Usage: pdg # Native Ghidra decompiler plugin
| pdg # Decompile current function with the Ghidra decompiler
| pdgd # Dump the debug XML Dump
| pdgx # Dump the XML of the current decompiled function
| pdgj # Dump the current decompiled function as JSON
| pdgo # Decompile current function side by side with offsets
| pdgs # Display loaded Sleigh Languages
| pdg* # Decompiled code is returned to r2 as comment
以下配置变量(用于e命令)可用于调整r2ghidra的行为:
r2ghidra.cmt.cpp: C++ comment style
r2ghidra.cmt.indent: Comment indent
r2ghidra.indent: Indent increment
r2ghidra.lang: Custom Sleigh ID to override auto-detection (e.g. x86:LE:32:default)
r2ghidra.linelen: Max line length
r2ghidra.nl.brace: Newline before opening '{'
r2ghidra.nl.else: Newline before else
r2ghidra.sleighhome: SLEIGHHOME
要同时构建Cutter插件,请将-DBUILD_CUTTER_PLUGIN = ON -DCUTTER_SOURCE_DIR = / path / to / cutter / source传递给cmake,例如:
/my/path> git clone 82aK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6J5j5h3c8S2M7X3g2G2M7X3N6Q4x3V1k6U0N6i4c8@1k6i4t1`.
/my/path> # build Cutter, clone r2ghidra-dec, etc.
...
/my/path/r2ghidra-dec> mkdir build && cd build
/my/path/r2ghidra-dec/build> cmake -DBUILD_CUTTER_PLUGIN=ON -DCUTTER_SOURCE_DIR=/my/path/cutter -DCMAKE_INSTALL_PREFIX=~/.local ..
/my/path/r2ghidra-dec/build> make && make install
License
Please note that this plugin is available under the LGPLv3, which is more strict than Ghidra's license!
This program is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
An Abstract Interpretation-Based Deobfuscation _a90K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2E0M7%4u0W2N6X3g2J5M7$3g2W2L8X3N6A6L8X3g2W2M7X3W2F1k6#2)9J5k6h3y4G2L8g2)9J5c8X3u0D9L8$3N6Q4x3V1j5J5x3o6p5&6i4K6u0r3y4q4)9J5c8U0p5%4i4K6u0r3j5h3&6Q4x3X3c8S2j5Y4y4@1M7X3q4U0N6q4)9J5k6r3W2F1N6r3g2J5M7s2u0W2N6r3q4@1K9h3!0F1i4K6u0V1j5X3q4K6k6h3c8Q4x3X3c8V1k6h3!0T1k6Y4g2K6j5$3q4@1K9h3!0F1i4K6u0V1M7r3I4#2k6$3W2F1i4K6u0V1k6X3!0J5i4K6u0V1k6$3S2A6k6s2u0S2
Analyzing Emotet with Ghidra — Part 1 _429K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6E0k6h3c8A6N6h3#2Q4x3X3g2U0L8$3#2Q4x3V1k6Q4y4o6l9H3P5r3b7H3j5$3j5I4x3h3g2Q4x3V1k6S2L8X3q4D9P5i4A6A6L8X3N6Q4x3X3c8W2L8h3!0@1k6i4c8Q4x3X3c8%4K9i4c8Z5i4K6u0V1k6$3S2A6k6s2u0S2i4K6u0V1M7r3q4J5N6q4)9J5k6o6q4Q4x3X3b7@1k6r3p5%4x3h3p5#2j5K6S2V1y4U0V1`. Analyzing Emotet with Ghidra — Part 2 _a2eK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6E0k6h3c8A6N6h3#2Q4x3X3g2U0L8$3#2Q4x3V1k6Q4y4o6l9H3P5r3b7H3j5$3j5I4x3h3g2Q4x3V1k6S2L8X3q4D9P5i4A6A6L8X3N6Q4x3X3c8W2L8h3!0@1k6i4c8Q4x3X3c8%4K9i4c8Z5i4K6u0V1k6$3S2A6k6s2u0S2i4K6u0V1M7r3q4J5N6q4)9J5k6o6u0Q4x3X3b7&6k6h3k6T1k6h3p5K6y4K6c8T1x3e0b7`.
