NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
49.06k stars 5.65k forks source link

How to view the stack? #6658

Closed JeremyWildsmith closed 1 week ago

JeremyWildsmith commented 1 week ago

Hello,

I am trying to figure out how to look at the stack. I realize Ghidra has the stack pane, but this doesn't show the full contents of the stack, just the return addresses etc. I want a listing of 64 bit hex integers from the stack pointer down. I tried doing this in the memory view, but the endianess is wrong (it just puts the bytes next to eachother when grouped. Doesn't swap them to little-endian.)

This seems like a pretty straight-forward feature, so I must be missing something in trying to get this working.

Below is an example from x64dbg that I am hoping to get something similar to (see bottom right): image

I tried doing this in Ghidra with a memory view, but the byte grouping basically produces a big-endian 64 bit integer, where as my system is little-endian (notice pointer (0x7ff...) is in wrong byte order)

image
d-millar commented 1 week ago

The nearest equivalent we have is the “Hex Integer”, I believe, which flips the bytes as quads (not octets). At a guess, we probably never did “Hex Long” as the implementation in Java is probably just a little more work and no one asked for it.