search

NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
51.43k stars 5.86k forks source link

Generic selectable type for code pointer #2362

Open mumbel opened 4 years ago

mumbel commented 4 years ago

Through analysis ghidra can decide that a pointer is code and will cast function pointers sometimes as code.

This issue is simply readability in the decompiler only (though maybe could help label functions through type propagation). You may see something like thing->func = (undefined *)0x12345678 instead of thing->func = FUN_12345678 even though the listing windows does have it listed as FUN_12345678.

code however is not a selectable DataType. The only other generic options are pointer, void *, and undefined *; but none of these would explicitly say this is a pointer to code as code would. Short of creating function definitions is there a built-in data type that I'm just not aware of to help with this.

ghidra1 commented 4 years ago

At the moment there is no work-around or pointer datatype attribute on the java-side which would identify a type as a code pointer. We are looking into ways we can incorporate this and other datatype attributes into the API.

Wall-AF commented 4 years ago

At the moment there is no work-around or pointer datatype attribute on the java-side which would identify a type as a code pointer. We are looking into ways we can incorporate this and other datatype attributes into the API.

Will these new datatype attributes contain the ability to have: 1) different sized pointers (address sizes) - for NEAR & FAR attribute (in my case 16- to 32-bit); and 2) ability to "widen" a NEAR pointer to a FAR one, by your choice of address offset - for passing across functions.

ghidra1 commented 4 years ago

Will these new datatype attributes contain the ability to have:

  1. different sized pointers (address sizes) - for NEAR & FAR attribute (in my case 16- to 32-bit); and
  2. ability to "widen" a NEAR pointer to a FAR one, by your choice of address offset - for passing across functions.

Hopefully, but at this point it is just a concept.