search

NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
51.85k stars 5.89k forks source link

Better recognition of arrays #746

Open teaalltr opened 5 years ago

teaalltr commented 5 years ago

array

(PPC disasm on the left) As you can see, it can't properly identify array boundaries and other entries. Also note the first line in the loop, the first element is almost never converted to var[0].

teaalltr commented 5 years ago

Maybe just a C printing enhancement, see this function here (namely checkArrayDeref()) https://github.com/NationalSecurityAgency/ghidra/blob/6e9516a07c3ad328a2d5cf1d944c8855e7207d6a/Ghidra/Features/Decompiler/src/decompile/cpp/printc.cc#L268

Maybe checking if other elements too are part of the same array would enhance this, at the moment it seems not take into account the other array slices as such.

Nonetheless, maybe one would need to add a variable elimination pass to get rid of unneeded temporary locals