diff --git a/disassemblers/ofrak_pyghidra/src/ofrak_pyghidra/components/pyghidra_components.py b/disassemblers/ofrak_pyghidra/src/ofrak_pyghidra/components/pyghidra_components.py index 83ebe1611..d876b26c2 100644 --- a/disassemblers/ofrak_pyghidra/src/ofrak_pyghidra/components/pyghidra_components.py +++ b/disassemblers/ofrak_pyghidra/src/ofrak_pyghidra/components/pyghidra_components.py @@ -33,7 +33,6 @@ from ofrak_pyghidra.standalone.pyghidra_analysis import unpack, decompile_all_functions from ofrak_type.error import NotFoundError - _GHIDRA_AUTO_LOADABLE_FORMATS = [Elf, Ihex, Pe] @@ -318,7 +317,13 @@ async def analyze(self, resource: Resource, config=None): analysis = self.analysis_store.get_analysis(program_r.get_id()) if "decompilation" not in analysis[cb_key]: program_file = analysis["metadata"]["path"] - for cb_key, decomp in decompile_all_functions(program_file, None).items(): + language = analysis["metadata"]["language"] + base_addr = None + if "base_address" in analysis["metadata"]: + base_addr = analysis["metadata"]["base_address"] + for cb_key, decomp in decompile_all_functions( + program_file, language, base_addr + ).items(): analysis[cb_key]["decompilation"] = decomp self.analysis_store.store_analysis(program_r.get_id(), analysis) else: diff --git a/disassemblers/ofrak_pyghidra/src/ofrak_pyghidra/standalone/pyghidra_analysis.py b/disassemblers/ofrak_pyghidra/src/ofrak_pyghidra/standalone/pyghidra_analysis.py index 1d3c428dd..edf5fc48c 100644 --- a/disassemblers/ofrak_pyghidra/src/ofrak_pyghidra/standalone/pyghidra_analysis.py +++ b/disassemblers/ofrak_pyghidra/src/ofrak_pyghidra/standalone/pyghidra_analysis.py @@ -44,19 +44,20 @@ def unpack( program_file = os.path.join(tempdir, "program") with open(program_file, "wb") as f: f.write(b"\x00") - with pyghidra.open_program(program_file, language=language) as flat_api: + with pyghidra.open_program(program_file, language=language, analyze=False) as flat_api: LOGGER.info("Analysis completed. Caching analysis to JSON") # Java packages must be imported after pyghidra.start or pyghidra.open_program from ghidra.app.decompiler import DecompInterface, DecompileOptions from ghidra.util.task import TaskMonitor from ghidra.program.model.block import BasicBlockModel from ghidra.program.model.symbol import RefType + from ghidra.base.project import GhidraProject from java.math import BigInteger from java.io import ByteArrayInputStream + program = flat_api.getCurrentProgram() # If memory_regions are provided, delete all data and create new regions: if memory_regions: - program = flat_api.getCurrentProgram() memory = program.getMemory() address_factory = program.getAddressFactory() default_space = address_factory.getDefaultAddressSpace() @@ -90,9 +91,6 @@ def unpack( logging.warning( f"Failed to create memory block at 0x{region['virtual_address']:x}: {e}" ) - # Analyze all - analysis_mgr = program.getOptions("Analyzers") - flat_api.analyzeAll(program) # If base_address is provided, rebase the program if base_address is not None: # Convert base_address to int if it's a string @@ -103,13 +101,13 @@ def unpack( base_address = int(base_address) # Rebase the program to the specified base address - program = flat_api.getCurrentProgram() address_factory = program.getAddressFactory() new_base_addr = address_factory.getDefaultAddressSpace().getAddress( hex(base_address) ) program.setImageBase(new_base_addr, True) LOGGER.info(f"Rebased program address to {hex(base_address)}") + GhidraProject.analyze(program) main_dictionary: Dict[str, Any] = {} code_regions = _unpack_program(flat_api) @@ -117,6 +115,7 @@ def unpack( main_dictionary["metadata"]["backend"] = "ghidra" main_dictionary["metadata"]["decompiled"] = decompiled main_dictionary["metadata"]["path"] = program_file + main_dictionary["metadata"]["language"] = language if base_address is not None: main_dictionary["metadata"]["base_address"] = base_address with open(program_file, "rb") as fh: @@ -475,13 +474,19 @@ def _decompile(func, decomp_interface, task_monitor): return decomp -def decompile_all_functions(program_file, language): - with pyghidra.open_program(program_file, language=language) as flat_api: +def decompile_all_functions(program_file, language, base_addr): + with pyghidra.open_program(program_file, language=language, analyze=False) as flat_api: from ghidra.app.decompiler import DecompInterface, DecompileOptions from ghidra.util.task import TaskMonitor + from ghidra.base.project import GhidraProject decomp = DecompInterface() program = flat_api.getCurrentProgram() + if base_addr is not None: + address_factory = program.getAddressFactory() + new_base_addr = address_factory.getDefaultAddressSpace().getAddress(hex(base_addr)) + program.setImageBase(new_base_addr, True) + GhidraProject.analyze(program) prog_options = DecompileOptions() prog_options.grabFromProgram(program) decomp.setOptions(prog_options)