search

NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
49.67k stars 5.71k forks source link

Ghidra is missing winternl.h definitions #617

Open huettenhain opened 5 years ago

huettenhain commented 5 years ago

In malware analysis in particular, it is sometimes useful to have predefined structures for the PEB and related structures. These definitions are in winternl.h according to MSDN, they are missing from Ghidras library of structures.

I am suggesting to add the structure definitions from winternl.h to Ghidra's default database of Windows structures.

0x6d696368 commented 5 years ago

I support this.

However, I guess that is what the https://github.com/NationalSecurityAgency/ghidra-data repo is for.

As a workaround you can try my fork of said repo, which should have winternl.h and other headers in winapi_{32,64}.gdt: https://github.com/0x6d696368/ghidra-data/tree/master/typeinfo (but please note these were generated from MinGW headers, and due to issues with the Ghidra's C parser have all datatypes in one file so you won't see a separate winternl.h folder in the data type archive).

mrexodia commented 10 months ago

There was some discussion at https://github.com/mrexodia/phnt-single-header/issues/10. It looks like Ghidra can correctly parse this header, so creating type libraries from it is possible.