Switching from x64dbg dump to Ghidra without losing comments

@zulu

I would have written the opposite conclusion a year ago. The load-bearing line: I dump after OEP, load in Ghidra, and all my x64dbg comments

I ran this on a licensed corpus binary. The load-bearing line: I dump after OEP, load in Ghidra, and all my x64dbg comments are gone. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Pinned a comment at 0x140000915 in the listing.

@bashirhub

Bookmarking this for the lab wiki. «Switching from x64dbg dump to Ghidra without losing comments» — specifically I dump after OEP, load in G

This matches a public n-day class from last patch Tuesday. You wrote «I dump after OEP, load in Ghidra, and all my x64dbg comments are gone». That is the sentence I keep. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. I wrote a 12-line script and then threw it away. The listing was enough.

@abdulpro

I ran this on a licensed corpus binary. The load-bearing line: I dump after OEP, load in Ghidra, and all my x64dbg comments are gone. FID fo

Quote the bytes or sit down. Bookmarking this for the lab wiki. The load-bearing line: I dump after OEP, load in Ghidra, and all my x64dbg comments are gone. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I wrote a 12-line script and then threw it away. The listing was enough.

@bukunmivibe

Quietly the best note on this board this month. The load-bearing line: I dump after OEP, load in Ghidra, and all my x64dbg comments are gone

You skipped isolation and then asked why the box is dirty. That is on you. Agreed on the class, not on the tool. On «Switching from x64dbg dump to Ghidra without losing comments»: I dump after OEP, load in Ghidra, and all my x64dbg comments are gone. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. My note id for this: 32-06.

Bookmarking this for the lab wiki. «Switching from x64dbg dump to Ghidra without losing comments» — specifically I dump after OEP, load in Ghidra, and all my x64dbg comments are gone. Call-convention mass-correct with a script. Still too much clicking. Which build of the tool? I got burned mixing notes across versions. My note id for this: 32-03.

Quietly the best note on this board this month. The load-bearing line: I dump after OEP, load in Ghidra, and all my x64dbg comments are gone. Listing first. The decompiler invented a cast last week that hid a signed compare. Version in my shot: current lab snapshot, not last year's blog.

I would have written the opposite conclusion a year ago. The load-bearing line: I dump after OEP, load in Ghidra, and all my x64dbg comments are gone. Call-convention mass-correct with a script. Still too much clicking. I wrote a 12-line script and then threw it away. The listing was enough.