Changes
Page history
Update An Introduction to Ghidra
authored
Apr 10, 2019
by
Aaron Scott Pope
Show whitespace changes
Inline
Side-by-side
Tool-Guides/An-Introduction-to-Ghidra.md
View page @
90b76c84
...
...
@@ -73,13 +73,13 @@ Right-clicking in the Decompiler window gives the option `Edit Function Signatur
We can provide the correct function signature for main, then click
`OK`
:


The code in the Decompiler window is updated and references to
`argc`
and
`argv`
are corrected throughout.
We can also rename variables and fix their type to make the code more understandable.
Middle-clicking with the mouse on a variable highlights its use throughout the code:


Pressing
`l`
allows us to change the variable name, and pressing
`Ctrl+l`
lets us change the variable type.
We can see that
`iVar1`
is used as a return value, so let's rename it
`retvar`
.
...
...
@@ -87,7 +87,7 @@ This actually splits the uses of `iVar1` into two variables, one of which is use
We'll rename that to
`cmpvar`
.
We'll also change the type and name of
`size_t __n`
to
`int password_length`
to match its use.


Once we've identified the intended behavior of a section of code, we can make a comment to save ourselves from repeated work.
Right-click and select
`Comments > Set ...`
to open the comment dialogue.
...
...
@@ -97,12 +97,12 @@ Types of comments possible include end-of-line, pre, post, plate, and repeatable
Depending on the type, an entered comment will show up in the assembly listing, decompiled source, or both.


Double-clicking the name of any function will show the code of the selected function.
Here we'll double-click
`strlen`
to show the placeholder assembly code used for the external function.


There are numerous views that can be used to further analyze a binary.
`Window > Function Call Graph`
shows the calling relationship between functions as a graph.
...
...
@@ -111,7 +111,7 @@ There are numerous views that can be used to further analyze a binary.
`Window > Function Graph`
shows how execution can be traced through the assembly by function calls or jump instructions.


`Window > Defined Strings`
shows a list of extracted strings and clicking on a string takes you to the relevant portion of the assembly code.
...
...
...
...