Skip to content

ghidra.md

Latest commit

 

History

History
252 lines (183 loc) · 11.8 KB

ghidra.md

File metadata and controls

252 lines (183 loc) · 11.8 KB
Raw

+

function ID (FID)

  1. Enable FunctionID plugin
  2. Create new empty database
  3. Populate database with program (I get 6783 results added to the database)
  4. When I load in another binary (using the same functions), I use Set Active databases
  5. I turned on "Always apply FID Label" in the analyzer's settings

In my code browser when i go to File -> Configure... I do not see an option for Function ID (there are only sections Ghidra Core, Debugger, Miscellaneous, Developer, and Experimental), and under the experimental plugins there's no option for FidDebugPlugin. However, Function ID is availble under Tools -> Function ID. What could cause that? I found it, they moved it to developer

data types (GDT)

symbols

export

  • Window > Symbol Table > [Select lines and open context menu] > Export to CSV...

import

PDB

MAME

Apply function symbols as debugger comments with script Funcs2MameComs:

GHIDRA_INSTALL_DIR=$HOME/opt/ghidra_12.0.4_PUBLIC/
GHIDRA_PROJECT_DIR=$HOME/code/ghidra/
GHIDRA_PROJECT_NAME=fooPrj
"$GHIDRA_INSTALL_DIR/support/analyzeHeadless" "$GHIDRA_PROJECT_DIR/" "$GHIDRA_PROJECT_NAME/fooDir" \
    -process fooPrg \
    -noanalysis \
    -scriptPath ~/ghidra_scripts/ \
    -postScript Funcs2MameComs.java

mame -debugscript foo.mame.txt

build

# extension
gradle -PGHIDRA_INSTALL_DIR=$HOME/opt/ghidra_12.0.4_PUBLIC buildExtension && mv dist/ghidra_12.0.4_PUBLIC_*.zip ~/opt/ghidra_12.0.4_PUBLIC/Extensions/Ghidra/

# processor
ant -Dghidra.install.dir=$HOME/opt/ghidra_12.0.4_PUBLIC -f buildLanguage.xml && rsync --delete-excluded --exclude=.git --exclude=.gradle -uva ./foo/ ~/opt/ghidra_12.0.4_PUBLIC/Ghidra/Processors/foo/

# dist
# - replace `assert(ip != null)` with `if` in gradle/support/ip.gradle (https://github.com/NationalSecurityAgency/ghidra/issues/661)
gradle -I gradle/support/fetchDependencies.gradle
gradle yajswDevUnpack
gradle buildGhidra
mv build/dist/*.zip ~/opt/ && ( cd ~/opt && find . -maxdepth 1 -type f -iregex '.*\.zip' -exec sh -c 'atool -x "{}" && rm -f "{}"' \; )

# parser/decompiler
gradle generateGrammarSource Decompiler:buildNatives

# test
gradle :Emulation:test --tests "ghidra.pcode.exec.SleighProgramCompilerTest.testGoto64BitOffset" -x buildHelp -x sleighCompile
gradle unitTestReport
gradle integrationTest

import project

  1. File > Import... > Existing project
  2. GhidraDev > Link Ghidra...

debug project

  1. If "Multiple modules collided with same name", then remove installed extension || temporarily move from ~/.ghidra/
  2. Run > Debug Configrations... > Classpath
    • Bootstrap Entries || User Entries > Add project...
  3. Debug (Ghidra instance is launched from Eclipse)

debug tests

If attaching from IDE:

diff --git a/gradle/javaTestProject.gradle b/gradle/javaTestProject.gradle
index 5e3614963e..c9ab46999d 100644
--- a/gradle/javaTestProject.gradle
+++ b/gradle/javaTestProject.gradle
@@ -198,7 +198,7 @@ def initTestJVM(Task task, String rootDirName) {
                        '-Duser.language=en',
                        '-Djdk.attach.allowAttachSelf',
                        '-XX:TieredStopAtLevel=1',
-                       '-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=' + debugPort,
+                       //'-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=' + debugPort,

                        // Allow illegal reflective accesses
                        '--add-opens=java.base/java.util.concurrent=ALL-UNNAMED',

configuration

  • Script Manager
    • Pick: ResolveX86orX64LinuxSyscallsScript
  • CodeBrowser > Edit > Tool Options > Decompiler > Analysis
    • Unpick: Eliminate unreachable code
  • CodeBrowser > Function Call Trees (Incoming + Outgoing Calls)

bad disassembly

  1. Select instructions > Clear Code Block
  2. Select bytes (starting at expected offset) > Disassemble

slow analysis

./analyzeHeadless $ghidra_database/ $database_name -process '*' -recursive

stack

Listing > Edit the Listing fields > Instruction Data > Add Field > Stack Depth

type recovery

  • File > Export Program > Export As C/C++
typedef unsigned char undefined;
typedef unsigned char byte;
typedef unsigned int dword;
typedef unsigned int uint;
typedef unsigned char uint3[3];
typedef unsigned char undefined1;
typedef unsigned short undefined2;
typedef unsigned int undefined4;
typedef unsigned long long undefined8;
typedef unsigned short ushort;
typedef unsigned short word;

scripting

pcode

0x41
  ||
  |+-> bits 3..0
  +--> bits 7..4

emulation

  • GitHub - Nalen98/GhidraEmu: Native Pcode emulator
  • First Look: Ghidra 10.3 Emulator

    Probably the best use case so far has been pcodetest which takes C code that tries to create junit tests for SLEIGH processor module validation. They gave an introduction at RECON 2019. The difficulty here is one size fits all: it's one C source base and you can't guarantee the coverage of asm produced from ISA to ISA with the compiler. It may not generate all the instructions or even whole classes of them. It may not generate enough variety in register usage, which for register based languages like SLEIGH, that is important to test. Some of the more interesting instructions, and typically the harder ones to implement in SLEIGH, sometimes don't even have a C counterpart.

add cpu architecture / processor module

# Compile SLEIGH specifications
cd ~/code/ghidra_workspace/foo/data
ant -f buildLanguage.xml

generating

testing

change data string encoding

  1. Select bytes
  2. Open: Context menu > Data > String
  3. Open: Context menu > Data > Settings > Charset

multiple files with same memory map

  1. File > Add to program
  2. Memory Map > Add Memory Block
    • Length: file size
    • Overlay: check
    • File Bytes: added file
    • File Offset: 0

bindiff

  1. Load PDB symbols (if available)
  2. Export... > Binary BinExport (v2) for BinDiff
  3. bindiff primary.BinExport secondary.BinExport, take primary_vs_secondary.BinDiff
  4. bindiff --ui
  5. Diffs > Add Existing Diff...