首页
社区
课程
招聘
[转帖]ghidra_2020年12月22日更新:9.2.1_PUBLIC_20201215
发表于: 2019-9-26 08:30 21198

[转帖]ghidra_2020年12月22日更新:9.2.1_PUBLIC_20201215

2019-9-26 08:30
21198

备注:

版本:ghidra_9.2.1_PUBLIC_20201215

国内网盘备份

https://pan.baidu.com/s/1C9JYsPq0xvF5pGW8yefeaw 

pass:e57x 


Ghidra软件逆向工程框架简介

Ghidra 是由国家安全局研究局创建和维护的软件逆向工程 (SRE)框架。此框架包括一套功能齐全的高端软件分析工具,使用户能够分析各种平台上编译的代码,包括 Windows、macOS 和 Linux。功能包括拆解、组装、反编译、图形和脚本,以及数百个其他功能。Ghidra 支持各种处理器指令集和可执行格式,可以在用户交互和自动模式下运行。用户还可以使用 Java 或 Python 开发自己的 Ghidra 插件组件和/或脚本。为了支持 NSA 的网络安全任务,Ghidra 的构建是为了解决复杂 SRE 工作上的扩展和团队问题,并提供一个可自定义且可扩展的 SRE 研究平台。NSA 已将 Ghidra SRE 功能应用于各种问题,这些问题涉及分析恶意代码,并给寻求更好地了解网络和系统中潜在漏洞的 SRE 分析师生成深入见解。

Ghidra的主要特点:

  • 包括一套软件分析工具,用于分析各种平台上编译的代码,包括 Windows、Mac 操作系统和 Linux
  • 功能包括拆解、组装、反编译、图形和脚本,以及数百个其他功能
  • 支持各种处理器指令集和可执行格式,并且可以在用户交互和自动模式下运行。
  • 用户可以使用公开的 API 开发自己的 Ghidra 插件组件和/或脚本


Ghidra v9.1 (September 2019)

Data Types. Added bit-field support to Structure and Union editor. An additional Bit-field Editor was also added for explicit bit-field placement within unaligned structures. (GT-559)
Eclipse Integration. Added new GhidraSleighEditor Eclipse plugin in the installation directory under Extensions/Eclipse. (GT-113)
GUI. Added method for turning off table sorting by control-clicking the only sorted table column. (GT-2763, Issue #87)
GUI. Hovering on an address will now show where the byte at that address came from in the imported file. (GT-3016, Issue #154)
Importer:MachO. Added new importer/loader for DYLD-shared cache files. (GT-2343)
Languages. Implemented Intel MCS-96 processor module. (GT-2350)
Languages. Added Tricore processor specification. (GT-3041, Issue #567)
Languages. Added HCS12X processor specification. (GT-3049)
Languages. Added HCS05 and HCS08 sleigh processor specifications. (GT-3050)
Languages. Added SH4 sleigh processor specification. (GT-3051, Issue #37)
Languages. Added MCS-48 processor specification. (GT-3058, Issue #638)
Memory. Added new API to preserve imported program's original bytes and how they map to memory blocks. (GT-2845)
Program API. Added Bit-field support for structures and unions. Warning: Version upgrade will be forced on all modified programs and data type archives that are open for update. (GT-557)
Sleigh. Added two new extension modules (SleighDevTools and GnuDisassembler) in support of processor module development. Added support for pcode junit tests which utilize emulation of cross-compiled C test code to verify sleigh pcode (i.e., instruction semantics). The SleighDevTools extension provides the pcode test C source and associated build scripts, as well as external disassembler support for aiding in the validation of disassembled instruction syntax. (GT-3067)


_http://sendfile.su/1518004



Ghidra安装指南

提供的安装信息自 Ghidra 9.2 起生效,并且可能会随着将来的发布而更改。


支持平台

  • Microsoft Windows 7或10(64位)
  • Linux(64位,首选CentOS 7)
  • macOS(OS X)10.8.3+(Mountain Lion或更高版本)

注意:现在不建议使用所有32位OS安装。如果您有特殊需要,请联系Ghidra团队。

最低要求

硬件

  • 4 GB内存
  • 1 GB的存储空间(用于已安装的Ghidra二进制文件)
  • 强烈建议使用双显示器

软件

  • Java 11 64位运行时和开发套件(JDK)(请参阅Java Notes

安装Ghidra

要安装Ghidra,只需使用任何解压缩程序(内置OS实用程序,7-Zip,WinZip,WinRAR等)将Ghidra分发文件提取到所需的文件系统目标即可。

安装注意事项

  • Ghidra不使用传统的安装程序。取而代之的是,Ghidra分发文件只是在文件系统上原地提取的。这种方法具有优点和缺点。从好的方面来说,安装Ghidra供个人使用不需要管理特权。另外,由于安装Ghidra不会更新Windows上的注册表之类的任何操作系统配置,因此删除Ghidra就像删除Ghidra安装目录一样简单。不利的一面是,Ghidra不会在桌面上自动创建快捷方式,也不会出现在应用程序的开始菜单中。
  • 可能需要管理特权才能将Ghidra提取到某些文件系统目标位置(例如C:\),并将Ghidra Server作为服务安装。
  • Ghidra依靠使用安装目录之外的目录来管理临时和较长寿命的缓存文件。Ghidra尝试使用为此目的而设计的标准OS目录,以避免出现多个问题,例如将大量数据存储到漫游配置文件中。如果怀疑这些目录的默认位置引起了问题,则可以通过修改support / launch.properties文件中的相关属性来更改它们 

Java笔记

  • Ghidra需要PATH上受支持的Java Runtime and Development Kit版本。但是,如果PATH上有Ghidra不支持的Java版本,它将使用该Java版本(如果是1.7或更高版本)来帮助您在系统上查找受支持的版本。如果无法自动找到,则将提示用户输入要使用的Java主目录的路径(Java主目录是Java的bin目录的父目录)。这样可以最大程度地减少Ghidra对其他软件可能依赖的Java现有配置的影响。
  • 如果Ghidra由于PATH中没有Java版本无法运行, 则应手动安装受支持的JDK并将其添加到PATH中。以下步骤概述了如何将JDK分发添加到操作系统的PATH。
    • Windows:将JDK发行版(.zip文件)提取到所需位置,然后将JDK的bin目录添加到PATH中:

    • Linux和macOS(OS X):将JDK发行版(.tar.gz文件)提取到所需位置,然后将JDK的bin目录添加到PATH中:

