Decompiler Usage

Use the Ghidra decompiler to analyze high-level code representations

Decompiler Overview

The Ghidra decompiler translates assembly code into high-level C-like pseudocode for easier analysis.

Implemented by the DecompilePlugin, the decompiler provides a high-level interpretation of assembly functions with interactive editing capabilities.

Opening the Decompiler

1. Enable Decompiler Window

   Access the decompiler view:

   • Window > Decompiler
   • Default: docked on right side
   • Can float or dock to any location
2. Navigate to Function

   The decompiler automatically displays:

   • Current function at cursor location
   • Updates when you navigate in listing
   • Synchronized with Code Browser
3. Wait for Decompilation

   Decompilation is performed on-demand:

   • Brief delay for complex functions
   • Progress indicator shown
   • Results cached for performance

Decompiler Interface

Main Components

Decompiler View

Primary decompiled code display:

• C-like pseudocode representation
• Syntax highlighting
• Line numbers
• Collapsible code blocks
• Token-based navigation

Function Signature

Top of decompiled view shows:

• Return type
• Function name
• Parameter list with types
• Calling convention
• Can be edited directly

Local Variables

Function-local variables:

• Stack variables
• Register variables
• Temporary values
• Renamed for clarity

Synchronization with Listing

1. Bidirectional Sync

   Decompiler and listing stay synchronized:

   • Click in decompiler → highlights assembly
   • Click in assembly → highlights decompiled code
   • Both views track same location
2. Token Highlighting

   Clicking tokens highlights:

   • All uses of the variable/function
   • Related assembly instructions
   • Data flow dependencies
3. Cross-Reference Navigation

   Follow references from decompiler:

   • Enter on function calls
   • Enter on global variables
   • Navigation history maintained

Editing in the Decompiler

Renaming Variables

1. Select Variable

   Click on variable name in decompiled code

2. Rename Action

   • Press L for rename
   • Right-click > Rename Variable
   • Enter new meaningful name
3. Apply Changes

   New name appears:

   • Throughout decompiled function
   • In assembly as comments
   • In function signature if parameter

Retyping Variables

1. Select Variable

   Click on variable to retype

2. Change Type

   • Press Ctrl + L for retype
   • Right-click > Retype Variable
   • Choose from Data Type Manager
3. Propagation

   Type changes affect:

   • Variable declaration
   • Cast expressions
   • Decompiler output clarity
   • Structure member access

Function Signature Editing

1. Edit Signature

   Modify function signature:

   • Right-click function name > Edit Function Signature
   • Or press Ctrl + Shift + G in listing
2. Modify Components

   Change signature elements:

   • Return type
   • Parameter types and names
   • Calling convention
   • Varargs specification
3. Commit Changes

   Changes trigger:

   • Automatic re-decompilation
   • Updated call sites
   • Improved type propagation

Use the ApplyFunctionSignatureCmd programmatically to set function signatures from scripts.

Decompiler Features

Hover Tooltips

Multiple hover services provide information:

Data Type Hover

Implemented by DataTypeDecompilerHoverPlugin:

• Shows full type definition
• Structure layouts
• Typedef resolution

Function Signature Hover

Implemented by FunctionSignatureDecompilerHoverPlugin:

• Complete function prototype
• Parameter names and types
• Return type information

Reference Hover

Implemented by ReferenceDecompilerHoverPlugin:

• Shows reference destinations
• Address information
• Symbol names

Scalar Value Hover

Implemented by ScalarValueDecompilerHoverPlugin:

• Displays constant values
• Multiple number formats
• Character representations

Control Flow Visualization

The decompiler shows control structures:

• If/Else: Conditional logic
• Loops: While, for, do-while patterns
• Switch: Case statement detection
• Goto: Remaining unconditional jumps

The decompiler attempts to structure all assembly into high-level constructs, but complex or obfuscated code may still contain goto statements.

Decompiler Options

Configuration Settings

1. Access Options

   Open decompiler options:

   • Edit > Tool Options > Decompiler
   • Configure analysis and display
2. Analysis Options

   Control decompilation behavior:

   • Maximum instruction count
   • Maximum payload bytes
   • Simplification style
   • Eliminate unreachable code
3. Display Options

   Customize appearance:

   • Color scheme
   • Font settings
   • Line spacing
   • Brace style (Allman, K&R, etc.)

Language-Specific Settings

Decompiler uses processor specifications:

• Calling conventions
• Register usage
• Stack frame layout
• Special instructions

For best results, ensure the correct processor specification and compiler specification are selected for your binary.

Working with Complex Code

Structures and Arrays

1. Structure Access

   Decompiler shows structure members:

   • struct->member notation
   • Offset calculations converted to members
   • Nested structure access
2. Array Indexing

   Arrays displayed with brackets:

   • array[index] notation
   • Multi-dimensional arrays
   • Pointer arithmetic simplified
3. Type Propagation

   Defining types improves output:

   • Set parameter types
   • Define global data types
   • Create custom structures
   • Decompiler propagates through code

Pointer Analysis

Decompiler handles pointers:

• Dereference operators (*ptr)
• Address-of operators (&var)
• Pointer arithmetic
• Multi-level indirection

Function Pointers

Indirect calls are shown as:

• Function pointer variables
• Casts to function types
• Indirect call notation
• Virtual function tables

Advanced Usage

Creating Disconnected Decompilers

1. Open Secondary Decompiler

   Create additional decompiler views:

   • Window > Decompiler (creates new instance)
   • Independent navigation
   • Compare different functions
2. Compare Views

   Use multiple decompilers to:

   • Compare similar functions
   • Track related code paths
   • Analyze caller and callee together

Debugging Decompiler Output

If decompilation quality is poor:

1. Check Function Boundaries

   Ensure function is properly defined:

   • Correct entry point
   • All code included
   • Return statements identified
2. Fix Data Flow

   Improve analysis:

   • Define parameter types
   • Set return type
   • Mark no-return functions
   • Fix incorrect references
3. Adjust Settings

   Try different options:

   • Increase instruction limit
   • Disable certain optimizations
   • Change simplification level

Exporting Decompiled Code

1. Copy to Clipboard

   Copy decompiled code:

   • Select code in decompiler
   • Ctrl + C to copy
   • Paste into external editor
2. Export Function

   Export single function:

   • Right-click > Export to C
   • Choose file location
   • Includes function signature and body
3. Bulk Export

   Export multiple functions:

   • Use Exporter from File menu
   • Select C/C++ format
   • Exports all or selected functions

For the best decompilation results, run full auto-analysis, define function signatures from library information, and create accurate structure definitions.