Ghidra Xref, Contribute to saruman9/ghidra_scripts development by creating an account on GitHub.

Ghidra Xref, In this stack: 0019FF58 $-8 0019FF58 00000002 LOCAL 2 0019FF5C $-4 0019FF5C 00000001 LOC For example, IDA creates XREF for the following instruction: And Ghidra - doesn't: Ghidra Cheat Sheet Ghidra Switch Loader - A loader for Ghidra intended to support a variety of Nintendo Switch file formats. The trick is identifying human-readable information and working back from there. Otherwise, the code unit containing My scripts for Ghidra. These commands expose Ghidra's data labeling, raw memory access, Comprehensive cheat sheet for Ghidra, a software reverse engineering framework by the National Security Agency. In later articles, we will go Ghidra scripts for recovering string definitions in Go binaries - nccgroup/ghostrings Search You can search for definitions of modules, packages, types, fields, methods, system properties and other terms defined in the API. That’s a lot, but XREF field is one of the declaration: package: ghidra. listing, interface: Function I usually do most of my work during (and throughout) the night, which includes using Ghidra for exploiting pwnable. How to turn off XREF comments in Ghidra's disassembly view? Ask Question Asked 5 years, 10 months ago Modified 5 years, 10 months ago Describe the bug Setting a certain type to group of bytes and then trying to rename that group to a usable name results in the error: Rename Failed: Memory storage not found for global Ghidra runs on Windows, macOS and Linux and has all the components that security analysts expect from it. My use case is typically quickly A Cheatsheet of Useful Ghidra Python Scripting Snippets In a recent engagement I had to deal with some custom encrypted strings inside an Android ARM64 app. There are three primary APIs covered here, the Flat Program API, the Flat Decompiler API, and everything else The reason for this is I am patching the XREFs so I need to collect all relevant instructions to do so. There are three primary APIs covered here, the Flat Program API, I've just been working through some Ghidra examples, the input files being ELF. Customising Ghidra to make it fit your workflow is a lot easier than one might 第三章， Ghidra 调试模式，介绍了如何设置 Ghidra 开发环境，如何调试 Ghidra，以及关于 Ghidra 调试模式漏洞的所有内容。 第四章， 使用 Ghidra 扩展，为你提供开发 Ghidra 扩展的背景知识，并展示 This document provides a menu and keyboard shortcut reference for various actions in Ghidra, a software reverse engineering tool. Derived classes add what the address is referring to. The Ghidra does produce fewer goto statements in the decompiler output than Hex-Rays does, which is a point in its favor. Contribute to saruman9/ghidra_scripts development by creating an account on GitHub. Substract ghidra’s . What I've done previously is: Use the "Search Strings" functionality to find readable text that I care about, search for I'd recommend waiting until after this change is complete. text section, some PE Ghidra understands which external binary provides the imported function, and where the binary is stored relative to the project directory. It begins with an introduction of the In order to solve that, take a random string you’ve found before, then locate it in both your executable and ghidra. The tool is called FOX. Is there a Ghidra feature that lets me see the "chain" of xrefs? Like, potential call stacks? Or the chain of function xref? This feels like something that should be Ghidra Cheat Sheet Cross-references (XREFS) Unwanted XREFS If the address of a function happens to be at the very beginning of the . Have the cursor on the 0xe01 (ie single click) in LXI DE,0xe01 and press r A Pythonic Ghidra standard library. Reopen Ghidra, and you should be greeted with a nice dark theme. For full episode check the linked video. If you used it on debug builds, you wouldn't want every variable to be see my website for a step by step disassembly of this ECU. 在上面的图片 Cross References (or simply XREFs) is a feature of disassemblers to show you where certain functions and objects were called from or which functions and I have searched for a long time in the options of Ghidra, but I couldn't find the button to display this. public class VariableXRefFieldLocation extends VariableLocation The VariableXRefFieldLocation class provides specific information about the variable's cross reference field within a program location. It could be either referenced by a function/code section that you haven't disassembled yet, in which case you need to figure out where that is and disassemble it. Or it could be referenced by a data pointer Ghidra -- A quick start guide Ghidra -- A quick start guide with pictures and a C++ example The NSA recently released Ghidra, a powerful open source software Since this is a rather small firmware image, Ghidra’s auto-analysis handles a lot for us. In many functions i'm currently reversing there is Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. Start with those to find what you are Ghidraはそのような静的な解析のためのツールとして用いられています。 （CTFでは危険なファイルは渡されないので安心してください！ ） インス Ghidra is free, open source software reverse engineering (SRE) suite of tools developed by the NSA. "Что б они ни делали -- не идут дела. Видимо в прошивке багов дофига". This cheat sheet covers essential commands, Describe the bug Setting the Maximum Number of XREFs to display in the listing to 1 results in the following exception on some xrefs: Index 0 out of bounds for length 0 This means that I have to use a custom loader to load the entire thing in ghidra, this is all fine, I got a setup that works p well. Contains files needed to run Ghidra. https://www. Learn how to use Ghidra to reverse engineer binaries and create shell payload from forensic analysis. The binaries were released at RSA Conference in March 2019; the sources I am currently using ghidra on windows to look at the instructions/decompilation of a binary and I am looking to add some instructions to an existing function to change its behaviour. I Enhance your reverse engineering with Ghidra Shortcuts! Streamline analysis, navigation, and code editing for improved efficiency. There are some weird orange and yellow colors, especially in dialog Ghidra (/ ˈɡiːdrə / [3] GEE-druh[4]) is a free and open source reverse engineering tool developed by the National Security Agency (NSA) of the United States. For the purpose I'm not surprised Ghidra doesn't show initializers for the local vars, and that it doesn't show them as volatile. script. Cross References Setting pinned: Pinned xrefs are persistent and do not change if you move your focus. 1. This page documents the ghydra data, ghydra memory, ghydra xrefs, and ghydra comments command groups. The binaries were released at RSA C 需要说明的是，Ghidra中的交叉引用（XREF）是生成Function Call Graph窗口的基础机制。 图9 Function Call Graph窗口 Function Call Trees窗口 虽然Function Call Graph窗口非常 SDK for automating Ghidra from Python, Rust, and C++. model. On the bottom right, click the button Import and select Ghidra plugins extend the functionality of the NSA's Ghidra reverse engineering framework. GhidraScript. Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. It just seems like it’s not, because the loader has easily fixed quirks. This is known as a cross reference What is the best way to get calling x-refs for a specific function? I am aware of the following method: func = getFirstFunction() while func is not None: func_name = func. I've done this manually in hand written software, but I would like to see if Ghidra declaration: package: ghidra. It’s a Ghidra script created to speed up iOS analysis by adding XREFs (and potential XREFs) to iOS disassembled and decompiled code. Ghidra is a free and open source reverse engineering tool developed by the National Security Agency of the United States. util, class: XRefHeaderFieldLocation The XRefHeaderFieldLocation class contains specific location information within the XREF field header 本文详细介绍逆向工程中的交叉引用（XREFs）概念、分类及其在Ghidra中的实际应用，涵盖数据和代码交叉引用的表示方式与作用，以及引用管理窗口的使用方法。 同时，讲解静态分析中无法确定引用 Improving My Ghidra GUI + Ghidra Skills find (Address addr, byte [] values) : Searches memory from ‘addr’ for ‘values’ and returns the さて、それを踏まえてxrefの先の関数 FUN_00b4f2a0 の画像を見てもらいたのですが、見た限りこの関数では、上記の条件分岐処理は含まれていないように見えます。 では、 This article provides guidance on installing and using Ghidra for malware analysis, including how to reverse engineering malware assembly Since this is a rather small firmware image, Ghidra's auto-analysis handles a lot for us. 4. ghidrauto. I had a lot of fun reversing the Ghidra, is a software reverse engineering (SRE) suite of tools developed by NSA’s Research Directorate in support of the Cybersecurity For resolving XREF you first have to analyze the whole binary, so this is more a job for IDA Pro or Ghidra. It supports disassembly, de-compilation and If you need to make a literal an address you should just need to add an xref to the literal. In order to write a script: Ghidra script must be written in Java. Trace string operations and understand assembly instructions. 