User Tools

Site Tools


reverse_engineering:ghidra:create_a_project

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision
Previous revision
reverse_engineering:ghidra:create_a_project [2022/03/12 10:50] kitorreverse_engineering:ghidra:create_a_project [2022/04/01 17:46] (current) – [Initial analysis] kitor
Line 33: Line 33:
 Close by clicking OK on all dialogs, and then acknowledge the import result. File will appear in a project. Close by clicking OK on all dialogs, and then acknowledge the import result. File will appear in a project.
  
-===== Initial analysis =====+===== Project preparation =====
  
 Click twice on newly imported file. It will bring up "Code Browser" window. Click twice on newly imported file. It will bring up "Code Browser" window.
  
 Ghidra will ask if you want to perform auto analysis now - select **No**. Ghidra will ask if you want to perform auto analysis now - select **No**.
 +
 +=== Load 2nd ROM file (where applicable) ===
 +
 +Go to ''File -> Add to program''. Select second ROM file. Import dialog will appear, but this time it will have language settings already in place.
 +
 +Open ''Options'', set Block name to something meaningful and Base Address to ''0xF0000000'' for Digic 7,8,X
  
 === Fix memory map === === Fix memory map ===
  
-Navigate to ''Window -> Memory Map''. In the only existing row (representing loaded ROM image) __uncheck__ tick in "W" (writable) column. This may affect analysis, and affects decompiler results.+Navigate to ''Window -> Memory Map''. In rows representing loaded ROM images __uncheck__ tick in "W" (writable) column. This may affect analysis, and affects decompiler results.
  
 +=== Add other memory regions ===
 +
 +This topic has a separate Wiki section: [[reverse_engineering:ghidra:memory_map|Defining memory map in Ghidra project]]
 +
 +== Result ==
 +
 +Complete memory map for EOS R 1.8.0 (internal 7.3.9) firmware:
 +
 +{{ :reverse_engineering:ghidra:ghidra_r180_memory.jpg|}}
 +
 +===== Initial analysis =====
 +
 +Project is now ready to start disassembling.
 +
 +=== Configure auto analysis ===
 +
 +Navigate to ''Analysis -> Auto analysis "<file_name>"''.
 +
 +There's no good answer on what should be selected here (some tools may even crash Ghidra), but as a rule of thumb:
 +
 +  * Disable "Non-returning functions - discovered"
 +  * Disable "Embedded Media".
 +  * Disable "Create Address Tables". In worst cases this option exhausts system memory and crashes Ghidra. 
 +
 +Click ''Apply'' (do not click ''Analyze''!). Close the window.
  
 === Run disassembly === === Run disassembly ===
Line 59: Line 90:
 === Run auto analysis === === Run auto analysis ===
  
-Navigate to ''Analysis -> Auto analysis "<file_name>"''+Go back to ''Analysis -> Auto analysis "<file_name>"''.
- +
-There's no good answer on what should be selected here (some tools may even crash Ghidra), but as a rule of thumb: +
- +
-  * Disable "Non-returning functions - discovered" +
-  * Disable "Embedded Media"+
-  * Disable "Create Address Tables". In worst cases this option exhausts system memory and crashes Ghidra+
  
-Run the analysis - it will take a long time. After it is done, you may want to run "one shot" analysis for Embedded media and for Create Address Tables - but YRMV.+Run the analysis - it will take a long time. After it is done, you may want to run "one shot" analysis for Embedded media and for Create Address Tables - but YMMV.
  
reverse_engineering/ghidra/create_a_project.1647078659.txt.gz · Last modified: 2022/03/12 10:50 by kitor