HackBlue

Tools · Ghidra · 24 / 26

Ghidra: a decompiler paste has no address

Copied decompiler text has no address. The Listing address is the location. Write that address beside the paste.

11 min read · practice only with authorization

The decompiler window is text

The decompiler prints a C-like function. You can select a line and copy it. What lands on the clipboard is that text. There is no address column in that window, so the clipboard does not grow an address on its own.

A line number in an editor you paste into is the editor counting lines. It is not a program address, and it will change if you paste a longer chunk.

The address is on the Listing row

Click the decompiler line first. When a mapping exists, a Listing row highlights. That row has the address you can cite. Write the address, then the paste. Readers can then open Go To and land on the same instruction.

If the click highlights nothing, you do not have a location for that line yet. Say so. Do not average the function start and end into a substitute address.

A ticket line that can be reopened

The note needs the function name you are in, the Listing address, and the pasted text marked as decompiler text. The paste explains the reading. The address is the place. Dropping either one leaves a sentence nobody can point at in the database.

Lab: a copied call that lost its place

Open a small function in the lab program and click a decompiler line that shows a call, such as a strlen or fopen call if your build has one. Confirm a Listing row highlights. Copy the decompiler line into the notebook with no address, and notice that the text could belong to any similar call.

Add the highlighted Listing address above the paste, and add the mnemonic on that row. The corrected note can be reopened with Go To. The address-free paste cannot.

Diagram

A paste needs an address added by hand

  1. Click

    Click the decompiler line you mean, and look at which Listing row lights up.

  2. Copy

    The copied text is the C-like line. It does not include the address column.

  3. Address

    Read the address from the Listing row that mapped, or say the mapping was missing.

  4. Note

    Put that address on the line above the paste. A paste alone is not a location.

    A strlen line that only means something with an address
    paste: len = strlen(path);
listing row that mapped: 00101402
mnemonic on that row: CALL strlen
write: address, then the paste
not: the paste as a location
A strlen line that only means something with an address
paste: len = strlen(path);
listing row that mapped: 00101402
mnemonic on that row: CALL strlen
write: address, then the paste
not: the paste as a location

Check yourself

1. You paste a decompiler line into the notebook and add nothing else. What location does that paste contain?

2. The Listing cursor is on 00101402 while you copy a strlen line from the decompiler. What do you add?

3. The decompiler line does not highlight any Listing row. What do you cite as the location?