External references for raw binary
See original GitHub issueDescribe the bug
Functions from external programs in raw binary file dispayed in decompiler as func_0x00009190
or func_0x1
To Reproduce Steps to reproduce the behavior:
-
Load raw binary file (module of firmware), which contains calls of external functions.
-
Load additional raw binary file (shared library for modules of firmware) and set it as external program.
-
Open module of firmware in CodeBrowser and find undefined call of function
-
Add external reference for
CALL
Name of function in decompiler:
or
-
Create new block of memory (addresses of shared library).
-
Create reference in called function.
Name of function in decompiler:
-
Expected behavior Name of function in decompiler should be displayed as in external function.
Environment (please complete the following information):
- OS: Linux
- Java Version: 11.0
- Ghidra Version: 9.0
Additional context
How can I create external reference in idiomatic way for raw binaries? Adding external reference for all CALL
(JMP
and others) is a very time consuming process. Can I automate it without script?
How can I export functions (signatures too) from Exports
of shared library to Import
of module of firmware and synchronize them in future? I do it manually now: reverse engineering functions in shared library, then changing signatures in functions of Imports
in module of firmware.
Issue Analytics
- State:
- Created 5 years ago
- Reactions:2
- Comments:5 (3 by maintainers)
I developed the script in the context of the project at work (NDA). When I finish the project, I will make a PR. While you can use prototype.
As I promised, I’m publishing the script for finding external references in raw binaries. It’s far from ideal, but you can use it as example for developing more complex scripts/plugins.