In this blog series, I will be putting the spotlight on useful Ghidra features that you may have missed. Each post will look at a different feature and show how it helps you save time and be more effective while reverse engineering. Ghidra is an incredibly powerful tool, but much of this power comes from knowing how to use it effectively.What is Cursor Text Highlighting?In this post, I will be discussing the Cursor Text Highlighting feature. By default, this feature is activated by clicking on text in the Listing or Decompiler view with the middle mouse button (scroll wheel for most of us). As you might have guessed from the name, this feature can highlight occurrences of a string within the Listing or Decompiler view. This is a rather standard feature we’ve grown to expect in any basic graphical IDE, but use Ghidra’s Cursor Text Highlighting on a register in the Listing view and you might notice it doing something more. When using this feature to follow register usage, Ghidra will color the register according to whether it is being read from or being written to.Text highlighting can draw your attention to how an address or label is being used, especially in the early stages of a reversing workflow where many variables may share similar names. As noted in the Ghidra issue tracker, this is a useful feature, but it is not particularly well advertised, and having it tied to the middle-click by default means that many users never notice it on their own.It is important to understand, however, that there are two distinct matching behaviors:Clicking on a register highlights use of that register with the scoped read/write colo ..
Support the originator by clicking the read the rest link below.
