+Improvements
++
+- Analysis. Added check for vftable entries in
+.NEPsection and relaxed the requirement that the code must have a return. (GP-649)- Analysis. Corrected flaw in RTTI analyzer determination of size of vftables. (GP-688)
+- Basic Infrastructure. Updated TLS protocol preference to use the most preferred/recent version available to both sides of an SSL connection (e.g., TLSv1.3) instead of forcing use of TLSv1.2. (GP-622)
+- Build. Corrected build issues which had prevented users from building Ghidra on an Apple M1 (OS X, AARCH64 architecture). (GP-600, Issue #2653)
+- Demangler. Increased Gnu Demangler parsing performance by changing some regular expressions. (GP-705)
+- Eclipse Integration. Updated SleighEditor to support new endian tag on define token definitions. (GP-721)
+- GUI. Updated the Choose Data Type dialog to apply data types in the same manner as dragging types from the Data Types window. This provides users more control when choosing how to overwrite existing types. (GP-521)
+- Importer:ELF. Added support for ELF relocation
+R_X86_64_IRELATIVE. (GP-651, Issue #1189)- Importer:ELF. Sped up loading of ELF files with large symbol tables. (GP-697)
+
+Bugs
++
+- Analysis. The RTTI analyzer now runs prior to Reference analysis so that references into vftables are not turned into code or data before the vftables are created. (GP-517)
+- API.
+Funtion.getCalledFunctions(TaskMonitor)andFunction.getCallingFunctions(TaskMonitor)now support passingnullfor the task monitor parameter, which previously would have thrown an exception. (GP-589, Issue #2643)- Data Types. Corrected segmented 32-bit pointer datatype address generation for 16:16 x86 far pointers. (GP-534, Issue #2548)
+- Decompiler. Fixed Decompiler issue where, when a function name extends beyond the line limit, an end-of-line comment could wrap around to additional lines without including additional
+//comment indicators. (GP-473)- Decompiler. Corrected an exception that could occur when attempting to edit function signature from the Decompiler. (GP-597, Issue #2601)
+- Eclipse Integration. When installing the SleighEditor into Eclipse, the plugin will now show up under the Ghidra category. Previously the Group Items by Category option had to be turned off before the SleighEditor would appear as a visible entry. (GP-564)
+- Eclipse Integration. Fixed an issue with Eclipse PyDev breakpoints not catching. (GP-668, Issue #2713)
+- Eclipse Integration. Fixed an Eclipse GhidraDev exception that occurred when creating a new Ghidra scripting project if a ~/ghidra_scripts directory did not exist. (GP-669)
+- Emulator. Replaced Java floating point emulation to fix multiple rounding issues. (GP-357, Issue #2414)
+- Graphing. Fixed issue with graph filters not updating satellite view when changing edge filters. (GP-557)
+- Graphing. Fixed Function Graph keybindings that did not work when docked in the main Code Browser window. (GP-586, Issue #2641)
+- GUI. Fixed NPE due to using Go To action when there was no open program in the Listing. (GP-66)
+- GUI. Fixed bug in Reference Code Viewer options that caused an exception. (GP-620, Issue #2672)
+- Importer. Fixed exception caused when importing previously exported XML data where the bookmark override option was turned off. (GP-667)
+- Importer:ELF. Fixed a NullPointerException caused by importing an ELF with an uninitialized
+.gotsection. (GP-360, Issue #2416)- Importer:ELF. Added Support for ELF
+R_ARM_MOVW_ABS_NCandR_ARM_MOVT_ABS ELFRelocations for ARM. (GP-555, Issue #2510)- Importer:ELF. Corrected ELF processing of
+.init_arrayand.fini_arraywhich was incorrectly overadjusting entries for an image base change. (GP-699)- Importer:Mach-O. Corrected Mach-O fat-binary library import issue and resolved error related to unnamed Mach-O segment. (GP-652, Issue #2702)
+- Importer:Mach-O. Fixed an issue with DYLD Load Command data structures being created in the wrong locations. (GP-689, Issue #2624)
