GHIDRA software reverse engineering suite of tools

f13nd

Постоянный
Мудрец
Сообщения
52
Реакции
353

Version 9.1.2 download
Release notes
github (только исходники)
Twitter

Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python.

Книга -Chris Eagle and Kara Nance - The Ghidra Book-No Starch Press (2020)
Книга -Ghidra Software Reverse Engineering for Beginners | Packt
 

ClockMan

Посетитель
Мудрец
Сообщения
10
Реакции
484

Error13Tracer

Враг народа
Мудрец
Сообщения
96
Реакции
70
Ghidra v9.2.2 (December 2020)[29.12.2020]
Bugs
  • Graphing. Fixed issue with Graph filters not working and satellite view sometimes not matching graph. (GP-526)
  • Importer:MachO. MachO DYLD cache incorrect offset use has been fixed. (GP-550, Issue ##2560)
  • Listing. Fixed issue where Edit Label action (L key) did not work on primary function symbols. (GP-537)
  • Multi-User. Corrected Ghidra Server build issue for version 9.2.1 which had an improperly generated classpath.frag file. Issue caused server to fail startup with a ClassNotFoundException. (GP-542)
  • Processors. The V850 JMP instruction has been corrected not to use the PC in the address calculation (GP-548, Issue #2570)
  • Processors. Removed erroneous VST4 variant, most likely from a copy/paste error. This fixes the ARM Thumb BL instruction disassembly with a negative offset. (GP-549, Issue #2559)
Скачать: https://ghidra-sre.org/ghidra_9.2.2_PUBLIC_20201229.zip
Зеркало:
Для просмотра содержимого вам необходимо Войти в систему.
 
Последнее редактирование:
  • Понравилось
Реакции: mak

Error13Tracer

Враг народа
Мудрец
Сообщения
96
Реакции
70
Ghidra v9.2.3 (March 2021)[25.03.2021]
Improvements
  • Analysis. Added check for vftable entries in .NEP section and relaxed the requirement that the code must have a return. (GP-649)
  • Analysis. Corrected flaw in RTTI analyzer determination of size of vftables. (GP-688)
  • Basic Infrastructure. Updated TLS protocol preference to use the most preferred/recent version available to both sides of an SSL connection (e.g., TLSv1.3) instead of forcing use of TLSv1.2. (GP-622)
  • Build. Corrected build issues which had prevented users from building Ghidra on an Apple M1 (OS X, AARCH64 architecture). (GP-600, Issue #2653)
  • Demangler. Increased Gnu Demangler parsing performance by changing some regular expressions. (GP-705)
  • Eclipse Integration. Updated SleighEditor to support new endian tag on define token definitions. (GP-721)
  • GUI. Updated the Choose Data Type dialog to apply data types in the same manner as dragging types from the Data Types window. This provides users more control when choosing how to overwrite existing types. (GP-521)
  • Importer:ELF. Added support for ELF relocation R_X86_64_IRELATIVE. (GP-651, Issue #1189)
  • Importer:ELF. Sped up loading of ELF files with large symbol tables. (GP-697)
Bugs
  • Analysis. The RTTI analyzer now runs prior to Reference analysis so that references into vftables are not turned into code or data before the vftables are created. (GP-517)
  • API. Funtion.getCalledFunctions(TaskMonitor) and Function.getCallingFunctions(TaskMonitor) now support passing null for the task monitor parameter, which previously would have thrown an exception. (GP-589, Issue #2643)
  • Data Types. Corrected segmented 32-bit pointer datatype address generation for 16:16 x86 far pointers. (GP-534, Issue #2548)
  • Decompiler. Fixed Decompiler issue where, when a function name extends beyond the line limit, an end-of-line comment could wrap around to additional lines without including additional // comment indicators. (GP-473)
  • Decompiler. Corrected an exception that could occur when attempting to edit function signature from the Decompiler. (GP-597, Issue #2601)
  • Demangler. Changed return type applied to constructors by Demangler from void to Undefined, allowing the Decompiler to determine the type. (GP-790)
  • DWARF. Improved handling of empty DWARF compile units. (GP-743)
  • DWARF. Improved handling of DWARF function signatures when parameter info contains unsupported location opcodes or failed to resolve datatypes. (GP-794)
  • Eclipse Integration. When installing the SleighEditor into Eclipse, the plugin will now show up under the Ghidra category. Previously the Group Items by Category option had to be turned off before the SleighEditor would appear as a visible entry. (GP-564)
  • Eclipse Integration. Fixed an issue with Eclipse PyDev breakpoints not catching. (GP-668, Issue #2713)
  • Eclipse Integration. Fixed an Eclipse GhidraDev exception that occurred when creating a new Ghidra scripting project if a ~/ghidra_scripts directory did not exist. (GP-669)
  • Emulator. Replaced Java floating point emulation to fix multiple rounding issues. (GP-357, Issue #2414)
  • Graphing. Fixed issue with graph filters not updating satellite view when changing edge filters. (GP-557)
  • Graphing. Fixed Function Graph keybindings that did not work when docked in the main Code Browser window. (GP-586, Issue #2641)
  • GUI. Fixed NullPointerException due to using Go To action when there was no open program in the Listing. (GP-66)
  • GUI. Fixed bug in Reference Code Viewer options that caused an exception. (GP-620, Issue #2672)
  • Importer. Fixed exception caused when importing previously exported XML data where the bookmark override option was turned off. (GP-667)
  • Importer:ELF. Fixed a NullPointerException caused by importing an ELF with an uninitialized .got section. (GP-360, Issue #2416)
  • Importer:ELF. Added Support for ELF R_ARM_MOVW_ABS_NC and R_ARM_MOVT_ABS ELF Relocations for ARM. (GP-555, Issue #2510)
  • Importer:ELF. Corrected ELF processing of .init_array and .fini_array which was incorrectly overadjusting entries for an image base change. (GP-699)
  • Importer:Mach-O. Corrected Mach-O fat-binary library import issue and resolved error related to unnamed Mach-O segment. (GP-652, Issue #2702)
  • Importer:Mach-O. Fixed an issue with DYLD Load Command data structures being created in the wrong locations. (GP-689, Issue #2624)
  • Importer:Mach-O. Fixed an exception that occurred when importing Mach-O files that define zero LC_BUILD_VERSION tool entries. (GP-702, Issue #2192)
  • PDB. Fixed createPdbXmlFiles.bat to permit spaces in the path name of Ghidra installation folder and the batch argument name. (GP-575, Issue #2167)
  • PDB. Fixed PDB Universal analyzer to set the run-once flag when finished. (GP-724)
  • PDB. Changed return type applied to constructors by PDB Universal from void to Undefined, allowing the Decompiler to determine the type. (GP-791)
  • Processors. Added missing RFE instruction in MIPS up to version R3000. (GP-33, Issue #1766)
  • Processors. ARM instruction VMUL now decodes correctly. (GP-627, Issue #2677)
  • Processors. Added missing CFINV instruction to AARCH64 processor specification and added definitions for locals in neon instructions. (GP-655, Issue #2710)
  • Scripting. Fixed analyzeHeadless -scriptPath option that didn't work for Python and other non-Java scripts located in non-default directories. (GP-528, Issue #2561)
  • Scripting. Fixed concurrency issue with management of scripting bundle paths. (GP-576)
  • Scripting. Corrected handling for Ghidra Script files which are symlinks that were broken in Ghidra 9.2. (GP-650, Issue #2698)
  • Scripting. Fixed the analyzeHeadless -scriptPath option to correctly parse $GHIDRA_HOME and $USER_HOME. (GP-781)
Скачать: https://ghidra-sre.org/ghidra_9.2.3_PUBLIC_20210325.zip
Зеркало:
Для просмотра содержимого вам необходимо Войти в систему.
 

