search

NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
50.86k stars 5.8k forks source link

IllegalAccessError docker ghidra headless mode #6933

Open spatti33 opened 1 week ago

spatti33 commented 1 week ago

I am running ghidra in a docker container to use the headless analyzer in a pipeline. I have an extension for google zynamics binexport and a custom script that will export the analyzed file as a .BinExport file. I have tried this implementation on my host machine (Ubuntu 22.04 with jdk 21) and it works just fine.

I set up the docker with the same OS version and jdk version but when I run my custom script, I get the following error:

java.lang.IllegalAccessError: java.lang.IllegalAccessError: class com.google.security.zynamics.BinExport$BinExport2 tried to access method 'com.google.protobuf.LazyStringArrayList and com.google.protobuf.LazyStringArrayList.emptyList()' (com.google.security.zynamics.BinExport$BinExport2 and com.google.protobuf.LazyStringArrayList are in unnamed module of loader ghidra.GhidraClassLoader @6073f712)

I can't seem to figure out what is causing this error, especially since it is only occurring in the docker container?

ryanmkurtz commented 1 week ago

Is the installation process the same on your host vs container? How are you installing the extension in each case?

spatti33 commented 1 week ago

Both are in offline environment so I pulled the source from a locally hosted file server and copied it over into the container. On my host I installed the extension through the GUI doing file -> install extensions. For the container I followed the set up guide for using it in headless mode and unzipped the extension in the Ghidra/Extensions directory.

astrelsky commented 1 week ago

https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/lang/IllegalAccessError.html

"...Normally, this error is caught by the compiler; this error can only occur at run time if the definition of a class has incompatibly changed...."

So, for one reason or another, the version of protobuf loaded at runtime is different then the one when BinExport was built and LazyStringArrayList.emptyList() is no longer visible/accessible.

spatti33 commented 1 week ago

I checked on my host and container and both have the same version of protobuf installed. Are you saying it may be possible that the installation on the container is not the one being used when executing the script?

astrelsky commented 1 week ago

I checked on my host and container and both have the same version of protobuf installed. Are you saying it may be possible that the installation on the container is not the one being used when executing the script?

The version of protobuf installed on the system is probably irrelevant. I think protobuf is distributed with ghidra in the debugger.

spatti33 commented 1 week ago

The version of protobuf installed on the system is probably irrelevant. I think protobuf is distributed with ghidra in the debugger.

If I'm taking the same version of ghidra as I have on my host, why would it fail in the container but not my host if protobuf is shipped with ghidra?

astrelsky commented 1 week ago

The version of protobuf installed on the system is probably irrelevant. I think protobuf is distributed with ghidra in the debugger.

If I'm taking the same version of ghidra as I have on my host, why would it fail in the container but not my host if protobuf is shipped with ghidra?

Is the version of protobuf the extension is built against, the same version being used at runtime?

spatti33 commented 1 week ago

No, it looks like its different. I'll give that a try, thank you!