NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
51.36k stars 5.85k forks source link

Ghidra can't open large files? #1040

Open E4ck opened 5 years ago

E4ck commented 5 years ago

I tried to disassemble a 100M+ mips file with ghidra, but it has been executed for 4 days and its analysis progress bar is still 0%. Does ghidra limit the size of the disassembled file?

E4ck commented 5 years ago

Shown under the "Decompiler" progress bar is: "NoReturn - find functions that cannot be returned" I am using ghidra 9.04, Java11, Windows10

emteere commented 5 years ago

4 days...you are patient.. There is no size limit. I just did a 1Gig binary. It had the same issues, although it completed in 17 hours on a slow machine. The NoReturn algorithm can get stuck as it is checking and fixing a large graph but will eventually complete. I wouldn't wait if it is taking that long. My usual limit is 20 minutes without much progress, and then I start looking for a root cause. We're looking at an alternative to solve the issue before the damage from non-returning function disassembly is caused. You can turn off the analyzer, then let analysis complete without it. Then run the FixupNoReturn script after the fact, and choose the routines to make non-returning, or note the locations. That may take a long time too. If there are key non-returning functions, it can help to find the most called ones then disassemble, and create a function there marked non-returning before running full analysis. If the MIPS has a stack_chk_fail call right before each function that can cause slow down in main analysis. One function then flows into another until the stack_chk_fail is turned into a non-returning function. This would be a candidate to mark non-returning before full analysis.

E4ck commented 5 years ago

Ok, thank you for your reply.

pabx06 commented 4 years ago

have a similare issue with CreateFunctionCmd. 8hour so far stuck. with the gui frozen and cpu locked near 100% i have 1955 no-return functions 'nullsub in ida' mostly. i have file with offsets. however i don't know either how to manually mark them nor witch api i could use.

image

image