph.
...@@ -111,7 +111,7 @@ There are numerous views that can be used to further analyze a binary. ...@@ -111,7 +111,7 @@ There are numerous views that can be used to further analyze a binary.
`Window > Function Graph` shows how execution can be traced through the assembly by function calls or jump instructions. `Window > Function Graph` shows how execution can be traced through the assembly by function calls or jump instructions.
![function-graph](uploads/c894a3e194dcc0964087603dcf519861/function-graph.png) ![function-graph](uploads/a171faa1263362eb1fc2c448adbc5629/function-graph.png)
`Window > Defined Strings` shows a list of extracted strings and clicking on a string takes you to the relevant portion of the assembly code. `Window > Defined Strings` shows a list of extracted strings and clicking on a string takes you to the relevant portion of the assembly code.
... ...
......