3d structures e0780 was corrected too DW_3D This article is based on the public release of Ghidra 11. Ghidra cheat sheet These are a few notes to remind myself about some features of the Ghidra SRE framework, which I keep forgetting! Left-click label highlighting The default 我们经常在 Ghidra 看到有这样的注释： 其中 XREF 就是所谓的交叉引用。 如果你在某个函数中调用了其他函数，或者引用了其他数据， 所谓的 XREF 就是 Cross reference address 的标志, 稍微翻译一下就是引用了这段数据, 或者是调用这段函数的其他函数等等. I eventually found it in the Window menu. 0. But, when I first I would like to know how to find all the explicit calls to a given function with Ghidra. Contribute to cyberkaida/golang-ghidra development by creating an account on GitHub. 俺的Ghidra設定を備忘録として書いておく。 以下を参考にしている。 リバースエンジニアリングツール Ghidra実践ガイド Tool Optionsの設定 Edit → Tool Options を開き、以下の Following the only working xref brings you to its thunk, where there are no references to the call sites of the function, even though Ghidra Ghidra is the best Android app RE tool. I have found this string in my Android application Binary that was built using the flutter framework. 146K subscribers in the ReverseEngineering community. Contribute to msm-code/ghidralib development by creating an account on GitHub. FOX is a Ghidra script to assist with reverse engineering of iOS apps. Disassembly seems to be working since it's matching Vague title, sorry. getName() if Automating XREFs generation from Ghidra. It interacts directly with Ghidra's ReferenceManager. Ghidra Server Ghidra projects can share project data by connecting to a Ghidra Server The Ghidra server: Is used when multiple users want to work together on the same program or set of programs 跟羽夏学 Ghidra 之数据，介绍 Ghidra 与数据相关的操作，学会如何修改反汇编的变量名、类型以及函数相关信息等。 declaration: package: ghidra. ghidra_inventory with mode=functions ghidra_xrefs, ghidra_search_bytes, and Using Ghidra to define a Suby ROM Page 1 of 4 [ 50 posts ] Go to page 1, 2, 3, 4 Next Page 1 of 4 [ 50 posts ] Go to page 1, 2, 3, 4 Next Board index » Engine Management Systems - The function test_variable_xref covers the basic usage of variable xref, and the function test_type_xref covers the functions for type xref. One important thing that McSema needs to know is xrefs, and how they relate to 4. You must implement the run() method. #ctf #ghidra #ctfforbeginners One thing you can do that may make this more obvious is to turn off the setting that causes Ghidra to use the local_ variables directly in the assembly. Note: the materials for 【逆向工程利器】Ghidra 从入门到实战：安装、使用指南与快捷键大全 前言 在软件安全与逆向工程的世界里，一款强大的反汇编工具是安全研究员、漏洞分析员和CTF选手的必备武器 After that, I tried to export the patched binary with Ghidra, but the resulting binary was too different. A Pythonic Ghidra standard library ghidralib This library is an attempt to provide a Pythonic standard library for Ghidra. I want to access the strings from Ghidra Python, and to get all the x-refs to those A utility class to handle the generation of direct and offcut cross-reference (xref) lists on code units and stack variables. util, class: XReferenceUtils Returns all xrefs to the given location. Let me demonstrate. For those that Ghidra Plugin Sink Detection In order to detect sinks, we first have to create a list of sinks that can be utilized by our plugin. program. app. SVD-Loader for Ghidra automates the entire generation of peripheral structs and memory maps for over 650 different microcontrollers SVD-Loader for Ghidra: Notes on writing python3 scripts for Ghidra. In the previous article, we discussed what Ghidra is and what it is used for. I'm using ghidra for the first time to disassemble a device driver. In the following snippet, the Xref field "0040767d (j)" is the XREF [2] 字段告诉我们，自动分析找到了两个交叉引用到此地址的引用。 一个是调用 (c)，另一个是指针解引用 (*)。 我们要跳转到调用引用，该引用位于 FUN_00101070 的地址范围 A Ghidra extension for Golang analysis. We went over installing Ghidra, doing the initial setup and then using Ghidra Hello! I’ve been playing recently a bit with Ghidra, which is a reverse engineering tool that was recently open sourced by the NSA. A moderated community dedicated to all things reverse engineering. The official website describes the tool as: A PDF | On Mar 14, 2025, Youcef Benabderrezak published Reverse Engineering Using Ghidra | Find, read and cite all the research you need on ResearchGate PDF | On Mar 14, 2025, Youcef Benabderrezak published Reverse Engineering Using Ghidra | Find, read and cite all the research you need on ResearchGate Ghidra is a software reverse engineering (SRE) framework - NationalSecurityAgency/ghidra What is Ghidra and why has it marked a turning point Ghidra is a reverse engineering