ARM Cortex-M CPUs ship with a set of on-chip trace peripherals that most developers never touch and most reverse engineers forget exist. In this post, we'll wire up an Xbox One controller, configure the ETM and TPIU from OpenOCD, and capture a live instruction trace with nothing more than a logic analyzer and Pulseview - then use Ghidra to figure out why the trace keeps dying.

With this post, I hope to explain how to set up a development environment for the latest Ghidra release on Ubuntu 20.04. After following the steps outlined below, we will have the ability to write, debug and export custom Ghidra plugins, modules, and scripts.

With this post we review Ghidra's built-in debugger and walk through how to use it on a simple ARM target

With this post we cover and review our free four session Ghidra course

In this post, I want to demonstrate and explain the following, Using pre-existing Ghidra scripts to aid in your analysis, Writing your own scripts to automate analysis tasks,Utilize and emulate Ghidra's intermediate language PCode to aid in your analysis

In my last post, we managed to dump the firmware off of an Xbox One controller by using the Single Wire Debug interface. Now that we have the firmware image as well as the target CPU determined, we can load it into Ghidra and attempt to learn more about how it works. For this post, we are focusing on learning more about how the firmware image works by writing a proper Ghidra loader and reviewing the USB stack.

The Tricore CPU architecture is commonly found in automotive embedded systems, often running an RTOS or even just bare metal firmware. This post will go over setting up an entry level toolchain for the Tricore architecture under Linux, and how we can use this toolchain when reverse engineering automotive platforms. We will also go over and provide a very simple bare metal loader.