是否可以执行一部分分解代码？
我目前正在尝试解决逆向挑战，其中为32位Linux系统编辑了C代码。
为了解决这一挑战，我试图利用Ghidra，但面临一些问题。到目前为止，我所做的一切：
我有两个操作系统，我的笔记本电脑上有一个64位Linux系统和这款64位Windows 10。显然，该程序是用GCC编辑的，没有A -G选项，使Ghidra失败。调试程序。在终端中使用GDB手动调试它是可能的，但使用可怕（至少对我而言）。
因此，我所能做的就是查看Ghidra的CodeBrowser中的汇编代码及其各自的解开C代码。因此，我必须了解，在程序中运行时进行了一些说明，为了进一步分析代码，我希望能够执行指令的一部分以缓慢但肯定地解密并理解的隐藏部分程序。
话虽如此，这里唯一的问题是我不知道我该怎么做。我注意到Ghidra具有运行Java代码的能力，但是Ghidra提供的所有示例允许我仅将硬编码说明修补到程序中，但不能实际执行/评估它们。
我手头的具体问题是遵循程序的一部分（绿色标记部分）： 吉德拉（Ghidra）拥有执行此部分所需的所有知识，我只是不知道该怎么做。我可能是手工做的，但这只是无聊，而不是为什么我要做这些挑战的原因，这与为什么我不在寻找为我解开此程序的完成脚本而是为了执行该程序的方法我的分析。
最终总结了我的问题：我要求一种方法来执行Ghidra的绿色标记的解密部分，而无需启动调试器（因为Ghidra调试器使我失败了）。
I am currently trying to solve a reversing challenge, where c code is compiled for a 32bit linux system.
To solve this challenge I am trying to make use of ghidra but am faced with a few issues. A bit of a summary what I have done up to this point:
I have two OS available to me, one 64bit Linux System on my Laptop and this 64bit Windows 10. Apparantly the programm was compiled with gcc without a -g option making ghidra fail to debug the programm. Manually debugging it with gdb in Terminal is possible but terrible to use (at least for me).
So all I can do is look at the assembler code in the CodeBrowser of Ghidra and its respective decomipled c code. With that I got to understand that some of the instructions are decrypted during the runtime of the programm and in order to further analyse the code, I want to be able to execute parts of the instructions to slowly but surely decrypt and understand the hidden parts of the programm.
That being said, the only issue here is that I do not know how I can do that. I have noticed that ghidra has the ability to run java code, but all the examples I looked at that were provided by ghidra allow me to only patch hardcoded instructions into the programm but not to actually execute/evaluate them.
My specific issue at hand is following part of the programm (green marked part):
Ghidra has all the knowledge it needs to execute this part and I just do not know how to do that. I could of cause do it by hand, but that is just boring and not really why I am doing these challenges and that is the same reason as why I am not looking for finished scripts that unpack this programm for me but for a way to execute my analysis.
Finally to summarize my question: I am asking for a way to execute the green marked decrypting part of the targeted programm in ghidra without starting the debugger (since the ghidra debugger keeps failing on me).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我认为您在这里混合一些东西。你说：
使用
-G -G添加的调试信息使分析和调试程序更容易，因为您拥有否则会有的信息通过逆向工程恢复。这应该不是 对您是否可以首先在调试器下运行该程序，并且正如您指出的那样，在终端工作中使用GDB运行它。 Ghidra调试器基本上只是在后台运行GDB并将其附加到交换信息，因此应该工作。您现在有一些选择：
1。让Ghidra调试器使用此二进制运行的任何问题
与Ghidra Debugger遇到的任何问题可能是 https：// reverversEngineergingeringeringing的有效问题。 .stackexchange.com/
从那时起，您可以采取初步计划来通过调试来解决此问题。
2。写一个ghidrascript以重新实现解密
理解您正确识别为某种解密循环的基本思想。然后，您可以使用Ghidra的脚本选项之一[0]来编写一个简单的脚本来重新实现此解密，但将解密的值直接写入Ghidra存储器。
任何脚本语言显然都将包括基本的算术操作，例如
+-和xorand loops，Ghidra API提供了功能byte getByte（地址）和setByte（地址地址，字节值）。如果您在编写此脚本时遇到任何问题或API问题，这也将是Re stack Exchange的有效后续问题。这种方法的优点是您可以 stat上再次分析Ghidra内部的数据，例如拆卸所得代码。
[0] Ghidra本地支持Python 2.7和基于Java的脚本和基本的Python替补，但是还有其他选项，例如基于jupyter和基于脚本的kotlin 或 ruby，kotlin和clojure脚本
I think you are mixing up a few things here. You say:
The debug information added with
-gmakes it easier to analyze and debug a program because you have information that would have otherwise have to be recovered by reverse engineering. This should not have an influence on whether you can run the program under a debugger in the first place, and as you noted running it with gdb in the terminal works. The Ghidra debugger basically just runs gdb in the background and attaches to it to exchange information, so it should work.You have a few options now:
1. Get the Ghidra Debugger to run with this binary
Whatever issue you are encountering with the Ghidra debugger is probably a valid question for https://reverseengineering.stackexchange.com/
From then on you can pursue your initial plan to solve this via debugging.
2. Write a GhidraScript to reimplement the decryption
Understand the basic idea of what you recognized correctly as some kind of decryption loop. Then you can use one of Ghidra's scripting options[0] to write a simple script that reimplements this decryption, but writes the decrypted values to the Ghidra memory directly.
Any scripting language will obviously include basic arithmetic operations like
+-, andxorand loops, and the Ghidra API provides the functionsbyte getByte(Address address)andsetByte(Address address, byte value). If you encounter any issues or API questions while writing this script that will also be a valid follow up question for the RE Stack Exchange.This approach has the advantage that you can then statically analyse the resulting data inside Ghidra again, e.g. disassemble the resulting code.
[0] Ghidra natively supports Python 2.7 and Java based Scripts and a rudimentary Python REPL, but there are other options like Jupyter and Script based Kotlin or Ruby, Kotlin and Clojure Scripts