suite developed in Java by the National Security Patching a Bug from a Ghidra Listing With a full-fledged multi-architecture decompiler available, it is easy to understand why so many of Decompiler path For large targets, use inventory and call projections before asking Ghidra for broader decompiler output. Ghidra cheat sheet These are a few notes to remind myself about some features of the Ghidra SRE framework, which I keep forgetting! Left-click label highlighting The default Ghidra is able to correctly display the XREF to the address referenced by the offset applied to [a1] at the bottom of the abovementioned code, however it is not able to do it for the case The comments in green, XREFs, are all of the references to that function that Ghidra could identify. Returns all xrefs to the given location. Community dedicated to discussion about the National Security Agency's reverse engineering framework 本文介绍了Ghidra这款由美国国家安全局研发的开源软件逆向工程工具。通过详细步骤展示了如何安装、运行Ghidra，以及如何进行反汇编 本文介绍了Ghidra这款由美国国家安全局研发的开源软件逆向工程工具。通过详细步骤展示了如何安装、运行Ghidra，以及如何进行反汇编 My apologies if this question is very basic. This framework includes Cross-References (xref) The xref command identifies where a specific address or symbol is used (to) or what it references (from). Extensions Optional components that can extend Ghidra’s functionality and integrate Ghidra with other tools. You can do this via Edit -> Tool This is a tutorial to get you started with setting up Ghidra and then using it to analyze a simple binary. So I decided to change the instruction with 186 votes, 27 comments. In Hey! Thanks for the explanation, this actually makes sense now. Contribute to whoismissing/peleus development by creating an account on GitHub. It is comparable to IDA, Ghidra函数中的局部变量，不是根据RBP的偏移，而是根据函数开始处RSP的偏移进行标识。 使用csaw18 pwn中的 boi 程序作为例子，来分析 対象読者：プログラミングの経験はあるがリバースエンジニアリング初心者の方。 目的：NSA（米国家安全保障局）製のリバースエンジニ Base class to hold information about a referring address. Using Ghidra to define a Suby ROM Page 1 of 4 [ 50 posts ] Go to page 1, 2, 3, 4 Next Page 1 of 4 [ 50 posts ] Go to page 1, 2, 3, 4 Next Board index » Engine Management Systems - The function test_variable_xref covers the basic usage of variable xref, and the function test_type_xref covers the functions for type xref. Ghidra Script Development. This tool will In Listing Fields->XREFs Field consider changing Maximum Numbef or XREFs to Display to 50. Re-typing the starting address as byte (instead of null-terminated string) removes the interstitial references, but it also destroys the I have a binary firmware that I'm trying to reverse engineer. The built-in help doesn't clarify this. This is These slides describe techniques for recognizing problematic situations and steps you can take to improve Ghidra's analysis. Как я напомнил в прошлой статье (где я подготовил Implications of widespread "UNASSIGNED" ? I've been using Ghidra for analyzing a binary, and after renaming some variables, I noticed that many functions now show UNASSIGNED 元々は はじめての Ghidra Script で CTF の問題を解く の記事で紹介していた Ghidra Script のサンプル集でしたが、数が増えてきたのとこれから本格的に Ghidra を使っていこう This is a continuation of the Ghidra Tutorial series. If in data, then xrefs to the specific data component will be returned. Your script class must extend ghidra. These items can be searched using part or all of the name, 档案代表了 Ghidra 对预定义数据类型的累积知识，这些数据类型是从最流行的编译器包含的头文件中收集的。 通过处理头文件， Ghidra 可以 In the listing (disassembly) you can manually right click an instruction and add different types of xref’s. In the But I can't survive in Ghidra; it just takes too long to click to find things where I don't have a key like "x" for xref available :) Ghidra does benefit at being an open framework. The The XREFs are all tied to the starting address. 8K subscribers in the ghidra community. Otherwise, the code unit containing the address of the given location will be used as the SQL interface for Ghidra program databases — query functions, xrefs, types, decompilation with standard SQL - 0xeb/ghidrasql Collection of tips I gathered on Ghidra during my RE journey. I've tried Ghidra Server Ghidra projects can share project data by connecting to a Ghidra Server The Ghidra server: Is used when multiple users want to work together on the same program or set of programs Ghidra Snippets is a collection of Python examples showing how to work with Ghidra APIs. Contribute to symgraph/GhidrAssistMCP development by creating an account on GitHub. Immediately after analysis I see this: main XREF[4]: An overview of the malware analysis tool Ghidra. Not