+- Importer:Mach-O. Fixed an exception that occurred when importing Mach-O files that define zero
+LC_BUILD_VERSIONtool entries. (GP-702, Issue #2192)- PDB. Fixed createPdbXmlFiles.bat to permit spaces in the path name of Ghidra installation folder and the batch argument name. (GP-575, Issue #2167)
+- Processors. Added missing
+RFEinstruction in MIPS up to version R3000. (GP-33, Issue #1766)- Processors. ARM instruction
+VMULnow decodes correctly. (GP-627, Issue #2677)- Processors. Added missing
+CFINVinstruction to AARCH64 processor specification and added definitions for locals in neon instructions. (GP-655, Issue #2710)- Scripting. Fixed analyzeHeadless
+-scriptPathoption that didn't work for Python and other non-Java scripts located in non-default directories. (GP-528, Issue #2561)- Scripting. Fixed concurrency issue with management of scripting bundle paths. (GP-576)
+- Scripting. Corrected handling for Ghidra Script files which are symlinks that were broken in Ghidra 9.2. (GP-650, Issue #2698)
+
@@ -24,6 +70,7 @@Bugs
- Graphing. Fixed issue with Graph filters not working and satellite view sometimes not matching graph. (GP-526)
-- Importer:MachO. MachO DYLD cache incorrect offset use has been fixed. (GP-550, Issue ##2560)
-- Listing. Fixed issue where Edit Label action (L key) did not work on primary function symbols. (GP-537)
+- Importer:Mach-O. Mach-O DYLD cache incorrect offset use has been fixed. (GP-550, Issue #2560)
+- Listing. Fixed issue where Edit Label action (L key) did not work on primary function symbols. (GP-537)
- Multi-User. Corrected Ghidra Server build issue for version 9.2.1 which had an improperly generated classpath.frag file. Issue caused server to fail startup with a ClassNotFoundException. (GP-542)
-- Processors. The V850 JMP instruction has been corrected not to use the PC in the address calculation (GP-548, Issue #2570)
+- Processors. The V850
JMPinstruction has been corrected not to use the PC in the address calculation. (GP-548, Issue #2570)- Processors. Removed erroneous VST4 variant, most likely from a copy/paste error. This fixes the ARM Thumb BL instruction disassembly with a negative offset. (GP-549, Issue #2559)
type_info vftable when it cannot be found with its mangled name. This will enable many more Windows programs to have their RTTI structures created that were unable to be parsed in previous Ghidra versions. (GP-141)gradle Decompiler:generateParsers task, which still requires bison and flex, must be used, explicitly, when changes are made to lex/yacc source files. (GP-467)0x1608 and 0x1609 with presumed class and struct types and follow-on application of these types. Also fixed up some fall-back data type logic and improved some warning messages to reflect the cause of the conditions. (GP-474, Issue #2523)longlong and double return values. Endianess ordering of r0/r1 was incorrect. (GP-512, Issue #2547)DUMPBIN /EXPORTS (see Ghidra/Features/Base/data/symbols/README.txt). (GT-3235)unique space are now always shown with the size of the access. Fixed bug which would cause the PCode emulator to reject valid pcode in rare instances. (GP-196)"Method is not Remote" errors. (GT-3521, Issue #1440)Method is not Remote errors. (GT-3521, Issue #1440)RSB.w instruction. (GT-3420, Issue #1365)@@ -331,7 +378,7 @@Improvements
-
- Importer:MachO. Improved import/load time of DYLD shared cache files. (GT-3261)
+- Importer:Mach-O. Improved import/load time of DYLD shared cache files. (GT-3261)
- Program API. Cached the addresses that correspond to executable memory to improve analysis performance. (GT-3260)
-i option. Corrected -ip option to strictly convey remote access hostname to clients. The updated server will only accept connections from Ghidra 9.1 and later clients due to the registry port now employing TLS. (GT-2685, Issue #101, #645)GhidraScript.askDomainFile() now correctly throws a CancelledException when the cancel button is clicked. (GT-2841)Bugs
-
- Multi-User:Ghidra Server. Corrected severe script error in svrAdmin.bat introduced with 9.0.3 build.
