# MIPS ELF analysis through Ghidra

> Documents REA’s Ghidra lane for MIPS ELF executables, relocatable objects and MIPS16 shared images, including a pinned 32-bit language for recordless legacy firmware executables that Ghidra would otherwise import as 64-bit. Admission is bounded by declared header and ABI-record facts, and verification compares source-owned fixtures with independent readelf output rather than executing or rehosting firmware.

- Type: Documentation
- Targets: Binary · Firmware
- Category: Official REA: investigation guides
- Relationship: Official REA documentation
- Sources reviewed: 2026-10-18
- Added to the catalog: 2026-10-18
- Original resource: <https://github.com/morluto/rea/blob/main/docs/ghidra-mips.md>
- Primary source: <https://github.com/morluto/rea/blob/c12d9eda87aa5a022ee7e18ea96d8d03bfd12e96/docs/ghidra-mips.md>
- Catalog page: <https://awesomerea.org/resources/rea-ghidra-mips-guide/>
- Record JSON: <https://awesomerea.org/resources/rea-ghidra-mips-guide/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/rea-ghidra-mips-guide/index.md)

## Requirements & limits

- Needs a caller-installed Ghidra and compatible JDK on a supported Linux or macOS host; Windows Ghidra P0 does not admit MIPS, and Hopper/IDA gain no MIPS support. The lane does not execute MIPS code or rehost firmware. The standard profile admits ELF32 executables and relocatable objects declaring o32 and MIPS32r2; MIPS16 shared images have a separate bounded profile. ELF64, n32/n64, microMIPS, machine variants, FP64, NAN2008 and PSP PRX are refused.
- Merged PR #1898, for issue #1620, admits recordless legacy ELF32 executables with EF_MIPS_ARCH_32 or 32R2, an unspecified ABI field and an inspected absence of ABI-flags records. It pins MIPS:<LE|BE>:32:default and checks the language Ghidra reports after import. o32 is recorded as an analysis assumption, not a declared fact, and floating-point ABI semantics stay unverified.
- Optional real-provider lanes need caller-supplied Clang with MIPS targets, LLD, GNU readelf or MIPS cross-binutils, and Ghidra. They build source-owned fixtures in both byte orders without executing them, comparing instruction bytes, symbols, languages and relocations with independent readelf facts. The guide states that pseudocode presence and decoding agreement do not establish runtime, delay-slot or complete floating-point semantics.
- The issue author reports gating a local patch on four real MIPS32 LE firmware ELFs whose function entries matched separate 32-bit Ghidra exports, and 400 of 5,250 functions lost on one image under auto-selection; those files are not public. A PR reviewer tested header-edited OpenWrt kernels and BusyBox builds with Capstone cross-checks and found no unedited public recordless file.
- REA declares MIT. Ghidra, compilers, binutils and analysed firmware keep their own terms, and the firmware behind the author’s results is not supplied.

## Primary sources

1. <https://github.com/morluto/rea/blob/c12d9eda87aa5a022ee7e18ea96d8d03bfd12e96/docs/ghidra-mips.md>
2. <https://github.com/morluto/rea/issues/1620>
3. <https://github.com/morluto/rea/pull/1898>
4. <https://github.com/morluto/rea/blob/c12d9eda87aa5a022ee7e18ea96d8d03bfd12e96/scripts/verify-real-ghidra-mips.mjs>
5. <https://github.com/morluto/rea/blob/c12d9eda87aa5a022ee7e18ea96d8d03bfd12e96/tests/conformance/ghidra/mips-fixture.mjs>
6. <https://github.com/morluto/rea/blob/c12d9eda87aa5a022ee7e18ea96d8d03bfd12e96/src/ghidra/GhidraMipsProfile.ts>
7. <https://github.com/morluto/rea/blob/c12d9eda87aa5a022ee7e18ea96d8d03bfd12e96/LICENSE>

## More in References and learning

- [PSP static ELF analysis through Ghidra](https://awesomerea.org/resources/rea-ghidra-psp-guide/index.md) · Documentation
- [NativeAOT metadata recovery with Ghidra](https://awesomerea.org/resources/rea-ghidra-nativeaot-guide/index.md) · Documentation
- [REA & AI RE Tools Guide (unofficial)](https://awesomerea.org/resources/reaguide-unofficial-rea-guide/index.md) · Learning resource
- [OpenSecurityTraining2](https://awesomerea.org/resources/ost2/index.md) · Learning resource
- [pwn.college: Reverse Engineering](https://awesomerea.org/resources/pwn-college-re/index.md) · Learning resource
- [Reverse Engineering for Beginners](https://awesomerea.org/resources/re-for-beginners/index.md) · Learning resource

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.