    1. 提取JDK:
      tar xvf <JDK发行版.tar.gz>
    2. 用您选择的编辑器打开〜/ .bashrc。例如:
      vi〜/ .bashrc
    3. 在文件的最后,将JDK bin目录添加到PATH变量中:
      export PATH = <提取的JDK目录的路径> / bin:$ PATH
    4. 保存存档
    5. 重新启动所有打开的终端窗口以使更改生效
    1. 提取JDK:

    2. 打开环境变量窗口:

    3. 将JDK bin目录添加到PATH变量中:

    4. 重新启动所有打开的命令提示符窗口,以使更改生效
    1. 右键单击该zip文件,然后单击全部提取...
    2. 单击提取
    1. Windows 10:右键单击Windows“开始”按钮,然后单击“系统”。

      Windows 7:单击Windows“开始”按钮,右键单击“计算机”,然后单击“ 属性”。

    2. 点击高级系统设置
    3. 单击环境变量...
    1. 在系统变量下,突出显示路径,然后单击编辑...。
    2. 在“变量值”字段的末尾,添加分号,后跟 <提取的JDK目录的路径> \ bin
    3. 点击确定
    4. 点击确定
    5. 点击确定
  • 在某些情况下,您可能希望Ghidra使用特定的Java版本而不是Ghidra自动定位的版本启动。要强制Ghidra使用特定版本的Java启动,请support / launch.properties文件中设置JAVA_HOME_OVERRIDE属性如果将此属性设置为Java的不兼容版本,则Ghidra将恢复为自动查找兼容版本。请注意,某些Java必须仍然在PATH上,Ghidra才能使用JAVA_HOME_OVERRIDE属性。此限制将在以后版本的Ghidra中解决。

Ghidra安装目录布局

安装Ghidra后,可运行软件将解压缩到新目录,我们将其称为<GhidraInstallDir>以下是对分发文件的提取完成后可以在<GhidraInstallDir>中找到的顶级目录和文件的说明

吉德拉Ghidra分发的基本目录。包含运行Ghidra所需的文件。
扩展名可以扩展Ghidra功能并将Ghidra与其他工具集成的可选组件。
有关更多信息,请参见扩展部分。
GPL独立的GPL支持计划。
服务器包含与Ghidra Server安装和管理有关的文件。
支持包含对调试Ghidra,在高级模式下运行Ghidra以及控制Ghidra的启动方式有用的文件。
docs包含有关Ghidra的文档,例如发行说明,API文件,教程等。
ghidraRun(.bat)用于启动Ghidra的脚本。
LICENSE.txtGhidra许可证信息。
执照包含Ghidra使用的许可证。

运行Ghidra

GUI模式

  1. 导航到<GhidraInstallDir>
  2. 运行ghidraRun.bat(Windows)或ghidraRun(Linux或macOS)

    如果Ghidra无法启动,请参阅“故障排除”部分。

Ghidra服务器

Ghidra可以支持多个用户在一个项目上一起工作。各个Ghidra用户启动并使用他们自己的特定Ghidra项目本地副本,但是将更改检查到包含该仓库所有提交的公共仓库中。有关安装/配置Ghidra服务器的详细信息,请参见 <GhidraInstallDir> /server/svrREADME.html文件。

Headless (Batch) 模式

传统上,Ghidra在GUI模式下运行。但是,它也可以使用命令行以无头批处理模式运行。有关更多信息,请参见 <GhidraInstallDir> /support/analyzeHeadlessREADME.html文件。

Single Jar 模式


通常,Ghidra是作为一个完整的目录结构安装的,该目录结构允许模块化包含或删除功能集,并提供许多可以扩展或配置的文件。但是,有时以牺牲配置选项为代价将全部或部分Ghidra子集压缩到单个jar文件中会很有用。这使Ghidra可以更轻松地从命令行运行以进行无头操作,或用作另一个Java应用程序的逆向工程功能库。

可以使用<GhidraInstallDir> / support / buildGhidraJar脚本创建单个ghidra.jar文件 


扩展名

扩展是可选组件,可以:

  • 通过实验或用户提供的Ghidra插件或分析器扩展Ghidra的功能。
  • 将其他工具与Ghidra集成,例如Eclipse或IDAPro。

Ghidra带有以下可用扩展名(默认情况下已卸载),可以在<GhidraInstallDir> / Extensions目录中找到它们。

  • Eclipse: GhidraDev Eclipse插件,用于预先存在的Eclipse安装。有关安装和使用Eclipse GhidraDev插件的信息,请参见 <GhidraInstallDir> /Extensions/Eclipse/GhidraDev/GhidraDev_README.html。
  • Ghidra: Ghidra扩展(以前称为contribs)。有关更多信息,请参见 Ghidra扩展说明
  • IDAPro: IDAPro插件/加载器,用于通过Ghidra传输项目。

Ghidra扩展说明

  • Ghidra扩展旨在从Ghidra前端GUI安装和卸载:

    1. 单击文件→安装扩展...
    2. 复选框以安装扩展;取消选中复选框以卸载扩展
    3. 重新启动Ghidra,以使更改生效
  • 从Ghidra前端GUI安装的扩展程序安装在 <UserDir> /.ghidra/.ghidra-[version]/Extensions中。
  • 可以将Ghidra扩展名直接安装到Ghidra安装目录中。如果系统管理员正在管理全部使用共享安装的Ghidra的多个用户的扩展,则可能需要这样做。如果只无头使用Ghidra安装,以这种方式管理扩展也可能会更方便。


    要在这种情况下安装扩展程序,只需将所需的Ghidra扩展程序存档文件提取到<GhidraInstallDir> / Ghidra / Extensions目录中。例如,在Linux或macOS上:

    要卸载扩展,只需从<GhidraInstallDir> / Ghidra / Extensions中删除提取的扩展目录 扩展将在下次启动Ghidra时被卸载。

    注意:如果正在运行的Ghidra实例在试图删除的扩展目录上持有文件锁,则可能无法以这种方式卸载扩展。

    1. 将当前目录设置为Ghidra installed-extensions目录:
    2. cd <GhidraInstallDir> / Ghidra /扩展
    3. 将所需的扩展存档文件提取到当前目录:
    4. 解压缩../../Extensions/Ghidra/<extension>.zip
    5. 扩展将在下次启动Ghidra时安装。




[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)

