User Tools

Site Tools


reverse_engineering:ghidra:create_a_project

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
reverse_engineering:ghidra:create_a_project [2022/03/13 15:59]
kitor
reverse_engineering:ghidra:create_a_project [2022/04/01 17:46] (current)
kitor [Initial analysis]
Line 62: Line 62:
  
 Project is now ready to start disassembling. Project is now ready to start disassembling.
 +
 +=== Configure auto analysis ===
 +
 +Navigate to ''Analysis -> Auto analysis "<file_name>"''.
 +
 +There's no good answer on what should be selected here (some tools may even crash Ghidra), but as a rule of thumb:
 +
 +  * Disable "Non-returning functions - discovered"
 +  * Disable "Embedded Media".
 +  * Disable "Create Address Tables". In worst cases this option exhausts system memory and crashes Ghidra. 
 +
 +Click ''Apply'' (do not click ''Analyze''!). Close the window.
  
 === Run disassembly === === Run disassembly ===
Line 78: Line 90:
 === Run auto analysis === === Run auto analysis ===
  
-Navigate to ''Analysis -> Auto analysis "<file_name>"''+Go back to ''Analysis -> Auto analysis "<file_name>"''.
- +
-There's no good answer on what should be selected here (some tools may even crash Ghidra), but as a rule of thumb: +
- +
-  * Disable "Non-returning functions - discovered" +
-  * Disable "Embedded Media"+
-  * Disable "Create Address Tables". In worst cases this option exhausts system memory and crashes Ghidra+
  
 Run the analysis - it will take a long time. After it is done, you may want to run "one shot" analysis for Embedded media and for Create Address Tables - but YMMV. Run the analysis - it will take a long time. After it is done, you may want to run "one shot" analysis for Embedded media and for Create Address Tables - but YMMV.
  
reverse_engineering/ghidra/create_a_project.txt · Last modified: 2022/04/01 17:46 by kitor