Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Incorrect symbol address for some functions in Ghidra #101

Open
antkss opened this issue Jun 2, 2024 · 7 comments
Open

Incorrect symbol address for some functions in Ghidra #101

antkss opened this issue Jun 2, 2024 · 7 comments

Comments

@antkss
Copy link

antkss commented Jun 2, 2024

image

@antkss
Copy link
Author

antkss commented Jun 2, 2024

i still can use disassemble cookhim but these numbers are in a wrong order
image

@antkss
Copy link
Author

antkss commented Jun 2, 2024

chall.zip
this is the binary

@mahaloz
Copy link
Owner

mahaloz commented Jun 3, 2024

Would you be able to describe in more detail what the bug is? In your first screenshot, I can see the decompilation. d2d does not touch how disassemble works, so I'm not sure what the bug is here.

@antkss
Copy link
Author

antkss commented Jun 3, 2024

my program is in main function right now
you can see gdb show us it's the main function and these number here is following the order
2024_06_04_0aw_Kleki
but when connected to ghidra, it shows in wrong order
image
sometime it doesn't show any number, i need these numbers because it can use to set breakpoint
image

@antkss
Copy link
Author

antkss commented Jun 3, 2024

the issue happends only when i use ghidra, binary ninja or angr is fine

@mahaloz
Copy link
Owner

mahaloz commented Jun 4, 2024

@antkss, so if I understand this correctly, the issue is the number <+0> shown next to the addresses? This really seems like a pwndbg issue. Are you sure this is reproducible in something like GEF?

@antkss
Copy link
Author

antkss commented Jun 4, 2024

@antkss, so if I understand this correctly, the issue is the number <+0> shown next to the addresses? This really seems like a pwndbg issue. Are you sure this is reproducible in something like GEF?

gef is in trouble too, raw gdb either

#101 (comment)

@mahaloz mahaloz changed the title can't decompile current frame (ghidra) Incorrect symbol address for some functions in Ghidra Jun 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants