+New Features
++
+- Basic Infrastructure. Ghidra now requires JDK 17 to run. (GP-2132, Issue #4316)
+- Build. A CycloneDX Software Bill of Materials (SBOM) is now included with a Ghidra distribution. (GP-1782)
+- Data Types. Added
+getSelectedDatatypes()method to DataTypeManagerService to get a list of selected data types in the data type tree. (GP-1631)- Debugger. Added a basic Frida debugger connector. (GP-1681, Issue #3134)
+- Debugger. Added cursor header to Plot columns in Debugger's experimental Model window. (GP-2067)
+- Debugger. Added Choose Platform actions to Debugger. (GP-2163)
+- Debugger. Enabled debugging using Frida on USB/remote devices. (GP-2312)
+- Debugger. Added Map Manually action to Modules window. (GP-2474)
+- Debugger:Emulator. Userops can be defined using Sleigh or Structured Sleigh. (GP-1205)
+- Debugger:Emulator. Added Linux x86 (64- and 32-bit)
+read,write,open,close,exit, andexit_groupsyscalls to the emulation API. (GP-1208)- Debugger:Emulator. Added Taint Analyzer (development prototype). (GP-1230)
+- Debugger:Emulator. Added a skip instruction button to the emulator (Threads pane). (GP-2062)
+- Debugger:Emulator. Added prototype
+EmuDeskCheckScriptto emulate and produce a table of expression values for each step. (GP-2289)- Debugger:Listing. Added toggle to automatically synchronize static and dynamic program selections; added actions to manually transfer selections between static and dynamic listings. (GP-1451)
+- Debugger:Listing. Can now have the Dynamic Listing and Memory windows follow the address of a watch. (GP-2581)
+- Debugger:Trace. Added Objects Manager to Trace API. (GP-1386)
+- Debugger:Trace. Added API for user-defined property maps on traces. (GP-2191)
+- Debugger:Watches. Added data type settings to Registers and Watches windows. (GP-1984)
+- Decompiler. A new Decompiler highlight service has been added, allowing clients to create highlights in the form of background colors for the syntax tokens in the Decompiler UI. Highlights apply to a full token and not strings of text. To highlight a token, you create a
+CTokenHighlightMatcherand pass it to thecreateHighlighter()method of the highlighter service. There is no limit to the number of highlighters that may be installed, and if multiple highlights overlap, their colors will blend. (GP-1435, Issue #2313)- Decompiler. The Decompiler now fully supports union data-types. (GP-1518)
+- Decompiler. A new Create Relative Pointer action is available from the main Decompiler pop-up menu. It creates pointers that have an offset relative to another data-type—typically a structure. Applying the action, the Decompiler can then follow and label accesses into the structure. (GP-1645)
+- Decompiler. The Format setting on a Typedef of an integer data-type now affects the display of constants in Decompiler output. A non-default setting forces the format for displaying constants of that data-type. (GP-1652, Issue #3004)
+- Decompiler. Decompiler line number margin now has fixed horizontal position. (GP-2446)
+- Extensions. A MachineLearning extension has been added. This contains a plugin for finding code and functions in a binary by training on functions which have already been found. (GP-2204)
+- Importer. Updated support for Android version 12.x (S): OAT v199, Vendor Boot Image v4, and FPBK v2. (GP-1461)
+- Importer. Created new Dump File Loader for Windows dump file formats. (GP-1864)
+- Importer. Added support for APPORT-style crash dumps (Ubuntu) to Dump File Loader. (GP-2049)
+- Importer. Added support for Android formats (ART, OAT, ODEX, DEX, CDEX, VDEX) and Dalvik VM Sleigh modules for each major Android release up to version 13.x (T). (GP-2060)
+- Listing. Added right-click menu Patch Data action for modifying bytes in the listing according to the unit's data type. (GP-1684)
+- Scripting. Added FlatDebuggerAPI interface for GhidraScripts to more easily access the Debugger's API. (GP-2189)
+
+Improvements
++
+- Analysis. Added detection of
+popto the PC as a return in ARM binaries. (GP-634)- Analysis. PointerTypedefs are now used for Relative Pointers in the Objective_C2 small method data structures. Previously, the value was a DWORD and did not resolve to an address. (GP-1427)
+- Analysis. The Variadic Function Signature Override Analyzer now handles offcut references to format strings. (GP-2048, Issue #4256)
+- Analysis. Added to the list of known non-returning windows functions. (GP-2069, Issue #4181)
+- Analysis. Improved branch-through-a-register return pattern for ARM processor thunk creation. (GP-2391)
+- Analysis. Enabled Assume Contiguous Functions Only option in Shared Return Calls analyzer. Disabled by default for ARM processors because of use of
+BLfor long jumps in Thumb mode. (GP-2534, Issue #4573, #678)- API. Added the ability to search for enum member usage. (GP-1514, Issue #1967)
+- API. Added recursive form of
+Function.getFunctionThunkAddresses()method. (GP-1692)- API. Improved namespace-based data type searching. Also added ability to specify a preferred root category for such searches on the Program API, which can be manipulated via the Program Information options panel. (GP-1994)
+- API. Eliminated methods from
+AddressMapinterface which are intended for internal use only. (GP-2002)- API. Removed deprecated methods from ProgramPlugin. (GP-2663)
+- Basic Infrastructure. Updated Gson to 2.9.0. (GP-1909, Issue #3992)
+- Basic Infrastructure. Updated commons-compress to 1.21. (GP-1910)
+- Basic Infrastructure. Updated commons-io to 2.11.0. (GP-1911)
+- Basic Infrastructure. Upgraded commons-text to 1.10.0 and commons-lang3 to 3.12.0. (GP-2753)
+- C Parsing. Any open archives in the data type manager will be searched for any missing data types during parsing. In addition when parsing header files with open archives there are new options to Use, Don't Use, or Cancel parsing. (GP-1336, Issue #2119, #2885, #716)
+- Data Types. Updated the Data Types view Paste action to work when pasting on a data type node. (GP-1627, Issue #3568)
+- Data Types. Added a Home action to the Structure Editor to allow users to show the structure data type in the Data Types tree. Added the Show In Data Type Manager action to the data type nodes in the Data Types tree to allow users to associate types with an archive. (GP-1913)
+- Data Types. Modified
+DataType.clone(DatatypeManager)method implementations forStructureDB,UnionDB,FunctionDefinitionDB, andEnumDBto adhere to method documentation which states that a datatype will return the instance itself if itsDataTypeManageris the same as the parameter specified. (GP-2236)- DB. Added persistent Name column to Breakpoints table. (GP-1559, Issue #3679)
+- Debugger. Added GDB connector support for Windows (tested with GDB 11.1 on msys64). (GP-869, Issue #2908)
+- Debugger. Debugger and Python Interpreter windows now support ANSI colors and styles. (GP-887, Issue #4176)
+- Debugger. Revised Debugger icons for visual contrast and action clarity. (GP-1538)
+- Debugger. Added Watch action to Listing, Memory, and Registers context menus. (GP-1560, Issue #3680)
+- Debugger. Dynamic Listing, Bytes, Registers, and Watches windows all now support editing the machine state. Edits can be directed to the Target, the Trace, or the Emulator. (GP-1584)
+- Debugger. Upgraded SWIG to match lldb v14. (GP-1760)
+- Debugger. Added Symbol column to Watches window. (GP-1773)
+- Debugger. Reworked the breakpoint state system and icons. (GP-1821)
+- Debugger. Improved breakpoint initialization. (GP-1824)
+- Debugger. Updated program user data to preserve command-line arguments. (GP-1886)
+- Debugger. Minimized the number of registers read for dbgeng; eliminated error messages. (GP-1898)
+- Debugger. Fixed issues with Debugger when dbgeng/dbgmodel connectors load/debug crash dumps. (GP-2023)
+- Debugger. Improved launcher logic for detecting and remedying trace recording and module mapping failures. (GP-2036)
+- Debugger. Added remote options to IN-VM dbgeng and dbgmodel connectors, like those for the GADP variants. (GP-2135)
+- Debugger. Added Track Program Counter (by Stack) and Track Program Counter (by Register) options to Dynamic Listing and Dynamic Memory. (GP-2462)
+- Debugger:Breakpoints. Improved error feedback for some failures in toggling/enabling (unmappable) breakpoints. (GP-2243)
+- Debugger:Emulator. Userop library callbacks can now receive more context via annotated parameters. (GP-1203)
+- Debugger:Emulator. Changed the display of the PcodeStepper window to look like the PCode field in the Listing windows. (GP-1535)
+- Debugger:GDB. Updated the GDB connector to support version 12.1. Now parses flags for memory map. (GP-2089, Issue #4297)
+- Debugger:GDB. Added GDB scripts for getting memory map of remote Wine win32 targets. (GP-2495, Issue #4546)
+- Debugger:GDB. Ported GDB connector to use JNA. (GP-2619)
+- Debugger:Listing. Added marker margin and overview to the Dynamic Listing window. (GP-1433)
+- Debugger:Listing. Changed priority so that PC highlights are over breakpoint highlights. (GP-2294)
+- Debugger:Mappings. Added Map Regions actions to Debugger. (GP-1231)
+- Debugger:Objects. Creating fewer unsolicited error popups in Debugger by logging these errors to the console. (GP-1329, Issue #3452)
+- Debugger:Trace. Made address encoding in traces more compact. (GP-2437)
+- Debugger:Trace. Handling Trace version exceptions more gracefully. Presents a clearer error dialog. (GP-2452)
+- Debugger:Trace. Simplified Trace database API: Register spaces are no longer a special interface. (GP-2479)
+- Debugger:Trace. Optimized trace memory access for Dynamic Listing and Memory windows. (GP-2593)
+- Debugger:Trace. Fixed a possible deadlock in the Trace database. (GP-2595)
+- Debugger:Watches. Repr column is now modifiable in Registers and Watches windows for supported data types. (GP-1881)
+- Decompiler. A prototype model, as defined by the
+tag in a compiler specification, can now be assigned multiple names. The names can be used interchangeably when assigning a calling convention to a function. (GP-1653) - Decompiler. The Decompiler now uses proper syntax when extracting small fields from packed structures. (GP-1683)
+- Decompiler. Added Decompiler support for the address space attribute on pointer typedefs. (GP-1932)
+- Decompiler. Updated windows calling convention on x64 to properly handle functions with both floating-point and integer/pointer arguments. Users should re-import and analyze programs with such functions. (GP-1954, Issue #1480, #2952)
+- Decompiler. The Decompiler better simplifies multi-part boolean expressions that are built using a status register. (GP-2281, Issue #620)
+- Decompiler. The Decompiler now supports simplification of more forms of optimized modulo/remainder calculations. (GP-2292, Issue #4322)
+- Decompiler. The Decompiler now uses a new, more efficient protocol to communicate with the rest of Ghidra. (GP-2358)
+- Decompiler. Auto-generated stack variable names in the Decompiler now show offsets in hexadecimal format. (GP-2486, Issue #4442)
