Open VelocityRa opened 4 years ago
Note: I'm aware there's already pattern matching for the syscalls, but
I think this should be possible by making the syscall instruction a call and then utilizing call fixup. I know there is a script in the ghidra repo to do this for linux syscalls.
By "only arguments" I mean the feature of being able to at least have
syscall
calls in the decompiler show arguments. Ghidra doesn't let you re-define thatsyscall
function (I assume it's a special kind of func defined somewhere), I'm not sure how to go about it from the GUI. But I assume that the extension is able to, somehow? I'd be useful to re-define it assyscall(void *arg1, void *arg2, void *arg3)
etc to at least aid with capturing arguments passed into it.By "syscall support" I mean the more fully-fledged feature of having a hardcoded list of the syscalls in the extension (ID -> syscall proto), and on each
syscall
instruction the right one recognized from the value loaded inv1
and communicated with the decompiler to show it as the correct function (name + signature).