最后于 2020-12-22 09:26 被梦幻的彼岸编辑 ,原因:
收藏
免费 5
支持
分享
最新回复 (31)
雪    币: 213
活跃值: (507)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
2
沙发
2019-9-26 10:33
0
雪    币: 97697
活跃值: (200824)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
3
非常感謝 LiteLu 編譯上傳的mac版本
ghidra_9.1_DEV_20190926_osx64
_https://pan.baidu.com/s/1VBSTM4PdZr4_f898PhlTwQ
2019-9-26 10:43
0
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
4
2019-9-26 10:54
0
雪    币: 97697
活跃值: (200824)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
5

Ghidra v9.1.1 (December 2019)

Improvements

Importer:MachO. Improved import/load time of DYLD shared cache files. (GT-3261)

Program API. Cached the addresses that correspond to executable memory to improve analysis performance. (GT-3260)

----

Bugs

Analysis. Fixed a symbol name error that occurred in the Objective-C analyzer. (GT-3321, Issue #1200)

Analysis. Constant references are now computed correctly within functions in overlay spaces. (GT-3373)

Build. Corrected build of DMG.jar which was improperly built within Ghidra 9.1 release. (GT-3364)

Decompiler. Fixed bug causing Pcode: XML comms: Badly formed address errors when decompiling HCS12 XGATE code. (GT-3297)

Decompiler. Fixed Array DataType must be Fixed length exceptions related to function pointer data types. (GT-3309)

Decompiler. Fixed bug causing decompiler to drop statements, assigning string constants to global variables. (GT-3315)

Decompiler. Fixed issue with enum name strings causing Low-level Error: XML error: syntax error in the decompiler. (GT-3387, Issue #1329)

GUI. Fixed a potential ConcurrentModificationException in the interactive python interpreter. (GT-3280)

Importer:PE. Fixed an exception in the PeLoader that occurred when the size of the memory block for the headers is larger than the file size. (GT-3344, Issue #1266)

Languages. Corrected Sparc floating point instruction pcode implementation. (GT-3202)

Languages. Corrected the semantics of the PowerPC e_cmpi instruction. (GT-3228, Issue #1127)

Languages. Corrected bit generation for PowerPC instructions se_bclri, se_bgeni, se_bseti, and se_btsti. (GT-3232, Issue #967)

Languages. Corrected register definitions for x86 RDRAND instruction. (GT-3253, Issue #1169)

Languages. Corrected signed immediate calculation for some powerPC VLE offsets being incorrect. (GT-3254, Issue #1160)

Languages. Resolved issue with x86 escape opcodes preventing certain instruction patterns from decoding. (GT-3256)

Languages. Corrected bug in XGATE LDH instruction shifting out high bits. (GT-3268)

Languages. Corrected processing of R_MIPS_REL32, R_X86_64_RELATIVE, and R_X86_64_RELATIVE64 ELF relocations affecting relocatable binaries which have non-zero section/segment load addresses. (GT-3349)

Listing. Fixed missing scroll bar in listing. (GT-3290)

Listing. Fixed issue that was causing a stack trace to be generated when contiguous addresses were cleared for a range greater than Integer.MAX. (GT-3357)

Listing:References. Corrected Create Default Reference action bug which did not handle composite/array data components properly. (GT-3371)

_https://yadi.sk/d/OcQ3XAfzzeei-A


2020-1-8 12:33
0
雪    币: 1432
活跃值: (11)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
6
感谢分享啊 
2020-1-16 13:12
0
雪    币: 97697
活跃值: (200824)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
7

Ghidra_9.1.2_build

_https://github.com/NationalSecurityAgency/ghidra/archive/Ghidra_9.1.2_build.zip

_https://github.com/NationalSecurityAgency/ghidra/archive/Ghidra_9.1.2_build.tar.gz

2020-5-23 19:47
0
雪    币: 97697
活跃值: (200824)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
8

Patch Diffing with Ghidra

_https://ihack4falafel.github.io/Patch-Diffing-with-Ghidra/


2020-5-26 06:06
0
雪    币: 97697
活跃值: (200824)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
9

Ghidra C++ Class and Run Time Type Information Analyzer

_https://github.com/astrelsky/Ghidra-Cpp-Class-Analyzer


2020-5-26 06:07
0
雪    币: 97697
活跃值: (200824)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
10

SVD-Loader for Ghidra

_https://github.com/leveldown-security/SVD-Loader-Ghidra


2020-5-26 06:08
0
雪    币: 97697
活跃值: (200824)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
11

Ghidra Unicorn

This is a work in progress, possibly worse than Ghidra's built in emulator and certainly full of issues.

In the future, I'd like to get Unicorn and Capstone installed within Ghidra's jython environment, but for now this script will export a pickle file from Ghidra and then a seperate python3 script will import the data and run unicorn

_https://github.com/AndrewFasano/ghidra-unicorn


2020-5-26 06:09
0
雪    币: 97697
活跃值: (200824)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
12

Ghidra Patch Diff Correlator Project

_https://github.com/threatrack/ghidra-patchdiff-correlator


2020-5-26 06:10
0
雪    币: 97697
活跃值: (200824)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
13

Using OOAnalyzer to Reverse Engineer Object Oriented Code with Ghidra

_https://insights.sei.cmu.edu/sei_blog/2019/07/using-ooanalyzer-to-reverse-engineer-object-oriented-code-with-ghidra.html


2020-5-26 06:12
0
雪    币: 97697
活跃值: (200824)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
14

Ghidra Firmware Utilities

_https://github.com/al3xtjames/ghidra-firmware-utils


2020-5-26 06:13
0
雪    币: 97697
活跃值: (200824)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
15

Dragon Dance

What is that?

Dragon Dance is a plugin for Ghidra to get visualize and manipulate the binary code coverage data. Coverage data can be imported from the multiple coverage sources. For now the plugin supports Dynamorio and Intel Pin binary instrumentation tools. Dynamorio has its own coverage collection module called "drcov". Intel Pin does not provide a builtin coverage collector module. To handle the lack of module situation I have to write my own coverage collection module for Intel Pin. So I wrote a coverage collection module for Intel Pin named ddph (Dragon Dance Pin Helper). So you can use that. You can view ddph's source from this link. If you are lazy to compile for your own, you can use the compiled binaries I provided for Windows, macOS and Linux.

_https://github.com/0ffffffffh/dragondance


2020-5-26 06:14
0
雪    币: 97697
活跃值: (200824)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
16

Ghidra 9.2 released!

