Merge remote-tracking branch 'origin/Updated_Whats_New_9.1' into

Ghidra_9.1

Conflicts:
	Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.html
This commit is contained in:
ghidra1 2019-09-23 10:54:29 -04:00
commit 208433c9f7

View file

@ -22,7 +22,7 @@
<P> <P>
Ghidra is a software reverse engineering (SRE) framework developed by NSA's Research Directorate. Ghidra is a software reverse engineering (SRE) framework developed by NSA's Research Directorate.
This framework includes a suite of full-featured, high-end software analysis tools that enable This framework includes a suite of full-featured, high-end software analysis tools that enable
users to analyze compiled code on a variety of platforms including Windows, Mac OS, and Linux. users to analyze compiled code on a variety of platforms including Windows, MacOS, and Linux.
Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with
hundreds of other features. Ghidra supports a wide variety of process instruction sets and hundreds of other features. Ghidra supports a wide variety of process instruction sets and
executable formats and can be run in both user-interactive and automated modes. Users may also executable formats and can be run in both user-interactive and automated modes. Users may also
@ -40,7 +40,7 @@
<BR /> <BR />
<H1> What's New in Ghidra 9.1</H1> <H1> What's New in Ghidra 9.1</H1>
<H2> <a id="finePrint91"/>The not so fine print: Please Read!</H2> <H2> <a id="finePrint91"/>The not-so-fine print: Please Read!</H2>
<P>Ghidra 9.1 is fully backward compatible with project data from previous releases. However, programs opened in 9.1 may no <P>Ghidra 9.1 is fully backward compatible with project data from previous releases. However, programs opened in 9.1 may no
longer be accessible by an earlier Ghidra version if the processor model has been updated. </P> longer be accessible by an earlier Ghidra version if the processor model has been updated. </P>
@ -56,8 +56,8 @@
a 9.0 server. Note that all other server interaction including authentication were and continue to be a 9.0 server. Note that all other server interaction including authentication were and continue to be
performed over a secure TLS connection.</P> performed over a secure TLS connection.</P>
<P>Minor Note: Ghidra compiled .sla files are not backwards compatible due to the newly added OTHER space for syscalls <P>Minor Note: Ghidra-compiled .sla files are not backwards compatible due to the newly added OTHER space for syscalls
support. In the pre-built ghidra all .sla files are re-built from scratch. However if you have local processor modules, support. In the pre-built ghidra, all .sla files are re-built from scratch. However if you have local processor modules,
or are building ghidra from scratch, you may need to do a clean build. You will get an error if an old .sla file is loaded or are building ghidra from scratch, you may need to do a clean build. You will get an error if an old .sla file is loaded
without recompilation of the .slaspec file. Any processor modules with changes are normally recompiled at Ghidra startup without recompilation of the .slaspec file. Any processor modules with changes are normally recompiled at Ghidra startup
so this situation is rare.</P> so this situation is rare.</P>
@ -65,9 +65,9 @@
<H2>Data Improvements</H2> <H2>Data Improvements</H2>
<P>Bitfields within structures are now supported as a Ghidra data type. Bitfield definitions <P>Bitfields within structures are now supported as a Ghidra data type. Bitfield definitions
can come from PBD, DWARF, parsed header files, and can also be created within the structure can come from PDB, DWARF, parsed header files, and can also be created within the structure
editor. All Data type archives delivered with Ghidra have been re-parsed to capture bitfield editor. All Data type archives delivered with Ghidra have been re-parsed to capture bitfield
information. In addition compiler bitfield allocation schemes have been carefully implemented. information. In addition, compiler bitfield allocation schemes have been carefully implemented.
Full support for bitfield references within the decompiler is planned for a future Full support for bitfield references within the decompiler is planned for a future
release.</P> release.</P>
@ -78,8 +78,8 @@
<H2>System Calls</H2> <H2>System Calls</H2>
<P>Ghidra now supports overriding indirect calls, CALLOTHER pcode ops, and conditional jumps via new overriding references. <P>Ghidra now supports overriding indirect calls, CALLOTHER pcode ops, and conditional jumps via new overriding references.
These references can be used to achieve correct decompilation of syscall-like instructions. A new script These references can be used to achieve correct decompilation of syscall-like instructions. A new script,
"ResolveX86orX64LinuxSyscalls" has been provided as part of this initial implementation. ResolveX86orX64LinuxSyscallsScript, has been provided as part of this initial implementation.
Future releases will automatically identify and apply system calls for other operating systems and versions.</P> Future releases will automatically identify and apply system calls for other operating systems and versions.</P>
<P>To support system calls, the decompiler follows references into OTHER address space overlays. <P>To support system calls, the decompiler follows references into OTHER address space overlays.