mak

Соломенные сандалии
Администратор
Сообщения
695
Реакции
411
Что-то сыпет гидра одни ошибки, что на ехе, длл, sys, а sys вобще не открывает, использует RawBinary без выбора, а потом ошибки - java.lang.NoClassDefFoundError: Could not initialize class net.sf.cglib.proxy.Enhancer, файл из винды последней 10-ки

2021-05-1112:01:56ERROR(LoaderService) Unexpected Loader exception from Old-style DOS Executable (MZ) java.lang.RuntimeException: java.lang.NoClassDefFoundError: Could not initialize class net.sf.cglib.proxy.Enhancer
 

f13nd

Постоянный
Мудрец
Сообщения
52
Реакции
353
Что-то сыпет гидра одни ошибки, что на ехе, длл, sys, а sys вобще не открывает, использует RawBinary без выбора, а потом ошибки - java.lang.NoClassDefFoundError: Could not initialize class net.sf.cglib.proxy.Enhancer, файл из винды последней 10-ки

2021-05-1112:01:56ERROR(LoaderService) Unexpected Loader exception from Old-style DOS Executable (MZ) java.lang.RuntimeException: java.lang.NoClassDefFoundError: Could not initialize class net.sf.cglib.proxy.Enhancer
Воспроизвести ошибку не удается. Она очевидно происходит в классе PeLoader, который не может создать ContinuesFactory, пытающийся создать этот самый Enchancer из cglib. Убедись, что используешь openjdk-11(x64), потому что cglib под него заточен.
 
  • Понравилось
Реакции: mak

mak

Соломенные сандалии
Администратор
Сообщения
695
Реакции
411
@f13nd, я любитель всего нового, у меня была jdk-17, взял ниже 16, а 15 была уже деприкейтед и ниже не стал тестировать :D (y), спасибо, попробую!
 

arth

Посетитель
Новичок
Сообщения
28
Реакции
1
что можете сказать об этом отладчике? он лучше Олли?
 

mak

Соломенные сандалии
Администратор
Сообщения
695
Реакции
411
@sendersu, нашёл jdk-15(x64) в архиве, тоже полет нормальный (y)
 

mizuki

Посетитель
Новичок
Сообщения
48
Реакции
29
Периодически заглядываю на прогресс гидры, но до сих пор не пойму как вы ей пользуетесь без нормальных сигнатур? Может, конечно, я ее варить не умею. Засунул ей либу на вход и сделал сигнатуры. Применил к бинарю, так она хоть и распознала сигнатуру но порезала весь манглинг и оставила только имена функций. Например, ns1::Open и ns2::Open обе стали просто Open.
Да и много по мелочи неудобств после иды. Может у кого есть экспорт конфига, который настраивает ее в стиле иды?
 

sendersu

Постоянный
Мудрец
Сообщения
69
Реакции
417
Последнее редактирование:
Верх Низ