Ghidra versus Ida: reverse engineering a 'crackme' _cb4K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6&6L8%4g2@1N6g2)9J5k6h3u0W2i4K6u0r3f1K6l9$3M7r3N6C8y4p5c8B7c8W2p5`.
Three Heads are Better Than One: Mastering NSA’s Ghidra Reverse Engineering Tool _b34K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1j5H3P5p5q4D9k6i4S2W2K9g2)9J5c8V1W2z5c8V1W2x3g2q4u0m8g2p5f1J5x3o6p5&6
Three Heads are Better Than One: Mastering Ghidra - Alexei Bulazel, Jeremy Blackthorne - INFILTRATE 2019 _04cK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6$3K9h3#2W2L8#2)9J5k6h3y4G2L8g2)9J5c8U0x3K6y4e0p5#2z5o6b7$3x3l9`.`.
WORKING WITH GHIDRA'S P-CODE TO IDENTIFY VULNERABLE FUNCTION CALLS _b42K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2J5K9i4k6W2M7X3I4G2L8%4m8K6k6h3y4#2M7X3W2@1P5g2)9J5k6h3y4G2L8g2)9J5c8X3u0D9L8$3N6Q4x3V1j5J5x3o6p5&6i4K6u0r3x3o6g2Q4x3V1k6H3j5$3!0V1k6g2)9J5c8R3`.`.
SVD-Loader for Ghidra Simplifying bare-metal ARM reverse engineering _cacK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6D9k6i4k6W2L8r3c8G2N6$3&6Q4x3X3c8K6k6h3y4#2M7X3W2@1P5g2)9J5c8W2y4h3c8q4)9J5k6p5I4G2j5h3c8W2M7W2)9J5k6p5N6Z5K9h3c8J5j5b7`.`.
r2ghidra-dec Deep ghidra decompiler integration for radare2 _285K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6J5j5h3c8S2M7X3g2G2M7X3N6Q4x3V1k6J5x3X3N6Z5K9h3c8J5j5g2)9J5k6r3c8W2j5H3`.`.
AUTOMATING GHIDRA: WRITING A SCRIPT TO FIND BANNED FUNCTIONS _007K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2$3k6r3q4D9j5h3u0K6i4K6u0W2j5$3!0E0i4K6u0r3x3U0l9I4z5g2)9J5c8U0l9K6i4K6u0r3x3o6W2Q4x3V1k6S2N6i4c8G2L8h3q4@1K9h3&6Y4i4K6u0V1k6$3S2A6k6s2u0S2i4K6u0V1N6%4u0A6N6r3W2F1k6#2)9J5k6r3q4Q4x3X3c8K6j5%4u0A6M7s2c8Q4x3X3c8@1L8#2)9J5k6r3k6A6L8X3c8Q4x3X3c8T1j5h3&6F1k6h3c8Q4x3X3c8X3N6h3&6U0N6r3W2G2L8Y4y4Q4x3V1j5`.
GhidraX64Dbg Extension containing a Ghidra script to export annotations from Ghidra to an X32/X64 database. _84aK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6J5k6i4k6G2L8s2k6W2M7W2)9J5k6r3!0U0k6h3I4G2N6q4)9J5k6s2y4S2j5g2)9J5c8V1N6Z5K9h3c8J5j5g2R3$3y4p5c8T1k6H3`.`.
.gdt files are data type archives. They contain data type to symbol correlation data. When applied to e.g. imported functions, the functions will be assigned the correct signatures via these files. _a05K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1j5H3P5o6k6V1y4U0V1$3x3K6j5^5i4K6u0r3k6$3S2A6k6s2u0S2i4K6u0V1k6r3q4@1j5g2)9J5c8Y4c8J5k6h3g2Q4x3V1k6E0j5i4y4@1k6i4u0Q4x3V1k6@1P5i4m8W2K9h3&6X3L8H3`.`.