search

NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
49.34k stars 5.68k forks source link

Universal Interface for Post Processing of DecompilerResults #1907

Open fmagin opened 4 years ago

fmagin commented 4 years ago

Is your feature request related to a problem? Please describe.

Ghidra's decompiler is nice, but still lacking in some aspects, some of them fairly trivial like not being able to generate for-loops (https://github.com/NationalSecurityAgency/ghidra/issues/644). Various other patterns that might only be relevant for specific languages or even specific binaries can't be easily added to the decompiler. Some examples:

Describe the solution you'd like My suggestion is to define an Interface ( I guess this would be an ExtensionPoint in the context of Ghidra) that can be implemented by classes provided by Ghidra Modules which allows processing a DecompilerResult after it gets created from the XML from the decompiler. I wrote basic sketch of this feature at https://github.com/fmagin/ghidra/blob/211063b41d7d98c30d424f40f5d4b16a1be124b0/Ghidra/Features/Decompiler/src/main/java/ghidra/app/decompiler/DecompInterface.java#L753-L769 , but this isn't tested with any implementations yet. This obviously could have more complicated logic there, at that point it would maybe be better to have one class (Service?) on which Modules can register a transformation if certain conditions are met. Ordering also can be relevant.

This offers the most flexibility at what I see as nearly no cost to the long term maintainability of the code. It would allow Ghidra Modules like ones that handle dynamically defining C-Macros via the GUI, that then get applied to any decompiler result so the code looks cleaner or implementing good enough loop detection for whatever the specific requirements are.

The focus of this is mostly prettier rendering for a human analyst. The underlying P-Code should stay the same. Any changes/analysis related to this should probably be made in the decompiler binary itself.

Describe alternatives you've considered I am not sure if there are any, but I am open to any suggestions.

astrelsky commented 4 years ago

This would definitely be nice feature.