+- Decompiler. Changed the Decompiler Rename Function action so that if applied to a thunk, the underlying thunked function is renamed instead of the thunk itself. In most cases the rename should be applied to the thunked-function instead of the thunk itself. (GP-2520, Issue #4566)
+- Decompiler. The Decompiler now displays reads from or writes to volatile variables using simple assignment syntax instead of functional syntax. (GP-2578)
+- Decompiler. Improved handling of
+_guard_dispatch_icalland other functions that inject an indirect call into the Decompiler. (GP-2601, Issue #1719, #4591)- Demangler. Added second-pass processing for non-standard Microsoft Demangler forms found in LLVM mangling scheme. (GP-1725, Issue #1162)
+- Demangler. Improved post-analysis pop-up error messaging. (GP-2429)
+- Demangler. Changed symbol demanglers to place anonymous function definitions into the
+/Demangler/!_anon_funcs_category using a revised naming convention consistent with PDB with a_func_name prefix. Changed DWARF to use this same anonymous function definition name prefix. (GP-2557)- Demangler. Improved demangling after File -> Load PDB File... task by kicking off standard demangler analyzer instead of the DemanglerCmd. This should improve consistency in Demangler output across a program. (GP-2648)
+- DWARF. Relaxed DWARF analyzer's requirement of a register-mapping file in order to allow attempted import of function definitions when missing. (GP-1833)
+- DWARF. Added support for compressed DWARF sections. (GP-2106)
+- DWARF. Improve DWARFs handling of explicitly sized data types (e.g., int32_t). Added Try To Pack Structs option to DWARF analyzer to enable packing of structure/union data types created by the analyzer. (GP-2526)
+- Eclipse Integration. The GhidraDev Eclipse plugin now requires Java 17 and Eclipse 2021-12 4.22 or later. (GP-2398, Issue #4496)
+- Exporter. Updated IDA Pro plugins compatibility for python 3. The plugins remain compatible with python 2. (GP-2567, Issue #1327, #1618, #2642)
+- Graphing. Created Graph Data Flow action in Decompiler window menu and renamed existing graph action from Graph AST to Graph Control Flow. (GP-1704)
+- GUI. Fixed dialog text and icon clipping seen on some Linux distributions. (GP-1534, Issue #1506)
+- GUI. Updated Enum Editor to scroll while using the arrow keys when in edit mode. (GP-1553, Issue #3669)
+- GUI. Fixed ordering of automatic comments in the Listing. (GP-1568, Issue #3648)
+- GUI. Updated the UI to allow for setting equate values when an enum has more than one name mapped to a particular value. (GP-1572, Issue #3618)
+- GUI. Add Shift-key modifier to Previous/Next toolbar buttons that invert the action to jump the cursor to functions, labels, data items, etc. (GP-1578)
+- GUI. Updated the GTree to allow new nodes to be created while a filter is applied. (GP-1615)
+- GUI. Added new Mark and Select action that allows users to create selections in a two-step process. The first time the action is invoked, the current location is marked. The next time the action is invoked, a selection is created from the marked location to the current location. (GP-1616)
+- GUI. The Go To... dialog now supports navigating to file offsets with a
+file(n)search string, and a new File Offset field has been added to the Listing (disabled by default). (GP-1756)- GUI. Created the new Script Quick Launcher Dialog. (GP-1826)
+- GUI. Selecting nodes in the ProjectDataTreePanel was made more efficient. This is only noticeable when there is a very large number of programs in a project. (GP-1931)
+- GUI. Added the Offset table column to the Structure Editor. This column is hidden by default, but can be added by right-clicking on the table's column header. (GP-1943, Issue #3850)
+- GUI. To reduce memory consumption, revised Symbol Table GUI to avoid hanging onto symbol objects. In some cases this may reduce the speed with which the symbol table updates. (GP-2030)
+- GUI. Changed Structure Editor Duplicate Component and Duplicate Multiple of Component... actions to select the last component; this allows for repeated uses of the action via key-binding. (GP-2095, Issue #4229)
+- GUI. Updated the Data Type Manager's right-click menu Replace... action on a selected data type to have a clearer purpose by prompting the user to confirm the replace action. (GP-2405, Issue #4463)
+- GUI. Updated popup menu key event processing to not apply to combo boxes. (GP-2491, Issue #4545)
+- GUI. Added the new Does Not Match Regex table column filter to allow clients to show table rows that do not match the given regular expression. (GP-2582, Issue #4608)
+- GUI. Added the
+TableChooserExecutor.executeInBulk()method to allow script writers to process multiple selected table rows themselves instead of one at a time. (GP-2583, Issue #4609)- GUI. Updated the XRefs Dialog to allow users to show xrefs to thunk functions. (GP-2594, Issue #3851)
+- GUI. Updated the Search Memory Dialog to allow users to paste hex values that begin with
+0x. (GP-2622, Issue #4623)- GUI. Updated the Instruction Info window to allow users to select and copy cells from the table. (GP-2631, Issue #4626)
+- GUI. Updated the Component Providers' drop-down button to allow users to add a keybinding to show the popup menu. (GP-2637, Issue #4625)
+- Importer. Added support for Android Multi-DEX. Created new Android APK loader to load all DEX files at one time and link the
+method_lookupsections using external references. The APK loader uses the manifest file to determine the Android version. (GP-275, Issue #4276)- Importer. Permanently removed the ContinuesInterceptor, which had allowed the import process to proceed past uncaught exceptions that could be encountered while parsing corrupted headers. (GP-1907)
+- Importer. The NeLoader now creates memory blocks using the FileBytes API which enables the file offset Listing field and lookup in the Goto dialog. (GP-2521, Issue #4565, #4570)
+- Importer. Redesigned the Importer's load library option set. The user now has finer-grained control over where libraries are loaded from, as well as how many libraries are loaded. (GP-2541)
+- Importer. Redesigned the Importer's load library option set. The user now has finer-grained control over where already-imported libraries are searched for in the project, as well as where newly imported libraries are saved to in the project. (GP-2604)
+- Importer:ELF. Added ELF import-processing of symbols defined in the
+.gnu_debugdatasection. (GP-1592, Issue #1659)- Importer:ELF. Improved ELF import-processing and logging of missing/truncated headers. (GP-1605, Issue #3507)
+- Importer:ELF. Improved ELF Importer to handle extended program and section header counts
+(e_phnum, e_shnum)which may be encountered for large core/memory dump files in ELF format. (GP-1936, Issue #4149)- Importer:Mach-O. We now discover more Mach-O functions via the LC_FUNCTION_STARTS load command. (GP-1460, Issue #3586, #3668)
+- Importer:Mach-O. Improved symbols and exports in Mach-O and DYLD shared cache files. (GP-2008, Issue #2932)
+- Importer:Mach-O. Improved the Program Tree for Mach-O, DYLD shared cache, and PRELINK files. (GP-2019)
+- Importer:Mach-O. The Objective-C Class Analyzer now works with dyld_shared_cache files. (GP-2113)
+- Importer:Mach-O. Improved processing to support changes in iOS 16 and macOS 13 dyld_shared_cache format. (GP-2176, Issue #4346, #4406)
+- Importer:PE. The Thread Environment Block (TEB) is now automatically populated by an analyzer for PE format programs on x86. (GP-527)
+- Importer:PE. Added label for
+_tls_index. (GP-2166, Issue #4285)- Jython. Upgraded Jython to 2.7.3. (GP-2324, Issue #107)
+- Listing. Added trailing comma on global arrays display. (GP-2165, Issue #4261, #4287)
+- Multi-User. Improved svrAdmin command for controlling repository access. Eliminated
+-adminoption while adding-grantand-revokeoptions. (GP-394, Issue #1703, #2467)- Multi-User. Eliminated use of ganymed-ssh2 library in favor of Bouncy Castle library suite. Improved Ghidra Server SSH authentication error reporting. (GP-1769)
+- Multi-User. The
+svrAdmin(.bat)script will now run under a JRE in addition to a JDK. (GP-2301, Issue #4394)- Multi-User. Improved
+Edit Shared Project Informationcapability which now handles case where user may have checked-out files and is unable to checkin or terminate them when unable to connect to old server (e.g., server name or IP address has changed). (GP-2496)- Multi-User. Upgraded Ghidra Server service wrapper (YAJSW) to 13.05. (GP-2754)
+- PDB. Crafted additional mechanisms for determining segment addresses. (GP-1777, Issue #3993)
+- PDB. When PDB has no type information, changed processing order so that mangled symbols become primary symbols, encouraging recovery of their limited type information. (GP-2385, Issue #4489)
+- PDB. Improved PDB Universal function creation, to include
+unknowncalling convention when a custom calling convention is indicated andnoreturnwhen indicated for a function. Also added initial support for some MIPS and IA64 processors called out in PDB. (GP-2505)- Processors. Implemented semantics for x86/64
+POPCNTinstruction. (GP-1780)- Processors. Updated ARM Processor specification to V9.3. (GP-1790, Issue #4655)
+- Processors. Added conditional assignment macro to x86 processor module. (GP-1819)
+- Processors. Implemented Coldfire
+bitrev,byterev, andff1instructions. (GP-2195, Issue #4270)- Processors. Generalized the 6502 processor spec file. (GP-2332, Issue #1533, #3434)
+- Processors. Added SLEIGH support for
+inst_next2, which can be used to implement conditional skip-next-instruction cases in the language spec. (GP-2480)- Processors. Added
+mips-eabicompiler specification. (GP-2734, Issue #3633, #3634)- References. Added support for use of
+Pointer-Typedefwith Offset setting to signal creation of an OffsetReference. Modified ELF relocation handler to create such pointers for certain relocation types known to be associated which offset-data pointers. Improved Listing operand markup for rendering of OffsetReferences. Took special measures for such data references into theEXTERNALmemory block to remedy XRef and navigation issues. (GP-1036)- References. Reference-finding actions in the Decompiler now work properly when applied to global variables. (GP-1880)
+- References.
+CALLOTHER_OVERRIDE_CALLreferences now cause the inputs of the original CALLOTHER op to be discarded. (GP-2206, Issue #3665, #3936)- Scripting. Upgraded Apache Felix to 7.0.3. (GP-1326, Issue #3450)
+- Scripting. Improved class recovery discovery mechanisms for determining deleting destructors and clones. (GP-1581)
+- Scripting. ApplyClassFunctionDefinitionUpdatesScript has been improved to allow users to choose function definition(s) from the Data Type Manager to apply updates from. Previously, users had to put a cursor somewhere in the related class and possibly get possibly unwanted updates from unchanged definitions in selected class(es). (GP-1660)
+- Scripting. Added a search filter to
+RunYARAFromGhidra.pyto include .yara files. (GP-1794)- Scripting.