@ -99,9 +99,10 @@
<H2>iOS DYLD and Macho Format</H2> <H2>iOS DYLD and Macho Format</H2>
<P>Imported DYLD cache images, extracted from an iOS image, are split into sub-dylib sections, greatly enhancing <P>DYLD shared cache images, extracted from an iOS image, can now be imported in their entirety.
follow on analysis. Internal Macho headers are retained and marked up similarly A DYLD's embedded DYLIB's are split into memory blocks, greatly enhancing follow-on analysis.
to ELF files, which includes tracking the origin of the program bytes from the initial import binary.</P> Internal Macho headers are retained and marked up similarly to ELF and PE files, which includes
tracking the origin of the program bytes from the initial import binary.</P>
<H2>Ghidra Server</H2> <H2>Ghidra Server</H2>
<P>The Ghidra server now requires the client to use a TLS secure connection for the initial RMI registry port access. <P>The Ghidra server now requires the client to use a TLS secure connection for the initial RMI registry port access.
@ -111,7 +112,7 @@
connect to a 9.1 server.</P> connect to a 9.1 server.</P>
<P>The Ghidra server has two additional authentication methods, Active Directory using <P>The Ghidra server has two additional authentication methods, Active Directory using
Kerberos and Plugable Authentication Modules(PAM) using JAAS. To utilize these new Kerberos and Plugable Authentication Modules (PAM) using JAAS. To utilize these new
methods you must configure the server.conf file and use either -a1 for windows authentication methods you must configure the server.conf file and use either -a1 for windows authentication
or -a4 along with -jaas. The JAAS mode will require setup of an additional configuration file (jaas.conf).</P> or -a4 along with -jaas. The JAAS mode will require setup of an additional configuration file (jaas.conf).</P>
@ -136,20 +137,20 @@
<P>In addition the decompiler now recognizes more optimization patterns used <P>In addition the decompiler now recognizes more optimization patterns used
by compilers for signed division, resulting in simplified decompilation.</P> by compilers for signed division, resulting in simplified decompilation.</P>
<P>AARCH64 based binary decompilation will be cleaner due to better handling of <P>AARCH64-based binary decompilation will be cleaner due to better handling of
zero extensions into larger registers which complicated data flow analysis. This zero extensions into larger registers. This improves data flow analysis and
change affects floating point Neon instructions.</P> primarily affects functions using floating point Neon instructions.</P>
<P>Renaming a parameter in the decompiler will no longer commit the <P>Renaming a parameter in the decompiler will no longer commit the
data types of all parameters, allowing data data types of all parameters, allowing data
types to continue to "float" without getting locked into a potentially types to continue to "float" without getting locked into a potentially
incorrect initial data type. In addition, the cumbersome warning dialog incorrect initial data type. In addition, the cumbersome warning dialog
for renaming and retyping has been removed improving your RE workflow.</P> for renaming and retyping has been removed, improving your RE workflow.</P>
<H2>Languages</H2> <H2>Languages</H2>
<P>There are many new processor specifications including SuperH4, MCS-96, <P>There are many new processor specifications including SuperH4, MCS-96,
HCS12X/XGATE, HCS08, and user-contributed specifications the MCS-48, HCS12X/XGATE, HCS08, and user-contributed specifications for MCS-48,
SuperH1/2a, and the Tricore.</P> SuperH1/2a, and Tricore.</P>
<P>The 16-bit x86 processor specification has been re-worked to include <P>The 16-bit x86 processor specification has been re-worked to include
protected mode addressing, which the NE loader now uses by default. Handling of protected mode addressing, which the NE loader now uses by default. Handling of
@ -157,8 +158,8 @@
complications from decompilation results. The implementation handles the HCS12X paging scheme as well.</P> complications from decompilation results. The implementation handles the HCS12X paging scheme as well.</P>
<P>Many improvements and bug fixes have been made to existing processor <P>Many improvements and bug fixes have been made to existing processor
specifications, ARM, AARCH64, PIC, 68K, MIPS, PPC, JVM, Sparc, AVR8, specifications: ARM, AARCH64, PIC, 68K, MIPS, PPC, JVM, Sparc, AVR8,
8051, 6502, etc...</P> 8051, 6502, and others.</P>
<H2>Bug Fixes and Enhancements</H2> <H2>Bug Fixes and Enhancements</H2>
@ -175,13 +176,13 @@
requests, scripts, processor modules, and plugins. </P> requests, scripts, processor modules, and plugins. </P>
<H2> Bug Fixes and Enhancements</H2> <H2> Bug Fixes and Enhancements</H2>
<P> Bug fixes and improvements are listed in the <P> Bug fixes and improvements for 9.0.x are listed in the
<a href="ChangeHistory.html">Change History</a> file.</P> <a href="ChangeHistory.html">Change History</a> file.</P>
<BR> <BR>
<P align="center"> <P align="center">
<B>https://www.nsa.gov/ghidra</B> <B><a href="https://www.nsa.gov/ghidra"> https://www.nsa.gov/ghidra</a></B>
</P> </P>
</BODY> </BODY>