Ghidra v9.2 (November 2020)


New Features


Graphing. A new graph service and implementation was created. The graph service provides basic graphing capabilities. It was also used to generate several different types of graphs including code block graphs, call graphs, and AST graphs. In addition, an export graph service was created that supports various formats. (GP-211)

PDB. Added a new, prototype, platform-independent PDB analyzer that processes and applies data types and symbols to a program from a raw (non-XML-converted) PDB file, allowing users to more easily take advantage of PDB information. (GT-3112)

Processors. Added M8C SLEIGH processor specification. (GT-3052)

Processors. Added support for the RISC-V processor. (GT-3389, Issue #932)

Processors. Added support for the Motorola 6809 processor. (GT-3390, Issue #1201)

Processors. Added CP1600-series processor support. (GT-3426, Issue #1383)

Processors. Added V850 processor module. (GT-3523, Issue #1430)

Improvements


Analysis. Increased the speed of the Embedded Media Analyzer, which was especially poor for large programs, by doing better checking and reducing the number of passes over the program. (GT-3258)

Analysis. Improved the performance of the RTTI analyzer. (GT-3341, Issue #10)

Analysis. The handling of Exception records found in GCC-compiled binaries has been sped up dramatically. In addition, incorrect code disassembly has been corrected. (GT-3374)

Analysis. Updated Auto-analysis to preserve work when encountering recoverable exceptions. (GT-3599)

Analysis. Improved efficiency when creating or checking for functions and namespaces which overlap. (GP-21)

Analysis. Added partial support of Clang for Windows. (GP-64)

Analysis. RTTI structure processing speed has been improved with a faster technique for finding the root RTTI type descriptor. (GP-168, Issue #2075)

API. The performance of adding large numbers of data types to the same category has been improved. (GT-3535)

API. Added the BigIntegerNumberInputDialog that allows users to enter integer values larger than Integer.MAX_VALUE (2147483647). (GT-3607)

API. Made JSON more available using GSON. (GP-89, Issue #1982)

Basic Infrastructure. Introduced an extension point priority annotation so users can control extension point ordering. (GT-3350, Issue #1260)

Basic Infrastructure. Changed file names in launch.bat to always run executables from System32. (GT-3614, Issue #1599)

Basic Infrastructure. Unknown platforms now default to 64-bit. (GT-3615, Issue #1499)

Basic Infrastructure. Updated sevenzipjbinding library to version 16.02-2.01. (GP-254)

Build. Ghidra's native Windows binaries can now be built using Visual Studio 2019. (GT-3277, Issue #999)

Build. Extension builds now exclude gradlew artifacts from zip file. (GT-3631, Issue #1763)

Build. Reduced the number of duplicated help files among the build jar files. (GP-57, Issue #2144)

Build. Git commit hash has been added to application.properties file for every build (not just releases). (GP-67)

Contrib. Extensions are now installed to the user's settings directory, not the Ghidra installation directory. (GT-3639, Issue #1960)

Data Types. Added mutability data settings (constant, volatile) for Enum datatype. (GT-3415)

Data Types. Improved Structure Editor's Edit Component action to work on array pointers. (GP-205, Issue #1633)

Decompiler. Added Secondary Highlights to the Decompiler. This feature allows the user to create a highlight for a token to show all occurrences of that token. Further, multiple secondary highlights are allowed at the same time, each using a unique color. See the Decompiler help for more information. (GT-3292, Issue #784)

Decompiler. Added heuristics to the Decompiler to better distinguish whether a constant pointer refers to something in the CODE or DATA address space, for Harvard architectures. (GT-3468)

Decompiler. Improved Decompiler analysis of local variables with small data types, eliminating unnecessary casts and mask operations. (GT-3525)

Decompiler. Documentation for the Decompiler, accessible from within the Code Browser, has been rewritten and extended. (GP-166)

Decompiler. The Decompiler can now display the namespace path (or part of it) of symbols it renders. With the default display configuration, the minimal number of path elements necessary are printed to fully resolve the symbol within the current scope. (GP-236)

Decompiler. The Decompiler now respects the Charset and Translate settings for string literals it displays. (GP-237)

Decompiler. The Decompiler's analysis of array accesses is much improved. It can detect more and varied access patterns produced by optimized code, even if the base offset is not contained in the array. Multi-dimensional arrays are detected as well. (GP-238, Issue #461, #1348)

Decompiler. Extended the Decompiler's support for analyzing class methods. The class data type is propagated through the this pointer even in cases where the full prototype of the method is not known. The methods isThisPointer() and isHiddenReturn() are now populated in HighSymbol objects and are accessible in Ghidra scripts. (GP-239, Issue #2151)

Decompiler. The Decompiler will now infer a string pointer from a constant that addresses the interior of a string, not just the beginning. (GP-240, Issue #1502)

Decompiler. The Decompiler now always prints the full precision of floating-point values, using the minimal number of characters in either fixed point or scientific notation. (GP-241, Issue #778)

Decompiler. The Decompiler's Auto Create Structure command now incorporates into new structures data-type information from function prototypes. The Auto Fill in Structure variant of the command will override undefined and other more general data-types with discovered data-types if they are more specific. (GP-242)

Demangler. Modified Microsoft Demangler (MDMang) to handle symbols represented by MD5 hash codes when their normal mangled length exceeds 4096. (GT-3409, Issue #1344)

Demangler. Upgraded the GNU Demangler to version 2.33.1. Added support for the now-deprecated GNU Demangler version 2.24 to be used as a fallback option for demangling. (GT-3481, Issue #1195, #1308, #1451, #1454)

Demangler. The Demangler now more carefully applies information if generic changes have been made. Previously if the function signature had changed in any way from default, the demangler would not attempt to apply any information including the function name. (GP-12)

Demangler. Changed MDMang so cast operator names are complete within the qualified function name, effecting what is available from internal API. (GP-13)

Demangler. Added additional MDMang Extended Types such as char8_t, char16_t, and char32_t. (GP-14)

Documentation. Removed Eclipse BuildShip instructions from the DevGuide. (GT-3634, Issue #1735)

FID. Regenerated FunctionID databases. Added support for Visual Studio versions 2017 and 2019. (GP-170)

Function Diff. Users may now add functions ad-hoc to existing function comparison panels. (GT-2229)

Function Graph. Added Navigation History Tool option for Function Graph to signal it to produce fewer navigation history entries. (GT-3233, Issue #1115)

GUI. Users can now view the Function Tag window to see all functions associated with a tag, without having to inspect the Listing. (GT-3054)

GUI. Updated the Copy Special action to work on the current address when there is no selection. (GT-3155, Issue #1000)

GUI. Significantly improved the performance of filtering trees in the Ghidra GUI. (GT-3225)

GUI. Added many optimizations to increase the speed of table sorting and filtering. (GT-3226, Issue #500)