+RecoverClassesFromRTTIScripthas been updated to make use of the new shifted pointer data types where applicable. (GP-1947)- Scripting. Updated
+RecoverClassesFromRTTIScriptto prevent it from running more than once on the same program. (GP-1962)- Scripting. Added
+FixElfExternalOffsetDataRelocationScriptto be used in updating EXTERNAL offset data relocations flagged by an ELF Relocation ERROR bookmark. These locations now support the use of an offset pointer-typedef and a resulting offset-reference. (GP-1963)- Scripting. The
+RecoverClassesFromRTTIScripthas been updated to make use of the new program setting allowing use of a preferred data type category for class structure assignment. Due to this change, there is no longer any need to remove existing class structures in order to use those created by this script, so all code related to replacing, other class structures, has been removed. (GP-2010)- Scripting. Added
+CallotherCensusScript, which determines the most frequent instructions with (partially) unimplemented semantics in a single program or across an entire repository. (GP-2072)- Scripting. Improved
+RecoverClassesFromRTTIScriptto distinguish between and name deleting destructors as either scalar or vector ones or both in Windows programs. (GP-2075)- Scripting. Updated the Script Manager to not close dialogs when the manager is closed. (GP-2216, Issue #4363)
+- Scripting. Added
+createNamespaceandcreateClassmethods toFlatProgramAPIfor Ghidra script use. (GP-2482, Issue #4446)- Search. Added the ability to search for structure fields by offset. (GP-1556)
+- Search. Added Navigate to Matching Byte Values action to the main toolbar to find the next matching byte value of the item under the cursor. (GP-1679)
+- Testing. Upgraded hamcrest to 2.2. (GP-1993)
+- Testing. Upgraded pcodetest build scripts to python 3. (GP-2138, Issue #4307)
+- Testing. Upgraded Jacoco to 0.8.8. (GP-2208)
+
+Bugs
++
+- Analysis. Fixed Windows x86 PE RTTI Analyzer to not duplicate labels on type_info vftables when PDB is present. (GP-854)
+- Analysis. Fixed long-standing issue with incorrectly named RTTI Type Descriptor symbols; also added correct class namespace. (GP-1703)
+- Analysis. Fixed issue where, when opening an non-analyzed program with one tool and that tool is connected to another tool, multiple ask-to-analyze dialogs would appear. (GP-1860)
+- Analysis. The Java Analyzer now parses MethodParameters attributes and gracefully handles unknown or unsupported attributes instead of throwing a RuntimeException. (GP-2012, Issue #4089)
+- Analysis. The Variadic Function Signature Override analyzer now handles wide-character format strings which are not defined data. (GP-2016, Issue #4165)
+- Analysis. Improved heuristics used to find strings in the Variadic Function Signature Override analyzer. (GP-2070, Issue #4154, #4281)
+- Analysis. Improved forced thunk creation from function start patterns files and fixed NullPointerException when thunk analysis got ahead of disassembly. (GP-2378, Issue #4369)
+- Analysis. Fixed bug in Variadic Function Signature Override analyzer involving examining too many function arguments. (GP-2384, Issue #4478)
+- Analysis. Changed Analysis to not mark class methods as noreturn unless they are included in the non returning function list as a mangled name. (GP-2471, Issue #2130, #4531)
+- Analysis. Added switching function identification for ARM RealView compiler. (GP-2504)
+- Analysis. Fixed an IllegalStateException in the FunctionStartAnalyzer that could occur for ARM thumb binaries. (GP-2543)
+- Analysis. Corrected Decompiler Switch Analysis issue which could prevent proper function body fixup to include switch code. (GP-2554)
+- Analysis. Fixed code to use the functions calling convention when computing the stack purge. X86 16-bit binaries now correctly display the correct value in the stack depth listing field. (GP-2683, Issue #4294)
+- API. Fixed issue where storing a register context across the entire address space had issues if the image base was a non-zero value. There were also numerous other issues that were uncovered, related to this context/image-base issue change, that were also fixed. (GP-1778)
+- API. Corrected improper instruction context read which could cause issues with delay-slot instructions that rely on context. (GP-2094, Issue #4259)
+- Assembler. Fixed issue with assembler referring to external functions via the IAT or PLT. (GP-615, Issue #2670)
+- Assembler. Refactored Assembler. Fixed issue assembling for x64 in 32-bit compatibility mode. (GP-1426)
+- Assembler. Made Assembler fields obey Listing Display font settings. (GP-1664)
+- Basic Infrastructure. Fixed an IllegalArgumentException that occurred when initializing 1-byte uninitialized memory blocks. (GP-2523)
+- C Parsing. Fixed numerous errors in C-Parser, including updated C specification syntax, macros with varargs, anonymous arrays of function pointers, and array definitions. Also providing better error handling. In addition data types in open archives can be used during parsing. (GP-1979, Issue #1455, #1784, #1940, #3908, #3996, #4184, #4377, #4491, #4517)
+- CParser. C-Parser handles arrays of function pointers and anonymous function signatures correctly. (GP-2258, Issue #3908, #4351)
+- CParser. C-Parser now accepts
+static_assertkeyword in more places, such as within structure definitions. (GP-2273, Issue #4401)- CParser. C-Parser grammar fixed to parse
+#pragmakeyword in more places such as within enum declarations. (GP-2646, Issue #4628)- CParser. C-Parser now defines a placeholder structure name early in parsing. (GP-2692, Issue #3505)
+- CParser. Fixed expansion of macros with missing arguments, concatenated string constants, const after type specification, and
+#pragmafound in function calls. (GP-2746, Issue #2896, #4660, #4676, #4677)- Data Types. Added support for pointer typedefs with various settings. (GP-1403)
+- Data Types. Corrected issues within structure/union editor when specifying a component whose datatype is a pointer to the edited structure (i.e., pointer-to-self). (GP-2134, Issue #3721)
+- Data Types. Added validation to EnumDataType.setLength(). (GP-2689, Issue #4654)
+- DB. Corrected JVM shutdown issue which could cause database recovery files to be discarded. (GP-1787, Issue #3994)
+- Debugger. Fixed occasional, spurious goto-PC when navigating in Debugger listing. (GP-385)
+- Debugger. Eliminated redundant calls to startRecording. (GP-1443, Issue #3559)
+- Debugger. Fixed compatibility issue with GDB 11 regarding module and section list. (GP-1666)
+- Debugger. Corrected Debugger address space mismatch and NullPointerException errors. (GP-1757, Issue #4022, #4023, #4024, #4025)
+- Debugger. Fixed for numerous failures in dbgeng. (GP-1812, Issue #4059)
+- Debugger. Fixed problem with memory refresh in dbgeng/dbgmodel targets. (GP-1852, Issue #4059)
+- Debugger. Fixed a DomainObject deadlock. (GP-1859)
+- Debugger. Fixed consistency issues when saving/loading target-launch command-line options. (GP-1866, Issue #4106)
+- Debugger. Fixed bug when refreshing target memory in dbgeng/dbgmodel connectors. (GP-1893, Issue #4112)
+- Debugger. Fixed register-update failures. (GP-1971)
+- Debugger. Fixed several bugs in the debug launch target monitor dialog. (GP-2102)
+- Debugger. Made miscellaneous fixes for errors in the JDI debugger. (GP-2253)
+- Debugger. Fixed a NullPointerException that occurred when closing the Debugger tool. (GP-2387)
+- Debugger. Fixed issue with Debugger module list when connected to GDB 10.1 on Debian Bullseye. (GP-2533, Issue #4583)
+- Debugger. Fixed issue in module list with gdb-11 and later. (GP-2727)
+- Debugger:Breakpoints. Fixed a bug that caused unexpected behavior when toggling a breakpoint while the cursor is in the Bytes field of the Listing. (GP-2725)
+- Debugger:Breakpoints. Fix address of watchpoints in GDB. (GP-2726)
+- Debugger:Emulator. Fixed spurious
+Emulate read from uninitialized statewarnings when P-Code Stepper window is active. (GP-1650)- Debugger:Emulator. Fixed display of internal p-code labels in Pcode Stepper window. (GP-1883)
+- Debugger:Emulator. Fixed NullPointerException that occurred when adjusting the register-tracking setting on the Dynamic Listing window. (GP-1905)
+- Debugger:Emulator. Fix bug in Taint analyzer with INT_ZEXT and INT_SEXT. (GP-2489)
+- Debugger:Emulator. Fixed issue with emulator writing values at space's max address. (GP-2490)
+- Debugger:GDB. Fixed GDB connector, making it properly parse escaped strings. (GP-1953, Issue #4169)
+- Debugger:GDB. Fixed AddressOutOfRange issues when GDB's
+info proc mappingsfails on 32-bit and smaller targets. (GP-2241, Issue #4345)- Debugger:GDB. Fixed GDB model so that patching PC updates the listing highlight. (GP-2635)
+- Debugger:Mappings. Fixed address/range arithmetic in Static Mapping service. (GP-2011)
+- Debugger:Memory. Fixed font coloring in Dynamic Memory window to indicate changes in the same manner as other Debugger windows. (GP-1890)
+- Debugger:Memory. Fixed auto-read-memory to work with the Force Full View toggle. (GP-2033)
+- Debugger:Objects. Fixed NullPointerException in ObjectTree. (GP-2004, Issue #4221)
+- Debugger:Trace. Fixed Trace API to handle NO_ADDRESS. (GP-2430)
+- Decompiler. Fixed stack trace sporadically encountered when clicking Decompiler brace tokens. (GP-1602)
+- Decompiler. Fixed issue with re-data-typing a variable via the Decompiler window in a big-endian binary. (GP-1673, Issue #2809, #3776)
+- Decompiler. Refactored handling of overlays in the Decompiler to address issues causing it to lose references and enumerations. (GP-1818, Issue #2680, #3900)
+- Decompiler. Decompiler now appends a size suffix to integer tokens when necessary. (GP-1922, Issue #3592)
+- Decompiler. The Decompiler now prevents over-propagation of register values that could misleadingly cause global variable assignments to be reordered. (GP-1997)
+- Decompiler. Fixed a bug in the Decompiler variable hashing system that caused Rename and Retype actions in the Decompiler window to fail. (GP-2006)
+- Decompiler. Fixed bug causing
+Bad storage nodeerror when using the Split Out As New Variable action on register pairs. (GP-2027, Issue #4186)- Decompiler. Added key bindings to allow users to navigate to enclosing braces in the Decompiler. See the Decompiler tool options for details. (GP-2090, Issue #4264)
+- Decompiler. Improved switch analysis, specifically for when constants are stored on the stack. (GP-2359)
+- Decompiler. Patched comparison error that could cause the Decompiler to crash during variable merging. (GP-2466, Issue #4450)
+- Decompiler. Fixed bug preventing the Decompiler from seeing certain pointer aliases on to the stack in segmented architectures. (GP-2515, Issue #4529)
+- Demangler. Fixed issue where changes to the Microsoft Demangler Apply Function Calling Conventions option were not being honored. (GP-2542, Issue #4590)
+- Diff. Corrected Program Diff to properly ignore ordering differences of non-primary labels at a given address. (GP-2558)
+- Disassembly. Fixed issue with disassembling an instruction that contains a delay slot that is at the end of an address space. (GP-1668, Issue #3840)
+- Documentation. Renamed ReloadSleighLangauge.java script to ReloadSleighLanguage.java. (GP-1772)
+- DWARF. Improved naming of DWARF anonymous structures and unions to fix .conflict-matching issues. (GP-1500)
+- DWARF. Fixed bad ordering of function parameters when importing DWARF info. (GP-1682, Issue #3874)
+- DWARF. Fixed DWARF analyzer to support Mach-O .o binaries. (GP-2698, Issue #4659)
+- Eclipse Integration. Fixed an issue in the GhidraDev Eclipse plugin that could cause old extensions to incorrectly remain on the Ghidra project classpath after performing a Link Ghidra operation. (GP-1733)
+- FileSystems. Enhanced Ghidra's zip file system to fall back to Java's built-in zip file support when 7-Zip's native libraries fail to load. (GP-1697, Issue #3904)
