redballoonsecurity / ofrak

OFRAK: unpack, modify, and repack binaries.
https://ofrak.com
Other
1.82k stars 128 forks source link

Do not run Ghidra auto-analysis on import #473

Closed rbs-afflitto closed 1 month ago

rbs-afflitto commented 1 month ago

One sentence summary of this PR (This should go in the CHANGELOG!)

Link to Related Issue(s) N/A

Please describe the changes in your request. This change adds -noanalysis to the import command in _do_ghidra_import in the GhidraProjectAnalyzer. Without this change, Ghidra analysis runs every time the GhidraProjectAnalyzer runs. This consumes a significant amount of time that is not necessary if using a pre-analyzed Ghidra project. By adding -noanalysis to the import command, the Ghidra analysis will run conditionally in _do_ghidra_analyze_and_serve, depending on if a pre-analyzed Ghidra project has been passed into the analyzer config.

Anyone you think should look at this, specifically? @whyitfor @SamL98

rbs-jacob commented 1 month ago

Do not run. Do not run. (I'm gonna run.)

SamL98 commented 1 month ago

Is the conditional analyzing performed by ghidra? i.e. the OFRAK user doesn't have to pass any new flags/call any new functions? If so, LGTM