NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
52.26k stars 5.92k forks source link

Show XREF for register offset as well as when the address is used. #5043

Closed rollsch closed 1 year ago

rollsch commented 1 year ago

I have the following code (infineon tricore tc2xx)

Which produces the following disassembly

        80427fea 37 04 70 f0     extr.u     d15,d4,#0x0,#0x10
        80427fee 91 00 00 f5     movh.a     a15,#0x5000
        80427ff2 d9 ff 04 d0     lea        a15,[a15]0x344
        80427ff6 90 ff           addsc.a    a15,a15,d15,#0x2
        80427ff8 c8 0f           ld.a       a15,[a15]#0x0=>**DATA_50000344**

I want it to annotate addresses 80427FF2 and 80427FF6 so that I get the following instead of the above

        80427fea 37 04 70 f0     extr.u     d15,d4,#0x0,#0x10
        80427fee 91 00 00 f5     movh.a     a15,#0x5000
        80427ff2 d9 ff 04 d0     lea        a15,[a15]0x344    #DATA_50000344
        80427ff6 90 ff           addsc.a    a15,a15,d15,#0x2  #DATA_50000344
        80427ff8 c8 0f           ld.a       a15,[a15]#0x0=>DATA_50000344

Eg show that there is an xref to DATA_50000344 at address 80427FF2 and 80427FF6

Is there any options that will do this out of the box?

Even if this is not technically an XREF, I'd like to comment that these instructions are responsible for the XREF.

The reason for this is I am patching the XREFs so I need to collect all relevant instructions to do so. I've done this manually in hand written software, but I would like to see if Ghidra can do it without essentially re-writing the same software.

mumbel commented 1 year ago

Place the cursor on the dest a15 of 80427ff2 and run the MultiInstructionMemReference.java from the script manager

rollsch commented 1 year ago

Is there a way to do this for the whole file? I can script it but just curious if I can do the whole file at once. Thank you for your help.

mumbel commented 1 year ago

Unless I'm forgetting something, no not that I'm aware of of. I believe the other architectures have additional constant analyzers for what ghidra doesn't pick up.