GUI. Improved performance of bit view component recently introduced to Structure Editor. (GT-3244, Issue #1141)

GUI. Updated usage of timestamps in the UI to be consistent. (GT-3286)

GUI. Added tool actions for navigating to the next/previous functions in the navigation history. (GT-3291, Issue #475)

GUI. Filtering now works on all tables in the Function Tag window. (GT-3329)

GUI. Updated the Ghidra File Chooser so that users can type text into the list and table views in order to quickly jump to a desired file. (GT-3396)

GUI. Improved the performance of the Defined Strings table. (GT-3414, Issue #1259)

GUI. Updated Ghidra to allow users to set a key binding to perform an equivalent operation to double-clicking the XREF field in the Listing. See the Show Xrefs action in the Tool Options... Key Bindings section. (GT-3446)

GUI. Improved mouse wheel scrolling in Listing and Byte Viewers. (GT-3473)

GUI. Ghidra's action context mechanism was changed so that actions that modify the program are not accidentally invoked in the wrong context, thus possibly modifying the program in ways the user did not want or without the user knowing that it happened. This also fixed an issue where the navigation history drop-down menu did not represent the locations that would be used if the next/previous buttons were pressed. (GT-3485)

GUI. Updated Ghidra tables to defer updating while analysis is running. (GT-3604)

GUI. Updated Font Size options to allow the user to set any font size. (GT-3606, Issue #160, #1541)

GUI. Added ability to overlay text on an icon. (GP-41)

GUI. Updated Ghidra options to allow users to clear default key binding values. (GP-61, Issue #1681)

GUI. ToggleDirectionAction button now shows in snapshot windows. (GP-93)

GUI. Added a new action to the Symbol Tree to allow users to convert a Namespace to a Class. (GP-225, Issue #2301)

Importer. Updated the XML Loader to parse symbol names for namespaces. (GT-3293)

Importer:ELF. Added support for processing Android packed ELF Relocation Tables. (GT-3320, Issue #1192)

Importer:ELF. Added ELF import opinion for ARM BE8. (GT-3642, Issue #1187)

Importer:ELF. Added support for ELF RELR relocations, such as those produced for Android. (GP-348)

Importer:MachO. DYLD Loader can now load x86_64 DYLD from macOS. (GT-3611, Issue #1566)

Importer:PE. Improved parsing of Microsoft ordinal map files produced with DUMPBIN /EXPORTS (see Ghidra/Features/Base/data/symbols/README.txt). (GT-3235)

Jython. Upgraded Jython to version 2.7.2. (GP-109)

Listing. In the PCode field of the Listing, accesses of varnodes in the unique space are now always shown with the size of the access. Fixed bug which would cause the PCode emulator to reject valid pcode in rare instances. (GP-196)

Listing:Data. Improved handling and display of character sequences embedded in operands or integer values. (GT-3347, Issue #1241)

Multi-User:Ghidra Server. Added ability to specify initial Ghidra Server user password (-a0 mode only) for the svrAdmin add and reset commands. (GT-3640, Issue #321)

Processors. Updated AVR8 ATmega256 processor model to reflect correct memory layout specification. (GT-933)

Processors. Implemented semantics for vstmia/db vldmia/db, added missing instructions, and fixed shift value for several instructions for the ARM/Thumb NEON instruction set. (GT-2567)

Processors. Added the XMEGA variant of the AVR8 processor with general purpose registers moved to a non-memory-mapped register space. (GT-2909)

Processors. Added support for x86 SALC instruction. (GT-3367, Issue #1303)

Processors. Implemented pcode for 6502 BRK instruction. (GT-3375, Issue #1049)

Processors. Implemented x86 PTEST instruction. (GT-3380, Issue #1295)

Processors. Added missing instructions to ARM language module. (GT-3394)

Processors. Added support for RDRAND and RDSEED instructions to x86-32. (GT-3413)

Processors. Improved x86 breakpoint disassembly. (GT-3421, Issue #872)

Processors. Added manual index file for the M6809 processor. (GT-3449, Issue #1414)

Processors. Corrected issues related to retained instruction context during a language upgrade. In some rare cases this retained context could interfere with the instruction re-disassembly. This context-clearing mechanism is controlled by a new pspec property: resetContextOnUpgrade. (GT-3531)

Processors. Updated PIC24/PIC30 index file to match latest manual. Added support for dsPIC33C. (GT-3562)

Processors. Added missing call-fixup to handle call side-effects for 32 bit gcc programs for get_pc_thunk.ax/si. (GP-10)

Processors. Added ExitProcess to PEFunctionsThatDoNotReturn. (GP-35)

Processors. External Disassembly field in the Listing now shows Thumb disassembly when appropriate TMode context has been established on a memory location. (GP-49)

Processors. Changed RISC-V jump instructions to the more appropriate goto instead of call. (GP-54, Issue #2120)

Processors. Updated AARCH64 to v8.5, including new MTE instructions. (GP-124)

Processors. Added support for floating point params and return for SH4 processor calling conventions. (GP-183, Issue #2218)

Processors. Added semantic support for many AARCH64 neon instructions. Addresses for register lanes are now precalculated, reducing the amount of p-code generated. (GP-343)

Processors. Updated RISCV processor to include reorganization, new instructions, and fixes to several instructions. (GP-358, Issue #2333)

Program API. Improved multi-threaded ProgramDB access performance. (GT-3262)

Scripting. Improved ImportSymbolScript.py to import functions in addition to generic labels. (GT-3249, Issue #946)

Scripting. Python scripts can now call protected methods from the GhidraScript API. (GT-3334, Issue #1250)

Scripting. Updated scripting feature with better change detection, external jar dependencies, and modularity. (GP-4)

Scripting. Updated the GhidraDev plugin (v2.1.1) to support Python Debugging when PyDev is installed via the Eclipse dropins directory. (GP-186, Issue #1922)

Sleigh. Error messages produced by the SLEIGH compiler have been reformatted to be more consistent in layout as well as more descriptive and more consistent in providing line number information. (GT-3174)

Bugs


Analysis. Function start patterns found at 0x0, function signatures applied from the Data Type Manager at 0x0, and DWARF debug symbols applied at 0x0 will no longer cause stack traces. In addition, DWARF symbols with zero length address range no longer stack trace. (GT-2817, Issue #386, #1560)

Analysis. Constant propagation will treat an OR with zero (0) as a simple copy. (GT-3548, Issue #1531)

Analysis. Corrected Create Structure from Selection, which failed to use proper data organization during the construction process. This could result in improperly sized components such as pointers and primitive types. (GT-3587)

