search

NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
50.74k stars 5.79k forks source link

Display a common ancestor function for two specified functions #1214

Open Boryotto opened 4 years ago

Boryotto commented 4 years ago

Is your feature request related to a problem? Please describe.

A nice addition to the Function Call Tree will be to select another function, beside the one that the call tree is displayed for, and find a common ancestor(s). This will really help in finding the possible path the program takes. For example: If you know that a program opens a file and checks a certain value inside it, And a file selection dialog is showing. And you've found a function that xref's the value (let's call it A), but it's called by many functions (maybe because the file data can also be acquired from the network). The feature will let you find function(s) that lead to calling GetOpenFileName and then lead to calling A. This will narrow the code paths to follow and help when debugging.

Describe the solution you'd like I imagine it as a button in the Function Call Trees window that will let you name another function (maybe with a popup) and will display the common ancestor function in a third window (other than Incoming Calls or Outgoing Calls). It will display a list of ancestor functions, and clicking each one will open them in a separate Function Call Tree window.

I don't know exactly how Function Call Trees are stored in Ghidra but I guess it's a tree-like structure, so I'm aiming at finding the first ancestor node and links the two selected function, and of course there might be more than one.

Describe alternatives you've considered This can also be a part of the function comparison feature

dragonmacher commented 4 years ago

This sounds like a useful feature. My first inclination would be to present the results as a graph of the program, only showing the direct ancestors and the two selected functions. This would allow you to explore ways to navigate the various paths to the ancestors. Using the Function Call Tree plugin for this seems like it could be a bit clunky. I guess it ultimately depends on how you wish to interact with the results of the search.

Boryotto commented 4 years ago

A graph would also be great! Generally, I think it would be cool to be able to query Ghidra's analyzed call tree using a query language like xpath.

saruman9 commented 4 years ago

FunctionReachabilityPlugin plugin has similar functionality, but works very unstable.

dragonmacher commented 4 years ago

The Function Reachability Plugin was meant to allow uses to find paths between two functions. It is very much a prototype that never seemed to gain much traction.