question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Bitfield support in decompiler

See original GitHub issue

Is your feature request related to a problem? Please describe. Right now the decompiler shows bitfield access simply as shift and mask (in other words, it is unaware of bitfields).

For example, consider:

  • a big-endian bitfield that is a byte long, and
  • a member 3 bits long starting at the 2nd bit.

A member read might look like bitfield >> 3 & 0x7, and a member write like bitfield = (bitfield & 0xc7) | (member << 3 & 0x38). This makes understanding decompiler output difficult.

The data type manager allows the declaration of bitfields only by importing them through the “Parse C Source” menu item (great if you have a header file for your platform), however the decompiler does not make use of this information.

Describe the solution you’d like

  • Ability to declare bitfields in the data type manager
  • Control over implementation-specific details like member allocation order
  • Decompiler recognizes data/variables typed as a bitfield + shift-and-mask pcode matching defined offsets and lengths as a bitfield member access, and shows the member access instead of the shift and mask

The above example would then look like var1 = bitfield.member and bitfield.member = var1 for the read and write cases.

Describe alternatives you’ve considered No real alternative besides the current situation of consulting datasheets and my own notes for bitfield layout.

  • Bitfield layout will depend on architecture and endianness
  • There is no definitive way for a function to access a bitfield member. It could shift first then mask, or mask then shift. Recognizing member access, even by pcode, might not be trivial.

Additional context This is mainly for embedded systems that pack many short parameters into registers.

Issue Analytics

  • State:open
  • Created 4 years ago
  • Reactions:16
  • Comments:16 (1 by maintainers)

github_iconTop GitHub Comments

5reactions
ghidra1commented, Jul 18, 2019

The ability to represent bitfields within Structures has just been added to the master branch . Support for bitfields has been added to the CParser, PDB parser and DWARF. The PDB XML file format has changed for bitfields - any retained PDB XML files will need to be regenerated to benefit from the bitfield improvements (bitfield bit-offset information was missing from XML). Note that “aligned” bitfield packing support is currently to msb filled first for big-endian and lsb filled-first for little-endian data. These bitfield component definitions are currently not conveyed to the decompiler and there is currently no bitfield reference mechanism. Structure Data instances in memory will reflect bitfield data. See Structure Editor help content for some additional information.

2reactions
dkatzdevcommented, Jun 6, 2019

This is something I’d really like to see implemented, both in the decompiler and just in the disassembly list view. I feel like a lot of good additions could be done to the enumerations feature. In addition to this, the ability to specify values within bitmasks within the enum would be great. Systems that use their own flag registers may group multiple independent sets into a single register each with a different mask.

Separating enumerations from the overall “data types” in some way would make navigating them easier as well.

Read more comments on GitHub >

github_iconTop Results From Across the Web

decompilation - How to make Ghidra recognize bit fields?
Looks like full bitfield support for the decompiler is slated for a future release according to a comment on Ghidra's github issues: ...
Read more >
IDA/HexRays and bitfields... - Exetools
You can add a struct with bitfields to the Local Types list (Shift-F1, Ins) but they are not currently supported by the decompiler...
Read more >
How does Arm Compiler 6 access bit-fields and volatile bit ...
Creates a boundary between any bit-fields before the zero-length bit-field and any bit-fields after the zero-length bit-field. Any bit-fields on opposite sides ...
Read more >
How does C compiler handle bit-field? - Stack Overflow
The following bit field sample code is from here. It claims better storage efficiency. But I am wondering how the compiler handles the...
Read more >
Bit Fields Tutorial - Hex Rays
We have a disassembly like this: Let's improve it by using bitfields. We first define a bitfield type by opening an enumeration window...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found