ghidra gotchas.md

things that will confuse you about ghidra if you're like me

Pointers are the wrong size in archives

Certain data types are "dynamically sized", such as pointers and a lot of the built-in integer types (looking at ulong). This means that their sizes depend on the context they're used in. In a program, your pointers will be the correct size for the architecture. Unfortunately, archives are not associated with a program and fall back on the defaults, where pointers are 4 bytes long. If you use a pointer in a struct and associate it into a program, the pointer will resize to the correct size.

References

• https://github.com/NationalSecurityAgency/ghidra/blob/eaf051429882d763ecc88fddad793b262d7f94df/Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/data/DataOrganizationImpl.java#L37
• https://github.com/NationalSecurityAgency/ghidra/blob/eaf051429882d763ecc88fddad793b262d7f94df/Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/data/PointerDataType.java#L51
• NationalSecurityAgency/ghidra#844

size_t is the wrong size on AArch64

In generic_clib_64, size_t is typedef'd to ulong. This is cool and good for Linux, where long changes size to match the bitness. On 32-bit linux, long is 4 bytes. On 64-bit linux, long is 8 bytes. Unfortunately, the people who wrote the BuiltInTypes for Ghidra are Windows people and made long be 4 bytes on AArch64. Blame AARCH64.cspec. This means that size_t will be 4 bytes and will confuse you.

References

• https://github.com/NationalSecurityAgency/ghidra/blob/eaf051429882d763ecc88fddad793b262d7f94df/Ghidra/Processors/AARCH64/data/languages/AARCH64.cspec#L13
• https://github.com/NationalSecurityAgency/ghidra/blob/eaf051429882d763ecc88fddad793b262d7f94df/Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/data/DataOrganizationImpl.java#L42

things that will bite you working on ghidra if you're like me

java.lang.NoClassDefFoundError: Could not initialize class

This looks like the build system just casually forgot to include whatever class you broke, but the important part is the message: "could not initialize class". This isn't telling you that the class couldn't be initialized because there was no definition for it, this is telling you that there is no definition for it because the definition it found could not be initialized because statics failed to get initialized or something.

The real error is helpfully hidden from you, since you probably didn't want to see it anyway.