2

I'm kind of new to Ghidra Disassembler so kindly bear with me .

I was trying to install Ghidra to analyse an executable. After opening the executable in Ghidra it loads everything fine except Decompiler. Decompiler window displays

Decompiler: Unable to initialize the DecompilerInterface: Could not find decompiler executable" this error message. Also it shows "os/mac_x86_64/decompile does not exist

I downloaded it from here. I also have JDK installed in my mac. What should i do so as to make Decompiler work?

Image 1

Image 2

Image 3

As the error says there is no decompiler inside "os/mac_x86_64". Not sure on what i should do.

Image 5

James Z
  • 12,209
  • 10
  • 24
  • 44
Jaffer Sheriff
  • 1,444
  • 13
  • 33
  • Please check out this issue and the discussion: https://github.com/NationalSecurityAgency/ghidra/issues/1495 Your system may be missing a required library to execute `decompile` binary. – Robert Jan 09 '22 at 11:12
  • Checked it but it didn't solve the issue. For `from java.lang import System >>> System.getProperty("os.arch")` the output is u'x86_64'. – Jaffer Sheriff Jan 09 '22 at 11:28
  • You need to read the full thread, that was only the first check. – Robert Jan 09 '22 at 11:31
  • I read the whole thread and it didn't help me much. Sorry if I'm missing something very obvious. Unlike there where user had Linux and issue was coz of mismatch of 32 & 64 bit architecture, my machine is Mac & i have no mismatch issue which we can see from the logs. – Jaffer Sheriff Jan 09 '22 at 11:46
  • Check if the `decompile` binary exists at the path mentioned by Ghidra and check if you can execute it from within a terminal, if not check if all required libraries used by `decompile` are present. – Robert Jan 09 '22 at 12:03
  • @Robert Thank u man for ur direction . U helped me to resolve this issue. I really appreciate ur time. – Jaffer Sheriff Jan 09 '22 at 14:47

1 Answers1

2

Issue happened because I removed the decompile file while installing ghidra for the first coz gatekeeper in my Mac prompted me to remove it as it was from github. Solution to this issue is to allow it in the Security & Privacy . Thank you @Robert for ur inputs and ur time. U saved me ton of time.

Image 1

Clicking "Allow Anyways" without removing decompile fixed the issue for me.

Image 2

Jaffer Sheriff
  • 1,444
  • 13
  • 33