+- FileSystems. Fixed issue with 7-Zip native library extraction during initialization that caused core dumps in other Ghidra processes running on the same host. (GP-1770)
+- FileSystems. Fixed issue handling zip files that contain a file with a blank name. (GP-1944, Issue #4128)
+- FileSystems. Fixed a
+hash has changedIOException that would sometimes occur when extracting .dylib files from a dyld_shared_cache file system. (GP-1986, Issue #4208)- FileSystems. By disabling free space checking, fixed problem that occurred when trying to query the available free disk space when in a Linux/Unix chroot environment. (GP-2078, Issue #4291)
+- Graphing. Updated the Function Call Graph to only save graph view information when visible. (GP-2514, Issue #4564)
+- Graphing. Corrected potential HTML injection vulnerability for the Graph Service vertex labeling. (GP-2716)
+- GUI. Fixed GUI lag issues on Windows in the file chooser that occurred when resizing the dialog in a directory with a large number of files. (GP-1634)
+- GUI. Fixed Ghidra's file chooser to allow refreshing the root locations in
+My Computer. (GP-1635)- GUI. Fixed bug that triggered a tool Save Tool - Possible Conflict dialog when using multiple tools. (GP-1637)
+- GUI. Updated the Choose Program dialog to focus the filter field by default so users can start filtering when the dialog opens. (GP-1745)
+- GUI. Updated the field at the bottom of the tool that displays the current instruction. Now, when the cursor is on a data item, the field shows the current datatype and size instead of being blank. (GP-1803)
+- GUI. Fixed issue where newly opened programs didn't have their datatypes tree apply any existing filter. (GP-1897)
+- GUI. Added Ctrl-C/V/X key bindings to the Motif Look and Feel text widgets. (GP-1972)
+- GUI. Corrected bad action description in the Log Viewer window. (GP-1975, Issue #4198)
+- GUI. Fixed NullPointerException that occurred when making a selection in the Table Chooser Dialog. (GP-1982, Issue #4204)
+- GUI. Fixed bug in IntegerTextField when pasting text that doesn't pass internal validation. This could result in an internal corrupted state. (GP-2000)
+- GUI. Improved the file chooser to not hang the GUI if there are slow file system root locations (drive letters) present. (GP-2059)
+- GUI. Updated tree and table filters to support undo/redo via Ctrl-Z and Ctrl-Y. (GP-2186)
+- GUI. Fixed rare exception seen while closing the tool just after a long reference search. (GP-2265)
+- GUI. Fixed an issue that prevented the One Shot analyzers from being enabled when the Listing did not have focus. (GP-2318, Issue #4589)
+- GUI. Fixed an IndexOutOfBoundsException in the Listing when the XREF Group by Function option is toggled on and Maximum Number of XREFs to Display is set to 1. (GP-2328, Issue #4445)
+- GUI. Fixed a NullPointerException that occurred when using the Go To dialog. (GP-2388)
+- GUI. Corrected Function Editor's Custom Storage editor dialog issues that prevented proper editing behavior. (GP-2483, Issue #4492)
+- GUI. Fixed a NullPointerException in the Patch action's auto-complete text field. (GP-2616, Issue #4604)
+- Headless. Fixed analyzeHeadless.bat reporting that
+Maximum setlocal recursion level reachedwhen a large number of command line arguments were specified. (GP-1735)- Headless. Fixed wildcard
+'*'path expansion not working properly when calling headless from Linux/macOS. (GP-2209, Issue #3409, #4500)- Help. Fixed issue of help window not opening when help was missing. (GP-2409)
+- Importer. Fixed NullPointerException in GzfLoader encountered when importing a GZF embedded in a ZIP file. (GP-1667)
+- Importer. Fixed infinite loop in import dialog that occurred when verifying filename with leading tilde (~) character. (GP-1849, Issue #4034)
+- Importer. When importing a file, the internal program name has been changed to reflect the name of the imported file and not the user-selected file name where Ghidra stores the program in the project. Ghidra programs have two names; the internal name and the file storage name. The file storage name must be unique within a project. The internal name can be retrieved using
+program.getName()and the storage name can be retrieved usingprogram.getDomainFile().getName(). (GP-1876)- Importer. External library links produced by the NeLoader are now working correctly. Libraries can now be discovered when loaders specify that library filename extensions are optional. (GP-2497, Issue #2063, #2233)
+- Importer. Case-insensitive library lookup now works for already-imported libraries. (GP-2498, Issue #906)
+- Importer. Libraries are now properly recursively imported. (GP-2510, Issue #110)
+- Importer. Fixed OMF comment record parsing. (GP-2528, Issue #3780, #4560)
+- Importer:ELF. Added
+-applyArmElfRelocPCBiasimport option for relative relocation processing to account for differences in how tool-chains factor in the bias value. (GP-2041)- Importer:ELF. Corrected processing of ELF REL type relocations for
+R_ARM_JUMP24, R_ARM_CALL and R_ARM_PLT32. (GP-2350, Issue #4455)- Importer:ELF. Fixed problem reading Elf32 binaries that were missing certain sections. (GP-2577, Issue #4605)
+- Importer:ELF. Corrected MIPS ELF
+.plt.gotmarkup error which could prevent import. (GP-2592, Issue #4602)- Importer:ELF. Corrected ELF MIPS-64 bit data relocation processing issue for
+R_MIPS_REL32andR_MIPS_32. (GP-2678, Issue #4633)- Importer:ELF. Corrected ELF relocation table processing to handle statically linked binaries. (GP-2703)
+- Importer:ELF. Corrected ELF Import processing of symbol table when associated string table is missing. Previously caused exception. (GP-2744, Issue #4680)
+- Importer:ELF. Added support for ELF
+DT_GNU_XHASHsymbol hash table. (GP-2749, Issue #4649)- Importer:PE. Fixed several bugs in the PE menu resource parser. (GP-1806, Issue #4017, #4018, #4020, #4021)
+- Importer:PE. Fixed incorrect PE driver COFF symbol offsets. (GP-1933, Issue #3564, #4139, #4168)
+- Importer:PE. Changed PE loader to label values found in PE header as
+PE Property[propertyname]instead of just barepropertynamewhen inserting the information into the program info list. (GP-2343, Issue #4452)- Importer:PE. Fixed an issue in the PeLoader that sometimes prevented symbols imported by ordinal from getting correctly labeled with their name. (GP-2422, Issue #4474)
+- Importer:PE. Fixed PE Header PdbInfo structure creation to have correct PDB pathname length. (GP-2428, Issue #4501)
+- Importer:PE. PE DebugDirectory entries with type
+IMAGE_DEBUG_TYPE_EX_DLLCHARACTERISTICSare now supported. (GP-2453, Issue #4502)- Importer:PE. Removed setting of TMode in PELoader for ARM PE files. Relying on the default setting of TMode from language variant selection at time of import. (GP-2525)
+- Listing. Fixed bug that showed incorrect references when double-clicking the XREF text in the Listing. (GP-1891)
+- Listing. Updated the Go To dialog to respect the tool option that restricts searches to the current program. (GP-2296)
+- Multi-User. Corrected ConcurrentModificationException condition on Ghidra Server when cleaning-up stale connection registrations. (GP-2441)
+- PDB. Fixed PDB Universal static local variable processing. (GP-1023)
+- PDB. Fixed calculation of number of files contributing to a module. (GP-1775)
+- PDB. Fixed a NullPointerException that would occur when a PDB did not have DebugInfo. (GP-1827)
+- Processors. Added support for ELF PowerPC
+R_PPC_EMB_SDA21relocation and implementedlqinstruction pcode. (GP-713, Issue #890)- Processors. Corrected issue with avr32
+absinstruction using the floating-pointabspcode operator. (GP-1165)- Processors. Corrected semantics for ARM
+vcvtinstruction. (GP-1503, Issue #3418)- Processors. Fixed TriCore
+jlinstruction semantics. (GP-1638, Issue #3552)- Processors. Corrected carry flag semantics for the M68000
+addxinstruction. (GP-1644, Issue #3818)- Processors. Reduced complexity of several PA-RISC floating-point instructions. (GP-1656)
+- Processors. Corrected semantics for x86
+FSTinstruction. (GP-1694, Issue #3894, #3895)- Processors. Corrected missing register definition in V850 processor. (GP-1701, Issue #3865)
+- Processors. Corrected register operand list for ARM
+vsubinstruction. (GP-1712, Issue #3943, #3944)- Processors. Added undocumented x86
+ffreepinstruction. (GP-1722, Issue #3883)- Processors. Corrected ARM Neon
+vraddhndisassembly. (GP-1736, Issue #3978)- Processors. Simplified the TriCore
+st.tinstruction semantics. (GP-1746, Issue #2326)- Processors. Fixed minor issue with TriCore sleigh file missing closing
+endifstatement. (GP-1762, Issue #4029)- Processors. Corrected semantics of ARM
+bfiinstruction. (GP-1763, Issue #4011)- Processors. Fixed some bugs involving JVM switch instructions and JVM switch analysis. (GP-1774, Issue #3980, #3981)
+- Processors. Included VPFv4 instructions in the ARM language. (GP-1817, Issue #2498, #3222)
+- Processors. Fixed punctuation consistency issue for ARM instructions with register lists. (GP-1837)
+- Processors. Fixed disassembly of M68000
+fmodcaused by manual typo. (GP-1946, Issue #4131)- Processors. Implemented previously unimplemented M68000
+packandunpkinstructions. (GP-2014, Issue #4223)- Processors. Fixed an issue with the RISC-V pattern constraints filename. (GP-2046, Issue #4002, #4003)
+- Processors. Fixed incrementing of the stack pointer in 6502
+PLPinstruction. (GP-2092, Issue #4249)- Processors. Fixed Coldfire
+tpfinstruction to not consume trailing bytes, which may be valid instructions. (GP-2104)- Processors. Fixed the TI MSP430
+RPTinstruction to use correct operand types. (GP-2112)- Processors. Fixed RISCV 64-bit long datatype size and alignment. (GP-2161, Issue #2590)
+- Processors. Fixed register zero reads in microMIPS and MIPS16. (GP-2162)
+- Processors. Fixed x86 SLEIGH issues that caused disassembly errors in various instructions. (GP-2196, Issue #4344)
+- Processors. Corrected semantics for SuperH
+trapainstruction to properly dereference the vector address. (GP-2344, Issue #4396, #4477)- Processors. Renamed avr8
+Wregister toR25R24. (GP-2499, Issue #4516)- Processors. Corrected issue with ARM
+ldrht,ldrsbt,ldrsht, andstrhtnot disassembling. (GP-2536, Issue #4582)- Processors. Corrected port addresses in ATmega256 for
+MAFCR0andMAFPA2L. (GP-2538, Issue #4592)- Processors. Corrected error in 6809 extended-address bit pattern. (GP-2562, Issue #4600)
+- Processors. Corrected missing S bit in ARM thumb
+BICinstruction. (GP-2696)- Processors. Added missing parentheses in 6502 indirect
+JMPinstruction. (GP-2701, Issue #783)- Processors. Corrected several instances of ARM instruction parse conflicts. (GP-2718)
+- References. References in Byte-Mapped memory blocks will now be created correctly. (GP-2420)
+- Scripting. Added the script
+setReusePreviousChoices(boolean)method to allow script writers to not reuse the last-entered values in the variousaskdialogs. (GP-1743, Issue #3937)- Scripting. Improved script error handling during load and initialization. (GP-2618)
+- Sleigh. Fixed a bug causing incorrect p-code to be generated when implementing the behavior of a SLEIGH
+bitrangeoperator applied to a dynamic symbol. (GP-1583, Issue #3716)- Testing. Fixed issue with pcodetest generation when test directory does not exist. (GP-2091, Issue #4239)
+- Version Tracking. Fixed a bug in Version Tracking where calling conventions were no longer being applied when applying function signature markup from the source to the destination program. (GP-1045)
+
Improvements
@@ -552,7 +915,7 @@
- Analysis. Added the Variadic Function Signature Override analyzer, which identifies functions that take a format string as a parameter and applies the correct signature override at each call site. (GP-516)
- Analysis. Added ability to save and easily reuse analysis options in customer-defined configurations. (GP-544, Issue #2182, #312)
- Analysis. Ghidra analysis is now aware of more PE/Windows non-returning functions. (GP-733, Issue #2111)
-- Analysis. ResolveX86orX64LinuxSyscallsScript now properly marks non-returning syscalls. (GP-868, Issue #2761)
+- Analysis.