Analysis. Fixed an issue where stored context is initializing the set of registers constantly. (GP-25)

Analysis. Fixed an RTTI Analyzer regression when analyzing RTTI0 structures with no RTTI4 references to them. (GP-62, Issue #2153)

Analysis. Fixed an issue where the RTTI analyzer was not filling out RTTI3 structures in some cases. (GP-111)

API. Fixed NullPointerException when attempting to delete all bookmarks from a script. (GT-3405)

API. Updated the Class Searcher so that Extension Points found in the Ghidra/patch directory get loaded. (GT-3547, Issue #1515)

Build. Updated dependency fetch script to use HTTPS when downloading CDT. (GP-69, Issue #2173)

Build. Fixed resource leak in Ghidra jar builder. (GP-342)

Byte Viewer. Fixed Byte Viewer to correctly load the middle-mouse highlight color options change. (GT-3471, Issue #1464, #1465)

Data Types. Fixed decoding of static strings that have a character set with a smaller character size than the platform's character size. (GT-3333, Issue #1255)

Data Types. Correctly handle Java character sets that do not support the encoding operation. (GT-3407, Issue #1358)

Data Types. Fixed bug that caused Data Type Manager Editor key bindings to get deleted. (GT-3411, Issue #1355)

Data Types. Updated the DataTypeParser to handle data type names containing templates. (GT-3493, Issue #1417)

Data Types. Corrected pointer data type isEquivalent() method to properly check the equivalence of the base data type. The old implementation could cause a pointer to be replaced by a conflicting pointer with the same name whose base datatype is not equivalent. This change has a negative performance impact associated with it and can cause additional conflict datatypes due to the rigid datatype relationships. (GT-3557)

Data Types. Improved composite conflict resolution performance and corrected composite merge issues when composite bitfields and/or flexible arrays are present. (GT-3571)

Data Types. Fixed bug in SymbolPathParser naive parse method that caused a less-than-adequate fall-back parse when angle bracket immediately followed the namespace delimiter. (GT-3620)

Data Types. Corrected size of long for AARCH64 per LP64 standard. (GP-175)

Decompiler. Fixed bug causing the Decompiler to miss symbol references when they are stored to the heap. (GT-3267)

Decompiler. Fixed bug in the Decompiler that caused Deleting op with descendants exception. (GT-3506)

Decompiler. Decompiler now correctly compensates for integer promotion on shift, division, and remainder operations. (GT-3572)

Decompiler. Fixed handling of 64-bit implementations of alloca_probe in the Decompiler. (GT-3576)

Decompiler. Default Decompiler options now minimize the risk of losing code when renaming or retyping variables. (GT-3577)

Decompiler. The Decompiler no longer inherits a variable name from a subfunction if that variable incorporates additional data-flow unrelated to the subfunction. (GT-3580)

Decompiler. Fixed the Decompiler Override Signature action to be enabled on the entire C-code statement. (GT-3636, Issue #1589)

Decompiler. Fixed frequent ClassCast and IllegalArgument exceptions when performing Auto Create Structure or Auto Create Class actions in the Decompiler. (GP-119)

Decompiler. Fixed a bug in the Decompiler that caused different variables to be assigned the same name in rare instances. (GP-243, Issue #1995)

Decompiler. Fixed a bug in the Decompiler that caused PTRSUB off of non-pointer type exceptions. (GP-244, Issue #1826)

Decompiler. Fixed a bug in the Decompiler that caused load operations from volatile memory to be removed as dead code. (GP-245, Issue #393, #1832)

Decompiler. Fixed a bug causing the Decompiler to miss a stack alias if its offset was, itself, stored on the stack. (GP-246)

Decompiler. Fixed a bug causing the Decompiler to lose Equate references to constants passed to functions that were called indirectly. (GP-247)

Decompiler. Addressed various situations where the Decompiler unexpectedly removes active instructions as dead code after renaming or retyping a stack location. If the location was really an array element or structure field, renaming forced the Decompiler to treat the location as a distinct variable. Subsequently, the Decompiler thought that indirect references based before the location could not alias any following stack locations, which could then by considered dead. As of the 9.2 release, the Decompiler's renaming action no longer switches an annotation to forcing if it wasn't already. A retyping action, although it is forcing, won't trigger alias blocking for atomic data-types (this is configurable). (GP-248, Issue #524, #873)

Decompiler. Fixed decompiler memory issues reported by a community security researcher. (GP-267)

Decompiler. Fix for Decompiler error: Pcode: XML comms: Missing symref attribute in <high> tag. (GP-352, Issue #2360)

Decompiler. Fixed bug preventing the Decompiler from seeing Equates attached to compare instructions. (GP-369, Issue #2386)

Demangler. Fixed the GnuDemangler to parse the full namespace for operator symbols. (GT-3474, Issue #1441, #1448)

Demangler. Fixed numerous GNU Demangler parsing issues. Most notable is the added support for C++ Lambda functions. (GT-3545, Issue #1457, #1569)

Demangler. Updated the GNU Demangler to correctly parse and apply C++ strings using the unnamed type syntax. (GT-3645)

Demangler. Fixed duplicate namespace entry returned from getNamespaceString() on DemangledVariable. (GT-3646, Issue #1729)

Demangler. Fixed a GnuDemangler ClassCastException when parsing a typeinfo string containing operator text. (GP-160, Issue #1870, #2267)

Demangler. Added stdlib.h include to the GNU Demangler to fix a build issue on some systems. (GP-187, Issue #2294)

DWARF. Corrected DWARF relocation handling where the address image base adjustment was factored in twice. (GT-3330)

File Formats. Fixed a potential divide-by-zero exception in the EXT4 file system. (GT-3400, Issue #1342)

File Formats. Fixed date and time parsing of dates in cdrom iso9660 image files. (GT-3451, Issue #1403)

Graphing. Fixed a ClassCastException sometimes encountered when performing Select -> Scoped Flow -> Forward Scoped Flow. (GP-180)

GUI. Fixed inconsistent behavior with the interactive python interpreter's key bindings. (GT-3282)

GUI. Fixed Structure Editor bug that prevented the F2 Edit action from editing the correct table cell after using the arrow keys. (GT-3308, Issue #703)

GUI. Updated the Structure Editor so the Delete action is put into a background task to prevent the UI from locking. (GT-3352)

GUI. Fixed IndexOutOfBoundsException when invoking column filter on Key Bindings table. (GT-3445)

GUI. Fixed the analysis log dialog to not consume all available screen space. (GT-3610)

