Mixed-mode. Native + C++/CLI. ILSpy is great on the managed half and useless on the native. Ghidra is the opposite.…
beaconGUESTstarted 21 Dec 2025, 03:47pagefltFriday, 07:52
3 readingOn this crackme the bug was a signed compare. Graph hid it. Listing showed the jle. Decompiler invented a cast that…
larskmThursday, 08:41
1 readingOld Delphi 7 target (public, licensed to the lab). No TDS. Ghidra treats it as a blob of stdcall with crazy stack f…
UPX, but they patched the magic so upx -d shrugs. The stub is still UPX. Restore the magic, decompress, move on. I …
avx512Tuesday, 21:54
4 readingPeople talk about RELRO like it changes the reverse. On a BIND_NOW + FULL RELRO lab binary the GOT is read-only aft…
apclevelMEMBERstarted 27 Oct 2025, 02:39
nmiwatch20 Aug 2026, 22:38
8 readingPublic COM server. Typelib exists. I still see people QueryInterface-guessing instead of loading the IDL. Ghidra's …
bswapeax17 Aug 2026, 13:00Overlay entropy looked packed. It was a ZIP of maps. file(1) on the overlay offset would have saved an hour. Please…
swapgsMEMBERstarted 5 Jun 2026, 06:03clts16 Aug 2026, 18:21
4 readingPeople call any resource blob a packer. This one is a config. Decode is 12 lines. I wish writeups would stop saying…
lldt15 Aug 2026, 05:25
8 readingInstaller. The interesting code is in the overlay, not the NSIS stub. Ghidra on the stub is a waste of a morning. 7…
headlessMEMBERstarted 15 May 2026, 03:49
loadtr14 Aug 2026, 15:02
10 readingI dump after OEP, load in Ghidra, and all my x64dbg comments are gone. Labeless/retsync is the usual answer. What i…
cryptGUESTstarted 11 Aug 2026, 17:11
fidbbuild12 Aug 2026, 12:30
3 readingDelay-load DLL. The IAT slot is a helper, not the real import, until the first call. Ghidra named it as the import …
tebselfSENIORvendorstarted 3 Dec 2025, 13:14xgetbv12 Aug 2026, 03:32
7 readingPeople dump FLOSS output and call it a day. On this crackme the interesting strings are built on the stack in 4-byt…
wrgsbaseSENIORvendorstarted 25 Sep 2025, 06:31uart1655010 Aug 2026, 00:4310 readingEmbedded signature vs catalog. People screenshot 'Digital Signatures' in Explorer and call it verified. I use signt…
kdnetMEMBERstarted 31 Jul 2026, 20:56plthook6 Aug 2026, 22:1110 readingNo PDB. I have a loop that touches what is obviously a struct at rcx+0x20, +0x28, +0x30. Creating a Ghidra struct a…
9 readingMBA pass on a CTF binary. I rewrote until the decompiler showed a xor. Then I stopped. Is there a Ghidra plugin in …
retsyncMEMBERstarted 2 May 2026, 21:56nnpflag29 Jul 2026, 20:532 readingMostly Thumb-2, a few ARM veneers. Ghidra mixed modes in one function and the decompiler invented bx loops. I split…
cioptsMEMBERstarted 28 Jul 2026, 12:48kptinote28 Jul 2026, 20:04
7 readingSPI dump from a router we own. No ELF, no PE. Vector table at 0, SP/PC look sane, then Thumb code. Ghidra language …
irpmjMEMBERstarted 20 Nov 2025, 22:49
allocaprobe24 Jul 2026, 19:035 readingTokio-ish lab tool. The interesting logic is in a generated poll() state machine. Function names are hash soup. I n…
bootmgfwMEMBERstarted 16 Jul 2026, 08:50thunkme18 Jul 2026, 16:422 readingCrash dump, matching binary gone. I have ntdll and the module list. Enough to name the crashing call, not enough to…
spidumpMEMBERstarted 11 Jul 2026, 12:08
dump_the_core12 Jul 2026, 02:07
5 readingI walked COL -> type descriptor -> name. Ghidra has an analyzer. On this binary it named 60% and left the rest. Is …
smbiosMEMBERstarted 2 Jul 2026, 18:29
gscookie5 Jul 2026, 08:056 readingCrackme decrypts import names into a heap buffer then GetProcAddress. I emulated the decryptor in 30 lines of Pytho…
tscskewMEMBERstarted 27 Jun 2026, 16:34sysenter29 Jun 2026, 05:549 readingCET-enabled public binary. incsspq around returns. Ghidra treated them as noise; the graph is still fine. Does anyo…
ud2padMEMBERstarted 20 Jun 2026, 20:34hex_olga21 Jun 2026, 17:568 readingGo 1.21+ register ABI. Ghidra still treated some functions as stack ABI and invented extra args. I set the Go calli…
wowentryMEMBERstarted 23 May 2026, 01:03
iatbound26 May 2026, 10:42
3 readingPublic sample driver (WHQL, old). I reversed the IOCTL table statically before attaching WinDbg. DeviceIoControl co…
sleighjitMEMBERstarted 10 May 2026, 09:48