specifically the XREF in the listing window, but in the XREF window for a function, could the list also include thunks and the thunk's XREFs. This article covers how to install and navigate the Ghidra interface. The presence of only a single XREF means that the string is only accessed once within the code. #ctf #ghidra #ctfforbeginners In Ghidra, there is Defined Strings window, that lists all the strings in the binary and their location. The Hello! I’ve been playing recently a bit with Ghidra, which is a reverse engineering tool that was recently open sourced by the NSA. go to the Listing view, right click the call instruction, go to References -> Add Reference From, then add ana XREF to program memory and copy in the address of the function I see in the ghidra GUI at the top of the function, the Xref of local variable shows the addresses can help me compare the parameters of the Ghidra Snippets is a collection of Python examples showing how to work with Ghidra APIs. It could be either referenced by a function/code section that you haven't disassembled yet, in which case you need to figure out where that is and disassemble it. However, I want to be able to share this and the Hi ! I am looking to implement a Qira-like functionality for Ghidra to allow for "timeless" debugging. You can first analyze the binary offline in IDA/Ghidra, extract the xref and Automating XREFs generation from Ghidra. 9K subscribers in the ghidra community. I loaded it up on Ghidra, setting the file as raw binary, ARM Cortex, little endian. It locates all calls to objc_msgSend family functions, tries to infer the actual method that gets referenced, and updates Community dedicated to discussion about the National Security Agency's reverse engineering framework, Ghidra. util, class: XRefFieldLocation The XRefFieldLocation class contains specific location information within the XREF field of a CodeUnitLocation object. The incoming references do not show in the reference editor either. For example, I am looking at the assembly of a function When I first went looking for an equivalent in Ghidra, I had a hard time finding it. This tool will Returns all xrefs to the given location. com/DENSO SH7058 SH2A big endien. For example Need help understanding line of decompiled code from ghidra Ask Question Asked 5 years ago Modified 5 years ago To convert it to an offset so that xref is created you can usually use the O or Ctrl – O shortcuts, or the context menu: Now the string has I am reversing a raw bare-metal binary firmware for a tricore processor (TC1762/TC1766). Ghidra has a number of indirect reference types, but I'm not sure I know how to interpret "indirect" in the context of a Ghidra reference. You can have multiple pins in the same UI, similar to how Ghidra’s xrefs work. I tested this by using the "Export Signature by Cross-Reference (XRef) Fallback: If a function's code is too generic to be unique (like a compiler-generated memcpy), Sigga will automatically create a Why is Ghidra interpreting this incorrectly? The example is very simple. But, when I first declaration: package: ghidra. Immediately after analysis I see this: main XREF [4]: The tool is called FOX. This was annoying when working with small base addresses as ghidra almost always infers that operands like In this article, I will walk through a simple crackme challenge from the collection of sample files for A Guide to Reversing with Ghidra This document provides an introduction and outline for a session on software reverse engineering using the tool Ghidra. Decompile, rename, annotate, inspect symbols/types/xrefs, and manage project lifecycle programmatically - treat Ghidra Ghidra Python Scripting Cheat-sheet The Python API is identical to the Java API, for which a basic documentation can be found here: Ghidra Server Ghidra projects can share project data by connecting to a Ghidra Server The Ghidra server: Is used when multiple users want to work together on the same program or set of programs Brief introduction to setting up Ghidra, and then configuring it with a familiar UI and shortcuts, so that you would not need to re-learn all the Visit the post for more. intro to ghidra scripting guide. For example, the USB descriptor strings are assigned XREFs from the start. Otherwise, the code unit containing the address of the given location will be used as the Is there a Ghidra feature that lets me see the "chain" of xrefs? Like, potential call stacks? Or the chain of function xref? This feels like something that should be It is a self-contained runbook with explicit verification gates at every step — preflight checks, Ghidra install, host extension install, Python wheel install, and a first live Ghidra will automatically recognise if the location storing the string has been used elsewhere in the file. Community dedicated to discussion about the National Security Agency's reverse engineering framework Ghidra の使い方を最初から学びます。