ghostrings

Ghostrings Scripts for recovering string definitions in Go binaries with P-Code analysis. Tested with x86, x86-64, ARM, and ARM64. Scripts Golang These can be found in the Golang category in the Script Manager. GoDynamicStrings.java Analyzes P-Code to find string structures created on the stack...

EvilClippy

This tool was released during our BlackHat Asia talk March 28, 2019. A video recording of this talk is available at https://www.youtube.com/watch?v=9ULzZA70Dzg. Evil Clippy A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code via P-Code and...

CVE-2026-100504 Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128

Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts from p-code. Attackers can craft malicious binaries with specific instruction sequences that trigger the overflow when decompiled...

CVE-2026-100504

Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability within the decompiler's leftshift128 function. This flaw is triggered when the software processes negative shift amounts from p-code . An attacker can exploit this by crafting malicious binaries with specific i...

CVE-2026-100504 Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128

Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts from p-code. Attackers can craft malicious binaries with specific instruction sequences that trigger the overflow when decompiled...

EUVD-2026-87373

Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts from p-code. Attackers can craft malicious binaries with specific instruction sequences that trigger the overflow when decompiled...

CVE-2026-100504 Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128

Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts from p-code. Attackers can craft malicious binaries with specific instruction sequences that trigger the overflow when decompiled...

Feeding Gophers to Ghidra

Feeding Gophers to Ghidra By Max Kersten · June 6, 2023 The scripts discussed in the article are based on the magnificent work of Dorka Palotay from CUJOai. Golang malware is becoming increasingly prevalent, requiring analysts to know how to effectively analyze these files without diving into a...

Delving deep into VBScript

In late April we found and wrote a description of CVE-2018-8174, a new zero-day vulnerability for Internet Explorer that was picked up by our sandbox. The vulnerability uses a well-known technique from the proof-of-concept exploit CVE-2014-6332 that essentially "corrupts" two memory objects and...