al3xtjames / ghidra-firmware-utils

Ghidra utilities for analyzing PC firmware
Other
397 stars 45 forks source link

Add enableRelaxedEndCondition support #25

Open s0ullight opened 1 year ago

s0ullight commented 1 year ago

XZ 1.9 introduced a new method to LZMAInputStream. When this method is called before any data from the stream is read, the absence of EOS doesn't trigger an exception.

al3xtjames commented 1 year ago

Thanks for the notice. ghidra-firmware-utils doesn't actually use XZ for Java directly - it uses Apache commons-compress, which is already included in Ghidra. I think this required manual installation of the jar in the past (at least that's what I thought at the time: https://github.com/al3xtjames/ghidra-firmware-utils/commit/cd7493008aa3e0ec8585bdda74354870cadc6c92 🤷‍♀️ ), but it seems to work without it. Ghidra already includes it:

$ fd xz $GHIDRA_INSTALL_DIR
Ghidra/Framework/Project/lib/xz-1.9.jar

I'll remove the explicit XZ for Java dependency as it's no longer needed.

Regarding enableRelaxedEndCondition: it seems that commons-compress started calling it in 1.22 (see https://github.com/apache/commons-compress/commit/31d1738ccc57f86d8fd56ff5271cda82a65f01ee). Ghidra 10.2.3 includes 1.2.1:

$ fd commons-compress $GHIDRA_INSTALL_DIR
Ghidra/Framework/Project/lib/commons-compress-1.21.jar

This should get addressed once Ghidra updates the commons-compress dependency. It might be worth opening an issue (or submitting a PR!) in https://github.com/NationalSecurityAgency/ghidra to let the Ghidra maintainers know about this.

By the way, do you have any examples of firmware binaries with compressed sections that require enableRelaxedEndCondition? AFAICT LzmaCompress in EDK II BaseTools uses the LZMA SDK, so it might have been affected by this issue in the past.

s0ullight commented 1 year ago

Thanks for the quick reply. I noticed the usage of apache commons-compress, but mentioned XZ to avoid confusion about what class has the method.

Regarding firmware binaries: I'm interested in the HP Pavilion 23-q109nb bios, trying to figure out how the nvram var whitelist works.