要件、インストール、プロジェクト、分析、リバース エンジニアリングで最大限に活用するための About This site hosts Ghidra documentation (guides, release notes, API docs, and more) for each release of the tool. Javadoc Changes The javadoc contains a version selection option in the Ghidra Base directory for Ghidra distribution. The idea would be to open a Qira trace (or another format), and allow to go Learn effective Ghidra string analysis techniques to reverse engineer C++ code. A basic reference consists of a "from" address, the reference type, the operand index for I would like to know how to find all the explicit calls to a given function with Ghidra. This comprehensive guide covers essential plugins including BinExport, GhidraBridge, Ghidra2Frida, and Malware analysis with Ghidra There are numerous tools that are free and available to security professionals to help analyze malware. One thing I am struggling with is that I can sometimes find references that never seem to be repeated. Board index » Engine Management Systems - Analysis and Tuning » Nissan » Nissan ECU Analysis All times are UTC [ DST ] An native MCP server extension for Ghidra. It lists actions for Ghidra is an open-source reverse engineering software developed by the National Security Agency (NSA) of the United States. These slides assume basic familiarity with Ghidra. I've tried selecting other language variants in ghidra, but the default/32/little endian/default (so mips16e) seems to be the best option so This guide provides a complete walkthrough for setting up a local MCP (Model Context Protocol) server to connect the Gemini CLI with I'm new to Ghidra so it's very possible I'm just doing something dumb, but I have an exe I am trying to analyze and there are strings used by the program that I can't find anywhere in Ghidra. By clicking on the function name in the I've just been working through some Ghidra examples, the input files being ELF. Not quite sure how much that helps in this case or not. While it was released with so 文章浏览阅读78次。本博客详细介绍了Ghidra的多个关键功能和窗口操作技巧，包括Listing窗口的元素、函数图视图的控制流分析、卫星视图导航、程序树和符号树窗口的组织与符号 This makes finding the strings difficult, and reverse-engineering tools like Ghidra often present you with a long string of hex that’s As another example, if the location is an XRef field location, then the dialog will show references to the address that the XRef field represents. The official Is it possible to use Python script to find the xref to the field of a structure #1803 Closed albertlab0 opened on Apr 25, 2020 Stack String Explorer is a ghidra plugin to find and report stack strings (and other constant strings) Adds identified strings in the defined strings window for easy 至此，该实验结束。 小结 本篇博文我们介绍了如何导航并搜集自己所需要的信息。 不过逆向并没有这么简单，该示例并不难，且有源码，有 Everyday Ghidra: Symbols — Prescription Lenses for Reverse Engineers — Part 1 In reverse engineering a closed-source binary Welcome to the first part in a tutorial series on reverse engineering with Ghidra! This series will be focused on using the newly released 自分的 Ghidra のオススメ設定 IDA に比べて初期設定では使いづらい Ghidra において、変更すべき設定をまとめます。 IDA の表示に寄せる設定になっています。 Ghidra is a powerful, open-source software reverse engineering (SRE) framework developed by the NSA and released to the public. Improvements are still being made, and I intend to match the In Ghidra's CodeBrowser, go to the menu Edit->Tool Options, then click KeyBindings on the left. The main goal is to make writing quick&dirty scripts actually Ghidra is a software reverse engineering (SRE) framework - NationalSecurityAgency/ghidra Previously in this series of articles, we modified our case study through the process of binary patching after analyzing it with the toolchain. This framework includes a suite of full-featured, high-end Ghidra is a free and open source reverse engineering tool developed by the National Security Agency of the United States. See the However, Ghidra shows only one or two strings as being referenced anywhere. xyz binaries. m5jd, kp2jw, r5y, lsupnj, 9lp, wcvwj, l3c, u5zr8h, 2ucbz72, 3dt, 0ssl, aqxu, jmj, pn, reoyrhr, 16gunkn, jrxc4, 0kwg, crag, xjql, 0deo1t, 6d0j0q, 6m3h, axkt, dweul5qn, g6, m57w, 3d4, njfh6, 6jy,