ResolveX86orX64LinuxSyscallsScriptnow properly marks non-returning syscalls. (GP-868, Issue #2761)- API. Revised Structure and Union API, and associated editor, to eliminate the use of the terms Unaligned/Aligned in favor of a packing enablement designation. Also corrected various change notification issues which may improve archive synchronization and merge behavior. (GP-862, Issue #2681)
- API. Renamed
Datatype.isDynamicallySized()toDataType.hasLanguageDependantLength()to avoid confusion. This method is used internally to differentiate between fixed-length types and those whose length is determined by the compiler specification's data organization (e.g., pointers). (GP-932)- Basic Infrastructure. Improved error reporting when trying to launch Ghidra from the git repo without Eclipse having compiled it. (GP-815, Issue #2872)
diff --git a/Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.html b/Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.html index 63a469fba3..849dfb8996 100644 --- a/Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.html +++ b/Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.html @@ -36,146 +36,203 @@In support of NSA's Cybersecurity mission, Ghidra was built to solve scaling and teaming problems - on complex SRE efforts, and to provide a customizable and extensible SRE research platform. NSA + on complex SRE efforts and to provide a customizable and extensible SRE research platform. NSA has applied Ghidra SRE capabilities to a variety of problems that involve analyzing malicious code and generating deep insights for NSA analysts who seek a better understanding of potential vulnerabilities in networks and systems.
- -Log4j Vulnerability Mitigation
-Please read! There have been several - published CVE security vulnerabilities noted for log4j which Ghidra uses for logging. The known issues - have been resolved in log4j 2.17.1. We strongly encourage - anyone using previous versions of Ghidra or a build from source, to remediate this issue by either upgrading - to the latest Ghidra 10.1.2 version, or patching your current version.
- -- To patch your current Ghidra installation: - -
-- - --
-- Delete any log4j jar files in Ghidra/Framework/Generic/lib.
-- Replace those jar files with the newer log4j 2.17.1 version: log4j-api-2.17.1.jar and log4j-core-2.17.1.jar.
-- Update the log4j version to refer to 2.17.1 in <install_dir>/Ghidra/Features/GhidraServer/data/classpath.frag.
- You can find these in the latest Ghidra 10.1.2 release, or from: -
-- - --
- https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-api/2.17.1/log4j-api-2.17.1.jar
-- https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core/2.17.1/log4j-core-2.17.1.jar
-- The details of the vulnerabilities can be found in the following: - CVE-2021-44228, CVE-2021-44832, CVE-2021-45046, CVE-2021-45105. -
-
-What's New in Ghidra 10.1
+What's New in Ghidra 10.2
The not-so-fine print: Please Read!
-Ghidra 10.1 is fully backward compatible with project data from previous releases. However, programs and data type archives - which are created or modified in 10.1 will not be useable by an earlier Ghidra version.
+Ghidra 10.2 is fully backward compatible with project data from previous releases. However, programs and data type archives + which are created or modified in 10.2 will not be useable by an earlier Ghidra version.
This release includes many new features and capabilities, performance improvements, quite a few bug fixes, and many pull-request contributions. Thanks to all those who have contributed their time, thoughts, and code. The Ghidra user community thanks you too!
+IMPORTANT: Ghidra requires Java 17 JDK to run. A newer version of Java may be acceptable, but has not been tested. Please see the + Ghidra Installation Guide for additional information.
+NOTE: Please note that any programs imported with a Ghidra beta versions or code built directly from source outside of a release tag may not be compatible - and may have flaws that have been corrected. Any programs analyzed with a beta should be considered experimental and re-imported and analyzed with - a release version. As an example, Ghidra 10.1 beta had an import flaw affecting symbol de-mangling that was not correctable. + and may have flaws that have been corrected. Any programs analyzed from a beta or other local master source build should be considered experimental and + re-imported and analyzed with a release version. As an example, Ghidra 10.1 beta had an import flaw affecting symbol demangling that was not correctable. Programs imported with previous release versions should upgrade correctly through various automatic upgrade mechanisms. Any program you will continue to reverse engineer should be imported fresh with a release version or a build you trust with the latest code fixes.
-NOTE: Ghidra Server: The Ghidra 10.1 server is compatible with Ghidra 9.2 and later Ghidra clients. Ghidra 10.1 - clients are compatible with all 9.x servers.
+NOTE: Ghidra Server: The Ghidra 10.2 server is compatible with Ghidra 9.2 and later Ghidra clients. Ghidra 10.2 + clients are compatible with all 10.x and 9.x servers.
+ +NOTE: Platform-specific native executables can be built directly from a release distribution. + The distribution currently provides Linux 64-bit, Windows 64-bit, and MacOS x86 binaries. If you have another platform, + for example a MacOS M1 based system or a Linux variant, the support/buildNatives script can build the Decompiler, + demangler, and legacy PDB executables for your plaform. Please see "Building Ghidra Native Components" section in the + the Ghidra Installation Guide for additional information.
Distribution
-The Ghidra distribution has been enhanced to allow building of native executables directly from a release distribution. - The distribution currently provides Linux 64-bit, Windows 64-bit, and MacOS x86 binaries. If you have another platform, - for example a MacOS M1 based system or a Linux variant, the support/buildNatives script can build the decompiler, - demangler, and legacy PDB executables for your plaform. You will need gradle that supports building for your platform - and a working compiler for your environment. Not every platform can be supported, as a pre-requisite is - support by gradle. Ghidra has been tested to build additional native executables for Linux ARM 64-bit, - Linux x86 variants, and macOS ARM 64-bit.
- -Please see the "Building Ghidra Native Components" section of the Installation Guide for additional information.
+A Software Bill of Materials (SBOM) is now included in the Ghidra release. The SBOM follows the CycloneDX standard, + and can be used with tools such as Dependency-Track to help identify risk in the software supply-chain.
Debugger
-Pure Emulation
-There's a new action Emulate Program (next to the Debug Program button) to launch the current program in Ghidra's p-code emulator. - This is not a new "connector." Rather, it starts a blank trace with the current program mapped in. The user can then step using the usual - "Emulate Step" actions in the "Threads" window. In general, this is sufficient to run simple experiments or step through local regions of code. - To modify emulated machine state, use the "Watches" window. At the moment, no other provider can modify emulated machine state.
- -This is also very useful in combination with the "P-code Stepper" window (this plugin must be added manually via File->Configure). - A language developer can, for example, assemble an instruction that needs testing, start emulating with the cursor at that instruction, - and then step individual p-code ops in the "P-code Stepper" window.
- -Raw Hex for Live Memory
-We've added a variant of the "Bytes" window within dynamic trace, allowing viewing live memory as hex, ascii, etc. The window - includes the same background coloring, navigation, and tracking actions as the "Dynamic Listing". To open this window, select Window -> Bytes -> Memory.
- -LLDB Support
-Working toward debugging macOS targets, we've added support for LLDB. Currently, some effort is required on the user's end to clone, patch, - and build LLDB with language bindings for Java. Once done, the new connectors for LLDB can be used in the normal fashion. While intended for macOS, - these connectors also work on Linux, and may work on Windows, too. This offers an alternative for those who prefer lldb to gdb.
- +The Debugger improvement highlights include:
++++
+- FlatDebuggerAPI is introduced, providing a scripting API for Java-based GhidraScripts. An example DemoDebuggerScript.java + is included to get started.
+- P-code Emulation is improved, including numerous fixes, a new framework for system calls in emulation scripts, and a + prototype taint analyzer.
+- Compatibility is improved, including support for GDB versions 8.0.1 through 12.1, and LLDB version 14.0.
+- Support for memory/register editing is improved in Registers, Dynamic Listing, Memory, and Watches panels.
+- A new Frida connector is introduced, including support for debugging using Frida on USB/remote devices.
+Decompiler
-Many improvements have been made to the decompiler output to improve readability. These include the production of else-if syntax in control flow, - and the reduction of casting when typedefs are involved. In addition, pointer calculation during sub-expression elimination has been improved, and - a new API for iterating and accessing the decompiler output syntax tokens has been added.