GUI. Fixed issue where Location column, when used in the column filters, resulted in extraneous dialogs popping up. (GT-3623)

GUI. Fixed Data Type Preview copy action so that newlines are preserved; updated table export to CSV to escape quotes and commas. (GT-3624)

GUI. Fixed tables in Ghidra to copy the text that is rendered. Some tables mistakenly copied the wrong value, such as the Functions Table's Function Signature Column. (GT-3629, Issue #1628)

GUI. Structure editor name now updates in title bar and tab when structure is renamed. (GP-19)

GUI. Fixed an issue where drag-and-drop import locks the Windows File Explorer source window until the import dialog is closed by the user. (GP-27)

GUI. Fixed an issue in GTreeModel where fireNodeChanged had no effect. This could result in stale node information and truncation of the text associated with a node in a GTree. (GP-30)

GUI. Fixed an issue where the file chooser directory list truncated filenames with ellipses on HiDPI Windows. (GP-31)

GUI. Fixed an uncaught exception when double-clicking on UndefinedFunction_ in Decompiler window. (GP-40)

GUI. Updated error handling to only show one dialog when a flurry of errors is encountered. (GP-65, Issue #2185)

GUI. Fixed an issue where Docking Windows are restored incorrectly if a snapshot is present. (GP-92)

GUI. Fixed a File Chooser bug causing a NullPointerException for some users. (GP-171, Issue #1706)

GUI. Fixed an issue that caused the script progress bar to appear intermittently. (GP-179, Issue #1819)

GUI. Fixed a bug that caused Call Tree nodes to go missing when showing more than one function with the same name. (GP-213, Issue #1682)

GUI:Project Window. Fixed Front End copy action to allow for the copy of program names so that users can paste those names into external applications. (GT-3403, Issue #1257)

Headless. Headless Ghidra now properly honors the -processor flag, even if the specified processor is not a valid opinion. (GT-3376, Issue #1311)

Importer. Corrected an NeLoader flags parsing error. (GT-3381, Issue #1312)

Importer. Fixed the File -> Add to Program... action to not show a memory conflict error when the user is creating an overlay. (GT-3491, Issue #1376)

Importer. Updated the XML Importer to apply repeatable comments. (GT-3492, Issue #1423)

Importer. Fixed issue in Batch Import where only one item of a selection was removed when attempting to remove a selection of items. (GP-138)

Importer. Corrected various issues with processing crushed PNG images. (GP-146, Issue #1854, #1874, #1875, #2252)

Importer. Fixed RuntimeException occurrence when trying to load NE programs with unknown resources. (GP-182, Issue #1596, #1713, #2012)

Importer. Fixed batch import to handle IllegalArgumentExceptions thrown by loaders. (GP-227, Issue #2328)

Importer:ELF. Corrected ELF relocation processing for ARM BE8 (mixed-endian). (GT-3527, Issue #1494)

Importer:ELF. Corrected ELF relocation processing for R_ARM_PC24 (Type: 1) that was causing improper flow in ARM disassembly. (GT-3654)

Importer:ELF. Corrected ELF import processing of DT_JMPREL relocations and markup of associated PLT entries. (GP-252, Issue #2334)

Importer:PE. Fixed an IndexOutOfBoundsException in the PeLoader that occurred when the size of a section extends past the end of the file. (GT-3433, Issue #1371)

Listing:Comments. Fixed bug in Comment field that prevented navigation when clicking on an address or symbol where tabs were present in the comment. (GT-3440)

Memory. Fixed bug where sometimes random bytes are inserted instead of 0x00 when expanding a memory block. (GT-3465)

Processors. Corrected the offset in SuperH instructions generated by sign-extending a 20-bit immediate value composed of two sub-fields. (GT-3251, Issue #1161)

Processors. Fixed AVR8 addition/subtraction flag macros. (GT-3276)

Processors. Corrected XGATE ROR instruction semantics. (GT-3278)

Processors. Corrected semantics for SuperH movi20 and movi20s instructions. (GT-3337, Issue #1264)

Processors. Corrected SuperH floating point instruction token definition. (GT-3340, Issue #1265)

Processors. Corrected SuperH movu.b and movu.w instruction semantics. (GT-3345, Issue #1271)

Processors. Corrected AVR8 lpm and elpm instruction semantics. (GT-3346, Issue #631)

Processors. Corrected pcode for the 6805 BSET instruction. (GT-3366, Issue #1307)

Processors. Corrected ARM constructors for instructions vnmla, vnmls, and vnmul. (GT-3368, Issue #1277)

Processors. Corrected bit-pattern for ARM vcvt instruction. (GT-3369, Issue #1278)

Processors. Corrected TriCore abs instructions. (GT-3379, Issue #1286)

Processors. Corrected x86 BT instruction semantics. (GT-3423, Issue #1370)

Processors. Fixed issue where CRC16C LOAD/STOR with abs20 were not mapped correctly. (GT-3529, Issue #1518)

Processors. Fixed M68000 MOVE USP,x and MOVE x,USP opcodes. (GT-3594, Issue #1593)

Processors. Fixed the ARM/Thumb TEQ instruction pcode to be an XOR. (GP-23, Issue #1802)

Processors. Emulation was broken by a regression in version 9.1.2. Emulation and Sleigh Pcodetests now work correctly. (GP-24, Issue #1579)

Processors. Fixed carry flag issue for 6502 CMP, CPX, and CPY instructions. (GP-34)

Processors. Corrected the SuperH high-order bit calculation for the rotr instruction. (GP-47)

Processors. Corrected ELF ARM relocation processing for type 3 (R_ARM_REL32) and added support for type 42 (R_ARM_PREL31). (GP-164, Issue #2261, #2276)

Scripting. Moved Jython cache directory out of tmp. (GP-36)

Scripting. Fixed a NoClassDefFoundError when compiling GhidraScript under JDK14. (GP-59, Issue #2152)

Scripting. Fixed issues with null result when searching for the script directory. (GP-103, Issue #2187)

Scripting. Fixed scripting issue where, if there were non-ASCII characters in the user path, Jython would not work. (GP-204, Issue #1890)

Sleigh. Corrected IndexOutOfBoundsException in SLEIGH when doing simple assignment in disassembly actions block. (GT-3382, Issue #745)

Symbol Tree. Fixed the Symbol Tree so that clicking an already-selected symbol node will still trigger a Listing navigation. (GT-3436, Issue #453)

Symbol Tree. Fixed the Symbol Tree to not continuously rebuild while performing Auto-analysis. (GT-3542)

