Ghidra is a software reverse engineering (SRE) framework developed by NSA's Research Directorate.
This framework includes a suite of full-featured, high-end software analysis tools that enable
- users to analyze compiled code on a variety of platforms including Windows, Mac OS, and Linux.
+ users to analyze compiled code on a variety of platforms including Windows, MacOS, and Linux.
Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with
hundreds of other features. Ghidra supports a wide variety of process instruction sets and
executable formats and can be run in both user-interactive and automated modes. Users may also
@@ -40,7 +40,7 @@
Ghidra 9.1 is fully backward compatible with project data from previous releases. However, programs opened in 9.1 may no longer be accessible by an earlier Ghidra version if the processor model has been updated.
@@ -56,8 +56,8 @@ a 9.0 server. Note that all other server interaction including authentication were and continue to be performed over a secure TLS connection. -Minor Note: Ghidra compiled .sla files are not backwards compatible due to the newly added OTHER space for syscalls - support. In the pre-built ghidra all .sla files are re-built from scratch. However if you have local processor modules, +
Minor Note: Ghidra-compiled .sla files are not backwards compatible due to the newly added OTHER space for syscalls + support. In the pre-built ghidra, all .sla files are re-built from scratch. However if you have local processor modules, or are building ghidra from scratch, you may need to do a clean build. You will get an error if an old .sla file is loaded without recompilation of the .slaspec file. Any processor modules with changes are normally recompiled at Ghidra startup so this situation is rare.
@@ -65,9 +65,9 @@Bitfields within structures are now supported as a Ghidra data type. Bitfield definitions - can come from PBD, DWARF, parsed header files, and can also be created within the structure + can come from PDB, DWARF, parsed header files, and can also be created within the structure editor. All Data type archives delivered with Ghidra have been re-parsed to capture bitfield - information. In addition compiler bitfield allocation schemes have been carefully implemented. + information. In addition, compiler bitfield allocation schemes have been carefully implemented. Full support for bitfield references within the decompiler is planned for a future release.
@@ -78,8 +78,8 @@Ghidra now supports overriding indirect calls, CALLOTHER pcode ops, and conditional jumps via new overriding references. - These references can be used to achieve correct decompilation of syscall-like instructions. A new script - "ResolveX86orX64LinuxSyscalls" has been provided as part of this initial implementation. + These references can be used to achieve correct decompilation of syscall-like instructions. A new script, + ResolveX86orX64LinuxSyscallsScript, has been provided as part of this initial implementation. Future releases will automatically identify and apply system calls for other operating systems and versions.
To support system calls, the decompiler follows references into OTHER address space overlays. @@ -99,9 +99,10 @@
Imported DYLD cache images, extracted from an iOS image, are split into sub-dylib sections, greatly enhancing - follow on analysis. Internal Macho headers are retained and marked up similarly - to ELF files, which includes tracking the origin of the program bytes from the initial import binary.
+DYLD shared cache images, extracted from an iOS image, can now be imported in their entirety. + A DYLD's embedded DYLIB's are split into memory blocks, greatly enhancing follow-on analysis. + Internal Macho headers are retained and marked up similarly to ELF and PE files, which includes + tracking the origin of the program bytes from the initial import binary.
The Ghidra server now requires the client to use a TLS secure connection for the initial RMI registry port access. @@ -111,7 +112,7 @@ connect to a 9.1 server.
The Ghidra server has two additional authentication methods, Active Directory using - Kerberos and Plugable Authentication Modules(PAM) using JAAS. To utilize these new + Kerberos and Plugable Authentication Modules (PAM) using JAAS. To utilize these new methods you must configure the server.conf file and use either -a1 for windows authentication or -a4 along with -jaas. The JAAS mode will require setup of an additional configuration file (jaas.conf).
@@ -136,20 +137,20 @@In addition the decompiler now recognizes more optimization patterns used by compilers for signed division, resulting in simplified decompilation.
-AARCH64 based binary decompilation will be cleaner due to better handling of - zero extensions into larger registers which complicated data flow analysis. This - change affects floating point Neon instructions.
+AARCH64-based binary decompilation will be cleaner due to better handling of + zero extensions into larger registers. This improves data flow analysis and + primarily affects functions using floating point Neon instructions.
Renaming a parameter in the decompiler will no longer commit the data types of all parameters, allowing data types to continue to "float" without getting locked into a potentially incorrect initial data type. In addition, the cumbersome warning dialog - for renaming and retyping has been removed improving your RE workflow.
+ for renaming and retyping has been removed, improving your RE workflow.There are many new processor specifications including SuperH4, MCS-96, - HCS12X/XGATE, HCS08, and user-contributed specifications the MCS-48, - SuperH1/2a, and the Tricore.
+ HCS12X/XGATE, HCS08, and user-contributed specifications for MCS-48, + SuperH1/2a, and Tricore.The 16-bit x86 processor specification has been re-worked to include protected mode addressing, which the NE loader now uses by default. Handling of @@ -157,8 +158,8 @@ complications from decompilation results. The implementation handles the HCS12X paging scheme as well.
Many improvements and bug fixes have been made to existing processor - specifications, ARM, AARCH64, PIC, 68K, MIPS, PPC, JVM, Sparc, AVR8, - 8051, 6502, etc...
+ specifications: ARM, AARCH64, PIC, 68K, MIPS, PPC, JVM, Sparc, AVR8, + 8051, 6502, and others.Bug fixes and improvements are listed in the +
Bug fixes and improvements for 9.0.x are listed in the Change History file.
- https://www.nsa.gov/ghidra + https://www.nsa.gov/ghidra