dseflag18 May 2026, 04:087 readingSomeone shipped .debug_line and stripped the rest. Line numbers without types. Still gold. Ghidra imported the line…
5 readingPublic loader-style crackme. Hash + PIC stub, then a normal IAT. I named the stub Resolve and the hash table. Do yo…
yarahotMEMBERstarted 17 Apr 2026, 22:56applyenum18 Apr 2026, 10:556 readingclang-cl, /EHsc, no PDB. Throw sites have a typeinfo pointer that Ghidra left unnamed. I walked the catchable type …
flossstrMEMBERstarted 8 Apr 2026, 18:12sys_call9 Apr 2026, 10:03
9 readingPublic engine (licensed). Custom allocator, so 'follow the malloc' is a lie. I found the arena from a size class ta…
gdbrecMEMBERstarted 22 Mar 2026, 14:02
sibscale23 Mar 2026, 09:431 readingOne function: dense jump table for 0-31, binary tree for the rest. Ghidra recovered the table and missed the tree. …
ttdposSENIORvendorstarted 13 Mar 2026, 16:59
forcefn15 Mar 2026, 00:23
4 readingCrackme TLS callback checks BeingDebugged and skips the real init. Without a debugger the interesting function neve…
x64dbgbpMEMBERstarted 10 Mar 2026, 05:50
iamflex12 Mar 2026, 13:023 readingForwarded export. EAT says kernel32.Foo, the string is NTDLL.RtlFoo. Ghidra named the thunk as kernel32. Do you ren…
peb644 Mar 2026, 08:2810 readingClassic overlapping-instruction trick on a public crackme. Capstone linear sweep lies. Recursive descent with a for…
rustcsymMEMBERstarted 24 Feb 2026, 10:45chkstk24 Feb 2026, 16:427 readingR2R image. ILSpy is fine on the IL, Ghidra sees a native precompiled body and an IL blob. I want the native body na…
boltGUESTstarted 11 Feb 2026, 15:29startio21 Feb 2026, 05:172 readingPublic ARM64 Linux binary built with PAC and BTI. Ghidra shows PACIASP / AUTIASP as noise around every frame. Do yo…
gdtarch7 Feb 2026, 15:575 readingNo RTTI, no PDB. vfptrs in .rdata, slots look like functions. I am grouping by cross-refs and naming IUnknown-shape…
kprobe28 Jan 2026, 00:026 readingI still see writeups treating the rich header as 'packer residue'. It is a compiler/linker fingerprint. Useful, not…
apihashMEMBERstarted 18 Jan 2026, 00:12boundimp18 Jan 2026, 12:109 readingntdll syscall stubs are all `mov r10, rcx; mov eax, imm; syscall`. Ghidra FID sometimes names them, sometimes leave…
8 readingDecoder writes plaintext into a heap buffer, never back into .rdata. Patching the binary does nothing useful. I emu…
gscookieMEMBERstarted 3 Jan 2026, 16:25clflush3 Jan 2026, 23:051 readingRelease notes said exception-handler decompiler is less cursed. I opened an old project and re-decompiled two funct…
tailcallMEMBERstarted 29 Dec 2025, 17:34dirql31 Dec 2025, 10:304 readingSignatures for a static lib we compiled ourselves (lab). FLIRT in IDA Free is limited. Ghidra FID I can actually ge…
eatwalkMEMBERstarted 11 Dec 2025, 21:30
greybeard15 Dec 2025, 14:3810 readingMSVC C++ binary. Ghidra marked a pile of methods as __fastcall. They are thiscall. Decompiler invented extra argume…
tlsslotSENIORvendorstarted 1 Dec 2025, 05:27windbgdx3 Dec 2025, 04:242 readingNot a fan war. Same public vendor tool (40MB, lots of C++) in IDA Free and Ghidra 11. IDA won on initial auto-analy…
rootkit_ivan22 Nov 2025, 10:086 readingPublic CTF binary used a CFF pass (dispatcher + state var). I am not asking for a generic unflatten. Find the dispa…
ntos_oldMEMBERstarted 12 Oct 2025, 15:04wowteb12 Oct 2025, 20:574 readingI keep rewriting the same 'walk EAT, ror13 add' script with tiny twists. One family uses ror13, one djb2, one crc32…
coldfireMEMBERstarted 6 Oct 2025, 20:53gdtarch7 Oct 2025, 18:323 readingRustc 1.78, panic=unwind. Every fallible path fans into rust_begin_unwind and the decompiler becomes a novella. I m…
ssdtacpi20 Sep 2025, 08:157 readingStripped Go binary, ARM64, no symbols. pclntab is there but Ghidra's Go analyzer only named ~40% of functions. I wa…
packedle11 Sep 2025, 09:102 readingLegal crackme I authored. UPX -d gets the inner blob. The stub walks the IAT and XOR-decodes .text with a 4-byte ke…
hex_olgaSENIORvendorstarted 29 Aug 2025, 10:05headless5 Sep 2025, 04:046 readingSEH/VEH on x64 still confuses the decompiler when the compiler emitted overlapping unwind codes. What worked: force…
trapiceMEMBERstarted 31 Aug 2025, 23:10applyenum1 Sep 2025, 20:535 reading