ghidra
https://github.com/nationalsecurityagency/ghidra
Java
Ghidra is a software reverse engineering (SRE) framework
Triage Issues!
When you volunteer to triage issues, you'll receive an email each day with a link to an open issue that needs help in this project. You'll also receive instructions on how to triage issues.
Triage Docs!
Receive a documented method or class from your favorite GitHub repos in your inbox every day. If you're really pro, receive undocumented methods or classes and supercharge your commit history.
Java not yet supported30 Subscribers
Add a CodeTriage badge to ghidra
Help out
- Issues
- Decompiler: a right shift by 64 or more of a 16-byte value marks its input as not consumed, so dead-code removal replaces live loads and addresses with 0 (AltiVec `lvebx`/`lvlx` + `vspltw`)
- X86 16bit segment register override
- Decompiler: in a chain of virtual calls (`a->get()->foo(x)`), the `this` argument of the later call is dropped ("Exceeded maximum restarts with more pending")
- "Apply Function Data Types" gives every overload of a function the signature of the first one (overloads stored as `name.conflict` get past the duplicate check)
- PowerPC 64-32addr: `ppc_64_32.cspec` doesn't list r2 (TOC), f14-f31 and cr2/cr3 as unaffected, so TOC-relative globals stop resolving after the first call
- PowerPC 64-32addr: `ppc_64_32.cspec` only models the 32-bit SysV parameter layout; 64-bit ELF ABI code with 32-bit pointers (PS3 Cell OS LV2) gets wrong parameter storage after a floating argument and for stack arguments
- PowerPC 64-32addr: one 64-bit use of r1 (e.g. the debug break `tw 31,r1,r1`) makes the decompiler lose the whole stack frame of the function
- PowerPC AltiVec: record-form vector compares (`vcmpequw.`, `vcmpgtfp.`, ...) don't write CR6, so `vec_all_*`/`vec_any_*` branches test an uninitialized `in_cr6`
- PowerPC64: out-of-line register save/restore routines (`_savegpr0_N`, `_restgpr0_N`, `_savefpr_N`, `_restfpr_N`, ...) are decompiled as real calls; suggest a callfixup
- PowerPC64: the `uponreturn` inject in `ppc_64_be.cspec`/`ppc_64_le.cspec` stores r2 to 0x28(r1), the ELFv1 TOC save slot; on ELFv2 (0x18) it overwrites a real stack slot
- Docs
- Java not yet supported