Version Tracking. Fixed Version Tracking Create Manual Match action. (GT-3305, Issue #2215)

Version Tracking. Fixed a NullPointerException encountered when changing the Version Tracking options for the Listing Code Comparison when no data was loaded. (GT-3437, Issue #1143)

Version Tracking. Fixed Version Tracking exception triggered in the Exact Functions Instructions Match correlator encountered when the two functions being compared differed in their number of instructions. (GT-3438, Issue #1352)


https://ghidra-sre.org/ghidra_9.2_PUBLIC_20201113.zip


2020-11-14 16:44
0
雪    币: 3017
活跃值: (27722)
能力值: (RANK:420 )
在线值:
发帖
回帖
粉丝
17
Ghidra 9.2 released!
国内网盘:
链接: https://pan.baidu.com/s/18mJExCNvLSauxEqG-SkCwg 提取码: xdca 复制这段内容后打开百度网盘手机App,操作更方便哦
2020-11-14 17:14
0
雪    币: 97697
活跃值: (200824)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
18
梦幻的彼岸 Ghidra 9.2 released! 国内网盘: 链接: https://pan.baidu.com/s/18mJExCNvLSauxEqG-SkCwg 提取码: xdca 复制这段内容后打开 ...
2020-11-14 17:30
0
雪    币: 97697
活跃值: (200824)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
19

BinDiffHelper

Ghidra extension that uses BinDiff on your Ghidra project to find matching functions and rename them automatically (BinDiff 6 supported). Check out the BinDiff manual to see how it works and how it matches functions / basic blocks. However, with this extension, BinDiff is automated from within Ghidra, so you don't have to diff your binaries yourself.


How to Install

Either download the .zip-File from the release, if it's compatible to your Ghidra version, otherwise see How to build below.

Open Ghidra, go to File->Install Extensions... in the Main Window. Click the +-Button in the top right and select the BinDiffHelper zip file.

Close the plugin manager. Restart Ghidra to load the new plugin.


https://github.com/ubfx/BinDiffHelper


2020-11-19 02:44
0
雪    币: 62
能力值: ( LV1,RANK:0 )
在线值:
发帖
回帖
粉丝
20
这个软件感觉不亚于IDA无奈自己英语太差,网上的教程又少只能先学习使用IDA。。。
2020-11-19 11:58
0
雪    币: 97697
活跃值: (200824)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
21
郑南城 这个软件感觉不亚于IDA无奈自己英语太差,网上的教程又少只能先学习使用IDA。。。

你是在国内吗?你用用百度。真的不知道怎么回答你的问题。

最后于 2020-11-19 12:24 被linhanshi编辑 ,原因:
2020-11-19 12:23
0
雪    币: 150
活跃值: (43)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
22
感谢分享啊 
2020-11-25 15:42
0
雪    币: 97697
活跃值: (200824)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
23

Ghidra 9.2.1 has been released!

http://ghidra-sre.org/

https://ghidra-sre.org/ghidra_9.2.1_PUBLIC_20201215.zip

Change Log

Ghidra v9.2.1 (December 2020)

Improvements


Analysis. Updated RTTI analyzer to find type_info vftable when it cannot be found with its mangled name. This will enable many more Windows programs to have their RTTI structures created that were unable to be parsed in previous Ghidra versions. (GP-141)

API. Relaxed memory block naming restrictions and restored ability to have spaces in memory block names. However, if a memory block is flagged as an overlay, the associated overlay space name may be modified to ensure validity and uniqueness. The DuplicateNameException has been removed from all memory block API methods since this was entirely an overlay space concern. Memory block GUI has also been changed eliminate the duplicate block name restriction. (GP-420, Issue #2465)

Build. Eliminated the need for installation of bison and flex when performing source-based gradle build of Ghidra or the Decompiler module. The generated files are now included with source files and maintained in source control. A separate gradle Decompiler:generateParsers task, which still requires bison and flex, must be used, explicitly, when changes are made to lex/yacc source files. (GP-467)

Graphing. Improved graphing where it did not navigate when clicking on external function nodes. Now it will navigate to the fake function location in the program, which is the location of the pointer to the external function. (GP-493)

Listing:Symbols. Removed restriction for naming labels that resemble default label names. (GT-3185, Issue #1057)

PDB. Crafted PDB type ID records 0x1608 and 0x1609 with presumed class and struct types and follow-on application of these types. Also fixed up some fall-back data type logic and improved some warning messages to reflect the cause of the conditions. (GP-474, Issue #2523)

Scripting. Removed unnecessary 1-second delay when launching a script. (GP-443)

Bugs


Analysis. Fixed the processing of CIL metadata that express arrays of non-primitive types. (GP-331)

API. WrappedMemBuffer methods getInt, getShort, getLong, and getBigInteger have been fixed when allocated at a non-zero offset, wrapping another MemBuffer such as DumbMemBufferImpl. (GP-486)

Decompiler. Fixed issue with the Auto Create/Fill Structure command that caused it to silently miss some pointer accesses. (GP-344)

Decompiler. Jump table recovery now takes into account encoded bits, like ARM/THUMB mode transition, that may be present in address tables. (GP-387, Issue #2420)

Decompiler. Fixed a bug in the Decompiler renaming action when applied to function references. (GP-477, Issue #2415)

Decompiler. Corrected 8-byte return value storage specification in compiler-spec affecting longlong and double return values. Endianess ordering of r0/r1 was incorrect. (GP-512, Issue #2547)

Graphing. Fixed the Function Graph's drag-to-select-nodes feature. (GP-430)

Graphing. Fixed issue where the graph in the satellite view is sometimes truncated. (GP-469)

Graphing. Fixed a stack trace issue caused by reusing a graph display window to show a graph that is larger than is allowed. (GP-492)

Graphing. Fixed issue where graph satellite view did not reflect main graph when graph vertices are hidden using hide actions or filters. (GP-514)

GUI. Fixed stack overflow in TableChooserDialogs. (GP-460, Issue #2536)

PDB. Corrected PDB parser selection bug affecting PDB load/download on Windows. (GP-390)

Processors. Fixed handling of certain ARM/THUMB switch calculation functions. (GP-389)


最后于 2020-12-22 08:29 被linhanshi编辑 ,原因:
2020-12-22 07:49
0
雪    币: 97697
活跃值: (200824)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
24

https://pan.baidu.com/s/1C9JYsPq0xvF5pGW8yefeaw 

pass:e57x 


2020-12-22 08:20
0
游客
登录 | 注册 方可回帖
返回
//