Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature/cached disasm #556

Open
wants to merge 33 commits into
base: master
Choose a base branch
from

Conversation

dannyp303
Copy link
Collaborator

One sentence summary of this PR (This should go in the CHANGELOG!)
Creates two new disassemblers for OFRAK, ofrak_pyghidra using the PyGhidra feature in the ghidra repository, and ofrak_cached for cacheing binary analysis.

Link to Related Issue(s)
None

Please describe the changes in your request.
ofrak_pyghidra.components: One single unpacker that unpacks the entire binary, down to instruction level, with an option switch to not unpack basic blocks into instructions.

ofrak_pyghidra.standalone(name pending): A utility completely seperate from OFRAK that uses pyghidra to generate the cache file used in ofrak_cached

ofrak_cached.components: OFRAK components that ingest a cached analysis file, associates it with a resource id, and uses it to unpack the binary as requested.

Anyone you think should look at this, specifically?
@rbs-jacob

@dannyp303 dannyp303 requested a review from rbs-jacob January 3, 2025 20:16
@rbs-jacob rbs-jacob added this to the 3.3.0 Release milestone Jan 6, 2025
@rbs-jacob rbs-jacob linked an issue Jan 6, 2025 that may be closed by this pull request
)


class CachedProgramUnpacker(Unpacker[None]):
Copy link
Collaborator Author

@dannyp303 dannyp303 Jan 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This component is untested due to code regions being unpacked by the ELF unpacker, could be useful for raw binaries, maybe should be removed?

Comment on lines +54 to +55
class CachedCodeRegionModifier(CachedCodeRegionModifier):
pass
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The cached code region unpacker runs this modifier directly, this is a workaround to have it be discoverable with only pyghidra components injected. I tested that it does not cause conflicts if both the cached_disassembly and pyghidra are injected at the same time.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Improve Ghidra Support
2 participants