Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,6 @@
from ofrak_pyghidra.standalone.pyghidra_analysis import unpack, decompile_all_functions
from ofrak_type.error import NotFoundError


_GHIDRA_AUTO_LOADABLE_FORMATS = [Elf, Ihex, Pe]


Expand Down Expand Up @@ -318,7 +317,13 @@ async def analyze(self, resource: Resource, config=None):
analysis = self.analysis_store.get_analysis(program_r.get_id())
if "decompilation" not in analysis[cb_key]:
program_file = analysis["metadata"]["path"]
for cb_key, decomp in decompile_all_functions(program_file, None).items():
language = analysis["metadata"]["language"]
base_addr = None
if "base_address" in analysis["metadata"]:
base_addr = analysis["metadata"]["base_address"]
for cb_key, decomp in decompile_all_functions(
program_file, language, base_addr
).items():
analysis[cb_key]["decompilation"] = decomp
self.analysis_store.store_analysis(program_r.get_id(), analysis)
else:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -44,19 +44,20 @@ def unpack(
program_file = os.path.join(tempdir, "program")
with open(program_file, "wb") as f:
f.write(b"\x00")
with pyghidra.open_program(program_file, language=language) as flat_api:
with pyghidra.open_program(program_file, language=language, analyze=False) as flat_api:
LOGGER.info("Analysis completed. Caching analysis to JSON")
# Java packages must be imported after pyghidra.start or pyghidra.open_program
from ghidra.app.decompiler import DecompInterface, DecompileOptions
from ghidra.util.task import TaskMonitor
from ghidra.program.model.block import BasicBlockModel
from ghidra.program.model.symbol import RefType
from ghidra.base.project import GhidraProject
from java.math import BigInteger
from java.io import ByteArrayInputStream

program = flat_api.getCurrentProgram()
# If memory_regions are provided, delete all data and create new regions:
if memory_regions:
program = flat_api.getCurrentProgram()
memory = program.getMemory()
address_factory = program.getAddressFactory()
default_space = address_factory.getDefaultAddressSpace()
Expand Down Expand Up @@ -90,9 +91,6 @@ def unpack(
logging.warning(
f"Failed to create memory block at 0x{region['virtual_address']:x}: {e}"
)
# Analyze all
analysis_mgr = program.getOptions("Analyzers")
flat_api.analyzeAll(program)
# If base_address is provided, rebase the program
if base_address is not None:
# Convert base_address to int if it's a string
Expand All @@ -103,20 +101,21 @@ def unpack(
base_address = int(base_address)

# Rebase the program to the specified base address
program = flat_api.getCurrentProgram()
address_factory = program.getAddressFactory()
new_base_addr = address_factory.getDefaultAddressSpace().getAddress(
hex(base_address)
)
program.setImageBase(new_base_addr, True)
LOGGER.info(f"Rebased program address to {hex(base_address)}")
GhidraProject.analyze(program)

main_dictionary: Dict[str, Any] = {}
code_regions = _unpack_program(flat_api)
main_dictionary["metadata"] = {}
main_dictionary["metadata"]["backend"] = "ghidra"
main_dictionary["metadata"]["decompiled"] = decompiled
main_dictionary["metadata"]["path"] = program_file
main_dictionary["metadata"]["language"] = language
if base_address is not None:
main_dictionary["metadata"]["base_address"] = base_address
with open(program_file, "rb") as fh:
Expand Down Expand Up @@ -475,13 +474,19 @@ def _decompile(func, decomp_interface, task_monitor):
return decomp


def decompile_all_functions(program_file, language):
with pyghidra.open_program(program_file, language=language) as flat_api:
def decompile_all_functions(program_file, language, base_addr):
with pyghidra.open_program(program_file, language=language, analyze=False) as flat_api:
from ghidra.app.decompiler import DecompInterface, DecompileOptions
from ghidra.util.task import TaskMonitor
from ghidra.base.project import GhidraProject

decomp = DecompInterface()
program = flat_api.getCurrentProgram()
if base_addr is not None:
address_factory = program.getAddressFactory()
new_base_addr = address_factory.getDefaultAddressSpace().getAddress(hex(base_addr))
program.setImageBase(new_base_addr, True)
GhidraProject.analyze(program)
prog_options = DecompileOptions()
prog_options.grabFromProgram(program)
decomp.setOptions(prog_options)
Expand Down
Loading