+The Decompiler has a myriad of improvements in the latest-release. Many have been long-requested features or improvements. + Highlights of the changes include:
+++
+- Support for union data-types. The Decompiler scores and displays the most likely field based on how code accesses the union. Alternately, a field access can be set manually.
+- Support for pointers with an offset relative to the start of a data type, usually a structure. Examples include windows LIST_ENTRY/CONTAINING_RECORD linked lists, + CString allocation data, and memory allocation records.
+- Support for pointers with a specified address space. Useful for targeting a specific address space such as SPI memory or + in Harvard architectures with multiple address spaces.
+- Improved reconciliation of overlapping views of data-types; for example, passing of sub members of a structure to a function.
+- Marker Margins, similar to the listing marker margins, have been added to display things like Debugger breakpoints.
+- A colored highlighting service has been added, allowing clients to create highlights in the form of background colors for syntax tokens in + the Decompiler UI through API calls.
+- Read-from and write-to access to a volatile variable now display as simple assignments, with a special token color, instead of as read- or write-volatile function calls.
+Data Types
-Support for zero-length data types and components has been improved, although such types will continue to - report a non-zero length using the DataType.getLength() method. For code/features that can support zero-length data types the DataType.isZeroLength() - method must be used to identify this case. The DataType.isZeroLength() is no longer synonymous with DataType.isNotYetDefined() which is - intended to identify data types (i.e., structures and unions) whose components have not yet be specified. Along these same lines, Ghidra - now allows zero-element arrays to be defined. The API methods supporting a trailing flex-array on structures have been removed in favor - of using zero-element array components. Existing flex-array instances will be upgraded accordinagly within Programs and Data Type Archives. - The static method DataTypeComponent.usesZeroLengthComponent(DataType) may be used to determine if a zero-length component - will be used for a specific data type. Due to the overlapping behavior of zero-length components, a data type which returns true - for isNotYetDefined() will not produce a zero-length component.
- -Improved parsing of C header files to correctly extract data type definitions, including corrected sizeof() handling, expression - simplification to a constant for many types such as array size and enumeration value, and handling of type declarations within function - and structure declarations. We have re-parsed most of the included data type archives to take advantage of the changes, and plan to - update the archives to more recent versions of the header files in the near future.
+With this release of Ghidra, support for Pointer Typedefs has been expanded to facilitate the use of specialized + data type settings. Improvements have also been made to ensure that such settings are preserved within data type + archives and merge situations. These settings are not supported at the instance-level and are intended to be an + attribute of the associated pointer. The Typedef provides the ability to tailor a pointer for a specific use. It + is highly recommended that all required Pointer Typedef settings be applied prior to using the data type + (e.g., for defined data, data type components, and variables) since there is currently no change propagation for such modifications. + +
The following Pointer Typedef settings have been introduced with this release:
+++ ++
+- Address Space - allows the destination address space to be specified for a pointer. While this does not affect pointer dereferencing operations + dictated by instruction semantics, it can aid analysis and the generation of associated memory references.
+- Component Offset - provides the ability to specify an offset relative to the associated pointer's referenced data type such that: +
+++<referenced-data-type-storage-address> = <pointer-offset> - <component-offset-setting>+- Offset Mask - bit-mask to be applied prior to any bit-shift (if specified) during the computation of an actual address offset
+ +- Offset Shift - bit-shift to be applied after any bit-mask (if specified) during the computation of an actual address + offset (positive: left-shift, negative: right-shift)
+ +- Pointer Type - facilitates special interpretation of pointers
+ ++++
+- default - normal pointer
+- image-base-relative - pointers whose offset should be treated as relative to the program's image base (e.g., relative virtual address (RVA))
+ +- relative - pointers whose offset is relative to the pointer's storage address
+ +- file-offset - pointers whose offset corresponds to an offset within the loaded binary file (limited to single load file)
+NOTE: The use and consumption of Pointer Typedef settings is in its early stages and may not be utilized by various analyzers. + In addition, some settings are not relevant to some analyzers where instruction semantics will dictate pointer dereferencing.
+ +At the API level, the PointerTypedef and PointerTypedefBuilder classes have been added to simplify the creation of a Pointer Typedef. + While an explicit Typedef name may be used, Pointer Typedefs also support an auto-naming mechanism (constructed with a null/empty name) + which will simply use the pointer name followed by the settings as an attribute list; example:
++ ++int * __((space(ram)))+Within the GUI, using the New->Typedef on <pointer> action on a selected pointer within the Data Type Tree is the quickest way to create one. + Once this is done, use the Settings... action on the selected Pointer Typedef. The Settings dialog will be displayed allowing the various settings + to be applied to the Typedef. Settings should be made to Typedef prior to applying it since settings change propogation is very limited.
+ +C Header File Parsing
+ +C-Parser support has been added for missing C specification syntax from C11 and C23, such as tags, macros with varargs, and _NoReturn. + Numerous parsing errors have also been fixed, including for arrays of function pointers, array definitions, and placement of compiler directives. + In addition, parsing time of extremely large header files has been drastically reduced.
+Error handling and reporting from the Pre-Processor and C-Parser have been improved.
+Several scripts to parse header files outside of the GUI have been included, including one that specially parses AVR8 data types and memory-mapped register + definitions from header files for each AVR8 processor variant. The scripts are CreateAVR8GDTArchiveScript.java, CreateExampleGDTArchiveScript.java, CreateJNIArchivesScript.java, + and CreateDefaultGDTArchives.java.
+Finally, data types in open archives can be used during parsing for undefined data types in a header file. At the start of parsing, use of open + archives can be chosen or ignored without closing open archives. The header files must still parse without error, + however a missing data type or unfound header file may not cause the parsing to fail if an open archive contains a missing, but needed data type definition.
+Mach-O Binary Import
-Mach-O binary import has been greatly improved, including handling of relocation pointer chains, support for newer Objective-C - class structures with RelativePointers, additional load commands, and support for more recent versions of dyld and kernel caches - including split-file dyld_shared_cache variants.
+Mach-O binary analysis continues to improve. Support has been added for new file formats introduced in iOS 16 and macOS 13. + Improvements have also been made to function identification, symbol detection, and Objective-C support.
Android
-Import and analysis of the entire existing set (almost) of Android binaries up to version 12.x is now supported. The type of binaries supported - include: Android Run-Time (ART), Ahead-of-Time (OAT)/ELF, Dalvik Executables (DEX), Compact DEX (CDEX), Verified DEX (VEX), Boot Image, - and Boot Loader formats. Also included are Sleigh modules for DEX files covering each major release of Android; the optimized instructions - vary across versions. Now when importing DEX files, you can select the Dalvik language appropriate to the Android release, which will result - in better analysis.
-Performance Improvements
-There have been many performance improvements to import, analysis, program data base access, many API calls, and the user interface.
-Symbol performance in Ghidra was significantly improved. Specifically, new database indexes were created to improve finding primary - symbols as well as improving lookups by combinations of name, namespace, and address.
+Import and analysis of the entire existing set of Android binaries up to version 13.x is now supported, including new support for the Multi-DEX format. + The type of binaries supported include: Android Run-Time (ART), Ahead-of-Time (OAT)/ELF, Dalvik Executables (DEX), Multi-DEX, Compact DEX (CDEX), + Verified DEX (VEX), Boot Image, and Boot Loader formats. Also included are Sleigh modules for DEX files covering each major release of Android; + the optimized instructions vary across versions.
+A new Android APK loader will load all DEX files at one time and link the
+ +method_lookup+ sections using external references. The new APK loader uses the manifest file to determine the Android version.Analysis
+ +The option Assume Contiguous Functions Only, for the Shared Return Analyzer, has been turned on by default. + The Shared Return Analyzer turns jump instructions into a call if the jump + target is, or should be, considered a function. When turned on, the option treats a jump + over a known function entry point to be a call, even if there is only one jump to that location. The option improves thunk function + recovery as well as decompilation results by using a call to the function instead of including the called functions code within the calling function.
+ +The option has been turned on by default for all processor types except ARM. ARM Thumb binaries can sometimes use BL instructions, + normally used as calls, as an internal jump within a large function. If this option were on by default for such a binary it would cause + additional erroneous functions to be created. The option can be used on ARM binaries, however they should be all ARM code; otherwise any Thumb code + using BL for far jumps must be fixed using the Fix_ARM_Call_JumpsScript and Override_ARM_Call_JumpsScript.
+ +Machine Learning
+An optional MachineLearning extension has been added containing the Random Forest Function Finder Plugin. + The plugin finds undiscovered functions within a binary using classifiers to identify potential function starts. + The plugin trains classifiers using data sets created from known functions within a binary. + These classifiers can then be used by the plugin on the original binary or other binaries to find additional functions + missed by initial analysis.
+The extension can be installed from the Ghidra Project Window via File->Install Extensions...
+Processors
-Improvements and bug fixes to many processors to include: X86, ARM, AARCH64, SPARC, PPC, SH4, RISC-V, and 6502.
+Updated ARM32 and AARCH64 to version v9.3 to include vfp4 instructions.
+Improvements and bug fixes have been made to many processors to include: AARCH64, ARM, AVR8, AVR32, Coldfire, JVM, MIPS, MSP430, PA-Risc, PowerPC, + RISC-V, SuperH, Tricore, V850, X86, 6502, and 68K.
+Sleigh now supports
-inst_next2as well asinst_nextto support branching around the next instruction when its length is unknown. + Many processors have conditional skip instructions which can be used on any instruction, including another skip instruction. + Some sleigh processor developers have tried to use the delayslot() directive to accomplish instruction skipping. Unfortunately, the use of the delayslot() directive + can cause nested delay slots or the potential for branches into the delay slotted instruction, both of which are not supported.DWARF
-Support for loading DWARF debug information from a separate file during import has been added. In addition data type information contained in the - separate debug file can be loaded without application to a program, enabling the use of debug information from a related version of the binary.
+User Interface Improvements
+The Go To... dialog now provides navigation to file offsets. In addition, a new File Offset field is available in the Listing. The + field must be added to the Listing using Edit Listing Fields. + These new features can greatly simplify correlating bytes in program memory with their original location within the file from which they were imported. + Example: to go to the memory location which corresponds to the first byte in the original file, enter
-file(0)in the Go To... dialog.Bug Fixes and Enhancements
+Import Formats
+Support has been added for loading WinDbg and APPORT dump files.
+Redesigned the Importer's library loading options to provide finer-grained control over where libraries are searched + for on disk and in the project, as well as where newly loaded libraries are saved to.
