Usage: pdg # Native Ghidra decompiler plugin
| pdg # Decompile current function with the Ghidra decompiler
| pdgd # Dump the debug XML Dump
| pdgx # Dump the XML of the current decompiled function
| pdgj # Dump the current decompiled function as JSON
| pdgo # Decompile current function side by side with offsets
| pdgs # Display loaded Sleigh Languages
| pdg* # Decompiled code is returned to r2 as comment
以下配置变量(用于e命令)可用于调整r2ghidra的行为:
r2ghidra.cmt.cpp: C++ comment style
r2ghidra.cmt.indent: Comment indent
r2ghidra.indent: Indent increment
r2ghidra.lang: Custom Sleigh ID to override auto-detection (e.g. x86:LE:32:default)
r2ghidra.linelen: Max line length
r2ghidra.nl.brace: Newline before opening '{'
r2ghidra.nl.else: Newline before else
r2ghidra.sleighhome: SLEIGHHOME
要同时构建Cutter插件,请将-DBUILD_CUTTER_PLUGIN = ON -DCUTTER_SOURCE_DIR = / path / to / cutter / source传递给cmake,例如:
/my/path> git clone https://github.com/radareorg/cutter
/my/path> # build Cutter, clone r2ghidra-dec, etc.
...
/my/path/r2ghidra-dec> mkdir build && cd build
/my/path/r2ghidra-dec/build> cmake -DBUILD_CUTTER_PLUGIN=ON -DCUTTER_SOURCE_DIR=/my/path/cutter -DCMAKE_INSTALL_PREFIX=~/.local ..
/my/path/r2ghidra-dec/build> make && make install
License
Please note that this plugin is available under the LGPLv3, which is more strict than Ghidra's license!
This program is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with this program. If not, see https://www.gnu.org/licenses/.
Here Be Dragons: Reverse Engineering with Ghidra - Part 0 [Main Windows & CrackMe]
An Abstract Interpretation-Based Deobfuscation _https://www.msreverseengineering.com/blog/2019/4/17/an-abstract-interpretation-based-deobfuscation-plugin-for-ghidra
Analyzing Emotet with Ghidra — Part 1 _https://medium.com/@0xd0cf11e/analyzing-emotet-with-ghidra-part-1-4da71a5c8d69 Analyzing Emotet with Ghidra — Part 2 _https://medium.com/@0xd0cf11e/analyzing-emotet-with-ghidra-part-2-9efbea374b14
AUTOMATING GHIDRA: WRITING A SCRIPT TO FIND BANNED FUNCTIONS _https://www.vdalabs.com/2019/03/09/automating-ghidra-writing-a-script-to-find-banned-functions/
GhidraX64Dbg Extension containing a Ghidra script to export annotations from Ghidra to an X32/X64 database. _https://github.com/revolver-ocelot-saa/GhidraX64Dbg
.gdt files are data type archives. They contain data type to symbol correlation data. When applied to e.g. imported functions, the functions will be assigned the correct signatures via these files. _https://github.com/0x6d696368/ghidra-data/tree/master/typeinfo