+ +Additional Bug Fixes and Enhancements
Numerous other bug fixes and improvements are fully listed in the ChangeHistory file.
diff --git a/Ghidra/Debug/Framework-TraceModeling/src/main/java/ghidra/trace/database/DBTrace.java b/Ghidra/Debug/Framework-TraceModeling/src/main/java/ghidra/trace/database/DBTrace.java index d962f2c589..a54454b7c0 100644 --- a/Ghidra/Debug/Framework-TraceModeling/src/main/java/ghidra/trace/database/DBTrace.java +++ b/Ghidra/Debug/Framework-TraceModeling/src/main/java/ghidra/trace/database/DBTrace.java @@ -580,8 +580,7 @@ public class DBTrace extends DBCachedDomainObjectAdapter implements Trace, Trace } @Override - // NOTE: addListener synchronizes on this and might generate callbacks immediately - public synchronized DBTraceProgramView getFixedProgramView(long snap) { + public DBTraceProgramView getFixedProgramView(long snap) { // NOTE: The new viewport will need to read from the time manager during init DBTraceProgramView view; try (LockHold hold = lockRead()) { @@ -595,8 +594,7 @@ public class DBTrace extends DBCachedDomainObjectAdapter implements Trace, Trace } @Override - // NOTE: Ditto getFixedProgramView - public synchronized DBTraceVariableSnapProgramView createProgramView(long snap) { + public DBTraceVariableSnapProgramView createProgramView(long snap) { // NOTE: The new viewport will need to read from the time manager during init DBTraceVariableSnapProgramView view; try (LockHold hold = lockRead()) { @@ -613,7 +611,7 @@ public class DBTrace extends DBCachedDomainObjectAdapter implements Trace, Trace } @Override - public synchronized DBTraceTimeViewport createTimeViewport() { + public DBTraceTimeViewport createTimeViewport() { try (LockHold hold = lockRead()) { DBTraceTimeViewport view = new DBTraceTimeViewport(this); viewports.add(view); diff --git a/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/StoredAnalyzerTimes.java b/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/StoredAnalyzerTimes.java index 8072ec72d5..69f78d7338 100644 --- a/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/StoredAnalyzerTimes.java +++ b/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/StoredAnalyzerTimes.java @@ -165,7 +165,7 @@ public class StoredAnalyzerTimes implements CustomOption { Options options = program.getOptions(OPTIONS_LIST); StoredAnalyzerTimes times = (StoredAnalyzerTimes) options .getCustomOption(StoredAnalyzerTimes.OPTION_NAME, new StoredAnalyzerTimes()); - return times; + return times.clone(); } /** diff --git a/Ghidra/Features/Base/src/main/java/ghidra/app/util/viewer/listingpanel/ListingCodeComparisonPanel.java b/Ghidra/Features/Base/src/main/java/ghidra/app/util/viewer/listingpanel/ListingCodeComparisonPanel.java index d7d49f3337..50bca2ccb1 100644 --- a/Ghidra/Features/Base/src/main/java/ghidra/app/util/viewer/listingpanel/ListingCodeComparisonPanel.java +++ b/Ghidra/Features/Base/src/main/java/ghidra/app/util/viewer/listingpanel/ListingCodeComparisonPanel.java @@ -1559,8 +1559,8 @@ public class ListingCodeComparisonPanel if (programs[LEFT] != null) { AddressIndexMap indexMap = listingPanels[LEFT].getAddressIndexMap(); listingPanels[LEFT].getFieldPanel() - .setBackgroundColorModel( - new MarkerServiceBackgroundColorModel(markerManagers[LEFT], indexMap)); + .setBackgroundColorModel(new MarkerServiceBackgroundColorModel( + markerManagers[LEFT], programs[LEFT], indexMap)); unmatchedCodeMarkers[LEFT] = markerManagers[LEFT].createAreaMarker("Listing1 Unmatched Code", "Instructions that are not matched to an instruction in the other function.", @@ -1573,9 +1573,8 @@ public class ListingCodeComparisonPanel if (programs[RIGHT] != null) { AddressIndexMap rightIndexMap = listingPanels[RIGHT].getAddressIndexMap(); listingPanels[RIGHT].getFieldPanel() - .setBackgroundColorModel( - new MarkerServiceBackgroundColorModel(markerManagers[RIGHT], - rightIndexMap)); + .setBackgroundColorModel(new MarkerServiceBackgroundColorModel( + markerManagers[RIGHT], programs[RIGHT], rightIndexMap)); unmatchedCodeMarkers[RIGHT] = markerManagers[RIGHT].createAreaMarker("Listing2 Unmatched Code", "Instructions that are not matched to an instruction in the other function.", @@ -1675,8 +1674,8 @@ public class ListingCodeComparisonPanel indexMaps[LEFT] = new AddressIndexMap(addressSets[LEFT]); markerManagers[LEFT].getOverviewProvider().setProgram(getLeftProgram(), indexMaps[LEFT]); listingPanels[LEFT].getFieldPanel() - .setBackgroundColorModel( - new MarkerServiceBackgroundColorModel(markerManagers[LEFT], indexMaps[LEFT])); + .setBackgroundColorModel(new MarkerServiceBackgroundColorModel(markerManagers[LEFT], + programs[LEFT], indexMaps[LEFT])); } private void updateRightAddressSet(Function rightFunction) { @@ -1692,8 +1691,8 @@ public class ListingCodeComparisonPanel indexMaps[RIGHT] = new AddressIndexMap(addressSets[RIGHT]); markerManagers[RIGHT].getOverviewProvider().setProgram(getRightProgram(), indexMaps[RIGHT]); listingPanels[RIGHT].getFieldPanel() - .setBackgroundColorModel( - new MarkerServiceBackgroundColorModel(markerManagers[RIGHT], indexMaps[RIGHT])); + .setBackgroundColorModel(new MarkerServiceBackgroundColorModel( + markerManagers[RIGHT], programs[RIGHT], indexMaps[RIGHT])); } @Override diff --git a/Ghidra/Features/Base/src/main/java/ghidra/program/database/ProgramBuilder.java b/Ghidra/Features/Base/src/main/java/ghidra/program/database/ProgramBuilder.java index 697de44808..79f040cb94 100644 --- a/Ghidra/Features/Base/src/main/java/ghidra/program/database/ProgramBuilder.java +++ b/Ghidra/Features/Base/src/main/java/ghidra/program/database/ProgramBuilder.java @@ -597,6 +597,15 @@ public class ProgramBuilder { returnType, params); } + public void deleteFunction(String address) throws Exception { + + tx(() -> { + Address entryPoint = addr(address); + FunctionManager functionManager = program.getFunctionManager(); + functionManager.removeFunction(entryPoint); + }); + } + public Library createLibrary(String libraryName) throws DuplicateNameException, InvalidInputException { return createLibrary(libraryName, SourceType.USER_DEFINED); diff --git a/Ghidra/Features/Base/src/test.slow/java/ghidra/app/plugin/core/stackeditor/AbstractStackEditorTest.java b/Ghidra/Features/Base/src/test.slow/java/ghidra/app/plugin/core/stackeditor/AbstractStackEditorTest.java index 9c9b2b2963..6adf7951e9 100644 --- a/Ghidra/Features/Base/src/test.slow/java/ghidra/app/plugin/core/stackeditor/AbstractStackEditorTest.java +++ b/Ghidra/Features/Base/src/test.slow/java/ghidra/app/plugin/core/stackeditor/AbstractStackEditorTest.java @@ -341,6 +341,12 @@ public abstract class AbstractStackEditorTest extends AbstractEditorTest { waitForBusyTool(tool); } + void deleteFunction(String address) throws Exception { + setLocation(address); + builder.deleteFunction(address); + waitForBusyTool(tool); + } + void analyzeStack(String address) { setLocation(address); DockingActionIf analyzeStack = diff --git a/Ghidra/Features/Base/src/test.slow/java/ghidra/app/plugin/core/stackeditor/StackEditorProvider1Test.java b/Ghidra/Features/Base/src/test.slow/java/ghidra/app/plugin/core/stackeditor/StackEditorProvider1Test.java index c1c3537d4e..6637f3d765 100644 --- a/Ghidra/Features/Base/src/test.slow/java/ghidra/app/plugin/core/stackeditor/StackEditorProvider1Test.java +++ b/Ghidra/Features/Base/src/test.slow/java/ghidra/app/plugin/core/stackeditor/StackEditorProvider1Test.java @@ -25,6 +25,7 @@ import javax.swing.SwingUtilities; import org.junit.Test; import docking.action.DockingActionIf; +import ghidra.app.util.datatype.EmptyCompositeException; import ghidra.framework.options.Options; import ghidra.program.model.data.*; import ghidra.program.model.listing.*; @@ -139,10 +140,12 @@ public class StackEditorProvider1Test extends AbstractStackEditorProviderTest { } @Test - public void testUndoAssociatedFunctionCreate() throws Exception { + public void testDeleteAssociatedFunction() throws Exception { Window dialog; // Create the stack frame @ 00000200. createFunction("0x200"); + waitForBusyTool(tool); // wait for analysis to complete + editStack("0x200"); Function f = program.getFunctionManager().getFunctionAt(addr("0x200")); @@ -159,16 +162,23 @@ public class StackEditorProvider1Test extends AbstractStackEditorProviderTest { // Put byte at -0x18 setType(new ByteDataType(), 0); - // Undo the apply of a new data type to an editor component. - undo(program, false); // don't wait, in case there is a modal dialog - waitForSwing(); + runSwing(() -> { + try { + model.apply(); + } + catch (EmptyCompositeException | InvalidDataTypeException e) { + failWithException("Editor apply failure", e); + } + }); + + deleteFunction("0x200"); // Verify the Reload Stack Editor? dialog is not displayed. dialog = getWindow("Reload Stack Editor?"); assertNull(dialog); // Verify the stack editor is not displayed. - assertStackEditorHidden(f); + assertStackEditorHidden(f); // This occurs if function is removed } @Test diff --git a/Ghidra/Features/BytePatterns/src/main/java/ghidra/app/analyzers/FunctionStartAnalyzer.java b/Ghidra/Features/BytePatterns/src/main/java/ghidra/app/analyzers/FunctionStartAnalyzer.java index 8505ea169c..554642c0a4 100644 --- a/Ghidra/Features/BytePatterns/src/main/java/ghidra/app/analyzers/FunctionStartAnalyzer.java +++ b/Ghidra/Features/BytePatterns/src/main/java/ghidra/app/analyzers/FunctionStartAnalyzer.java @@ -44,7 +44,7 @@ import ghidra.xml.XmlElement; import ghidra.xml.XmlPullParser; public class FunctionStartAnalyzer extends AbstractAnalyzer implements PatternFactory { - private static final String FUNCTION_START_SEARCH = "Function Start Search"; + protected static final String FUNCTION_START_SEARCH = "Function Start Search"; protected static final String NAME = FUNCTION_START_SEARCH; private static final String DESCRIPTION = "Search for architecture specific byte patterns: typically starts of functions"; @@ -742,7 +742,7 @@ public class FunctionStartAnalyzer extends AbstractAnalyzer implements PatternFa } } - + @Override public boolean canAnalyze(Program program) { ProgramDecisionTree patternDecisionTree = getPatternDecisionTree(); @@ -816,7 +816,7 @@ public class FunctionStartAnalyzer extends AbstractAnalyzer implements PatternFa AutoAnalysisManager analysisManager = AutoAnalysisManager.getAnalysisManager(program); if (!disassemResult.isEmpty()) { - analysisManager.disassemble(disassemResult); + analysisManager.disassemble(disassemResult, AnalysisPriority.DISASSEMBLY); } analysisManager.setProtectedLocations(codeLocations); @@ -824,49 +824,9 @@ public class FunctionStartAnalyzer extends AbstractAnalyzer implements PatternFa // could be a pattern that said this is a function start, so it isn't potentially anymore potentialFuncResult = potentialFuncResult.subtract(funcResult); - // kick off a later analyzer to create the functions after all the fallout - // it should check that the function is not already part of another function - analysisManager.scheduleOneTimeAnalysis(new AnalyzerAdapter( - FUNCTION_START_SEARCH + " delayed", AnalysisPriority.DATA_ANALYSIS.after()) { - @Override - public boolean added(Program addedProgram, AddressSetView addedSet, - TaskMonitor addedMonitor, MessageLog addedLog) throws CancelledException { - AddressIterator addresses = addedSet.getAddresses(true); - while (addresses.hasNext() && !addedMonitor.isCancelled()) { - Address address = addresses.next(); - // if there are any conditional references, then this can't be a function start - if (hasConditionalReferences(addedProgram, address)) { - continue; - } - Function funcAt = - addedProgram.getFunctionManager().getFunctionContaining(address); - if (funcAt != null) { - if (funcAt.getEntryPoint().equals(address)) { - continue; - } - BookmarkManager bookmarkManager = addedProgram.getBookmarkManager(); - bookmarkManager.setBookmark(address, BookmarkType.ANALYSIS, - getName() + " Overlap", - "Function exists at probable good function start"); - continue; - } - new CreateFunctionCmd(address, false).applyTo(addedProgram, addedMonitor); - } - return true; - } - - private boolean hasConditionalReferences(Program addedProgram, Address address) { - ReferenceIterator refsTo = - addedProgram.getReferenceManager().getReferencesTo(address); - while (refsTo.hasNext()) { - Reference reference = refsTo.next(); - if (reference.getReferenceType().isConditional()) { - return true; - } - } - return false; - } - }, potentialFuncResult); + // kick off a later analyzer to create the functions after all the fallout from disassemlby + PossibleDelayedFunctionCreator analyzer = new PossibleDelayedFunctionCreator(); + analysisManager.scheduleOneTimeAnalysis(analyzer, potentialFuncResult); } if (!funcResult.isEmpty()) { @@ -994,3 +954,59 @@ public class FunctionStartAnalyzer extends AbstractAnalyzer implements PatternFa } } + +/** + * + * One time analyzer used to delay function creation until disassembly has settled. + */ +final class PossibleDelayedFunctionCreator extends AnalyzerAdapter { + + PossibleDelayedFunctionCreator() { + super(FunctionStartAnalyzer.FUNCTION_START_SEARCH + " delayed", AnalysisPriority.DATA_ANALYSIS.after()); + } + + @Override + public boolean added(Program addedProgram, AddressSetView addedSet, + TaskMonitor addedMonitor, MessageLog addedLog) throws CancelledException { + AddressIterator addresses = addedSet.getAddresses(true); + AddressSet functionStarts = new AddressSet(); + while (addresses.hasNext() && !addedMonitor.isCancelled()) { + Address address = addresses.next(); + // if there are any conditional references, then this can't be a function start + if (hasConditionalReferences(addedProgram, address)) { + continue; + } + + // Check for any function containing the potential start detected earlier in analysis + Function funcAt = + addedProgram.getFunctionManager().getFunctionContaining(address); + if (funcAt != null) { + if (funcAt.getEntryPoint().equals(address)) { + continue; + } + BookmarkManager bookmarkManager = addedProgram.getBookmarkManager(); + bookmarkManager.setBookmark(address, BookmarkType.ANALYSIS, + getName() + " Overlap", + "Function exists at probable good function start"); + continue; + } + functionStarts.add(address); + } + + // create functions that still don't exist/overlap + new CreateFunctionCmd(functionStarts, false).applyTo(addedProgram, addedMonitor); + return true; + } + + private boolean hasConditionalReferences(Program addedProgram, Address address) { + ReferenceIterator refsTo = + addedProgram.getReferenceManager().getReferencesTo(address); + while (refsTo.hasNext()) { + Reference reference = refsTo.next(); + if (reference.getReferenceType().isConditional()) { + return true; + } + } + return false; + } +} diff --git a/Ghidra/Framework/SoftwareModeling/src/test/java/ghidra/app/plugin/assembler/sleigh/ARMAssemblyTest.java b/Ghidra/Framework/SoftwareModeling/src/test/java/ghidra/app/plugin/assembler/sleigh/ARMAssemblyTest.java index 6e7778058f..b4c5f1eb52 100644 --- a/Ghidra/Framework/SoftwareModeling/src/test/java/ghidra/app/plugin/assembler/sleigh/ARMAssemblyTest.java +++ b/Ghidra/Framework/SoftwareModeling/src/test/java/ghidra/app/plugin/assembler/sleigh/ARMAssemblyTest.java @@ -111,8 +111,14 @@ public class ARMAssemblyTest extends AbstractAssemblyTest { } @Test - public void testAssemble_T_vmov_i32_d0_simdExpand_0x0_0x0_0xb1() { + public void testAssemble_T_vmov_simd_immed() { assertOneCompatRestExact("vmov.i32 d0,simdExpand(0x0,0x0,0xb1)", "83:ff:11:00", THUMB, 0x00010100, "vmov.i32 d0,simdExpand(0x0,0x0,0xb1)"); + assertOneCompatRestExact("vmov.i16 d0,simdExpand(0x0,0xa,0xb1)", "83:ff:11:0a", THUMB, + 0x00010100, "vmov.i16 d0,simdExpand(0x0,0xa,0xb1)"); + assertOneCompatRestExact("vmov.i32 d0,simdExpand(0x0,0xd,0xb1)", "83:ff:11:0d", THUMB, + 0x00010100, "vmov.i32 d0,simdExpand(0x0,0xd,0xb1)"); + assertOneCompatRestExact("vmov.i64 d0,simdExpand(0x1,0xe,0xb1)", "83:ff:31:0e", THUMB, + 0x00010100, "vmov.i64 d0,simdExpand(0x1,0xe,0xb1)"); } } diff --git a/Ghidra/Processors/ARM/data/languages/ARMneon.sinc b/Ghidra/Processors/ARM/data/languages/ARMneon.sinc index c781b59fa7..737c352036 100644 --- a/Ghidra/Processors/ARM/data/languages/ARMneon.sinc +++ b/Ghidra/Processors/ARM/data/languages/ARMneon.sinc @@ -3983,14 +3983,16 @@ vmlDm: thv_Dm_4^"["^thv_M5^"]" is TMode=1 & thv_c2021=2 & thv_Dm_4 & thv_M5 Qd = VectorMultiplySubtract(Dn,vmlDm,esize2021,udt); } -:vmov.^simdExpImmDT Dd,simdExpImm_8 is (( $(AMODE) & ARMcond=0 & cond=15 & c2527=1 & c2323=1 & c1921=0 & c0707=0 & Q6=0 & c0405=1 ) | - ( $(TMODE_EorF) & thv_c2327=0x1f & thv_c1921=0 & thv_c0707=0 & thv_Q6=0 & thv_c0405=1 )) & Dd & simdExpImmDT & simdExpImm_8 +# Addresses all versions of F6.1.134 except A2/T2 with Q=0 +:vmov.^simdExpImmDT Dd,simdExpImm_8 is (( $(AMODE) & ARMcond=0 & cond=15 & c2527=1 & c2323=1 & c1921=0 & c0707=0 & Q6=0 & c0404=1 ) | + ( $(TMODE_EorF) & thv_c2327=0x1f & thv_c1921=0 & thv_c0707=0 & thv_Q6=0 & thv_c0404=1 )) & Dd & simdExpImmDT & simdExpImm_8 { Dd = simdExpImm_8; } -:vmov.^simdExpImmDT Qd,simdExpImm_16 is (( $(AMODE) & ARMcond=0 & cond=15 & c2527=1 & c2323=1 & c1921=0 & c0707=0 & Q6=1 & c0405=1 ) | - ( $(TMODE_EorF) & thv_c2327=0x1f & thv_c1921=0 & thv_c0707=0 & thv_Q6=1 & thv_c0405=1 )) & Qd & simdExpImmDT & simdExpImm_16 +# Addresses all versions of F6.1.134 except At/T2 with Q=1 +:vmov.^simdExpImmDT Qd,simdExpImm_16 is (( $(AMODE) & ARMcond=0 & cond=15 & c2527=1 & c2323=1 & c1921=0 & c0707=0 & Q6=1 & c0404=1 ) | + ( $(TMODE_EorF) & thv_c2327=0x1f & thv_c1921=0 & thv_c0707=0 & thv_Q6=1 & thv_c0404=1 )) & Qd & simdExpImmDT & simdExpImm_16 { Qd = simdExpImm_16; } @@ -3999,6 +4001,15 @@ vmlDm: thv_Dm_4^"["^thv_M5^"]" is TMode=1 & thv_c2021=2 & thv_Dm_4 & thv_M5 @if defined(VFPv3) +# F6.1.134 vmov A2/T2 + +:vmov^COND^".f16" Sd,vfpExpImm_4 is ( ( $(AMODE) & ARMcond=1 & c2327=0x1d & c2021=3 & c0411=0x90 ) | + ( $(TMODE_E) & thv_c2327=0x1d & thv_c2021=3 & thv_c0411=0x90 ) ) & COND & Sd & vfpExpImm_4 +{ + build COND; + Sd = vfpExpImm_4; +} + :vmov^COND^".f32" Sd,vfpExpImm_4 is ( ( $(AMODE) & ARMcond=1 & c2327=0x1d & c2021=3 & c0411=0xa0 ) | ( $(TMODE_E) & thv_c2327=0x1d & thv_c2021=3 & thv_c0411=0xa0 ) ) & COND & Sd & vfpExpImm_4 { @@ -4006,6 +4017,7 @@ vmlDm: thv_Dm_4^"["^thv_M5^"]" is TMode=1 & thv_c2021=2 & thv_Dm_4 & thv_M5 Sd = vfpExpImm_4; } +# F6.1.134 vmov A2/T2 :vmov^COND^".f64" Dd,vfpExpImm_8 is ( ( $(AMODE) & ARMcond=1 & c2327=0x1d & c2021=3 & c0411=0xb0 ) | ( $(TMODE_E) & thv_c2327=0x1d & thv_c2021=3 & thv_c0411=0xb0 ) ) & COND & Dd & vfpExpImm_8 {