-- GUI. Restored the default 'p' key binding for creating pointers within the listing display.
+- Multi-User:Ghidra Server. Corrected severe script error in svrAdmin.bat introduced with 9.0.3 build. (GT-2874)
+- GUI. Restored the default 'p' key binding for creating pointers within the listing display. (GT-2854)
New Features
-
- GUI. Function tags are now viewable from Functions Window table using new column.
+- GUI. Function tags are now viewable from Functions Window table using new column. (GT-2114)
Improvements
-
- Decompiler. Improved modeling of CFG on Windows 10. (Issue #340)
-- Patcher. Renamed patch directory to /Ghidra/patch and added README.txt that explains how the patch directory is used.
-- Search. Updated the Decompiler Data Type Finder to find references to inside of nested array access in a line of Decompiler C output. (Issue #416)
-- Sleigh. Improved error reporting for SLEIGH compiler. (Issue #364)
+- Decompiler. Improved modeling of CFG on Windows 10. (GT-2755, Issue #340)
+- Patcher. Renamed patch directory to
+/Ghidra/patch and added README.txt that explains how the patch directory is used. (GT-2734) - Search. Updated the Decompiler Data Type Finder to find references inside of nested array access in a line of Decompiler C output. (GT-2756, Issue #416)
+- Sleigh. Improved error reporting for SLEIGH compiler. (GT-2820, Issue #364)
Bugs
-
- Analysis. Code that checks for thunks no longer throws an exception if the PC is not set for the processor.
-- Analysis. Made a fix to enable Apply button when changing tool options. (Issue #40)
-- Data Types. Fixed concurrent modification exception when replacing one datatype for another that results in some other datatype being renamed.
-- Decompiler. Fixed dynamic variables and equates in 16-bit x86 programs. (Issue #336)
-- Decompiler:Java. Fixed DEX decompilation regression issue. (Issue #350)
-- Eclipse Integration. Fixed exception in Eclipse GhidraDev plugin that occurred when performing certain actions on a Ghidra project that was imported from a previously exported Archive File. (Issues #283, #383)
+- Analysis. Code that checks for thunks no longer throws an exception if the PC is not set for the processor. (GT-2730)
+- Analysis. Made a fix to enable Apply button when changing tool options. (GT-2801, Issue #40)
+- Data Types. Fixed concurrent modification exception when replacing one datatype for another that results in some other datatype being renamed. (GT-2736)
+- Decompiler. Fixed dynamic variables and equates in 16-bit x86 programs. (GT-2745, Issue #336)
+- Decompiler:Java. Fixed DEX decompilation regression issue. (Issue #350, GT-2743)
+- Eclipse Integration. Fixed exception in Eclipse GhidraDev plugin that occurred when performing certain actions on a Ghidra project that was imported from a previously exported Archive File. (GT-2721, Issues #283, #383)
- GUI. Improved documentation on how to deal with HiDPI monitor issues in Linux. In the <ghidra_installation>/support/launch.properties file, change VMARGS=-Dsun.java2d.xrender from false to true.
-- Importer. Fixed an exception that occurred when batch importing APK files. (Issue #426)
-- Multi-User:Ghidra Server. Restored ability to execute svrAdmin script in development mode.
-- Processors. The 6502 Zero page indexed addressing has been corrected to only access the Zero page. (Issue #201)
-- Processors. The 68000 BCD arithmetic instructions now have pcode semantics that allow disassembly to continue. (Issue #227)
-- Search. Fixed NullPointerException in Decompiler Data Type Reference Finder. (Issue #407)
+- Importer. Fixed an exception that occurred when batch importing APK files. (GT-2767, Issue #426)
+- Multi-User:Ghidra Server. Restored ability to execute svrAdmin script in development mode. (GT-2740)
+- Processors. The 6502 Zero page indexed addressing has been corrected to only access the Zero page. (GT-2759, Issue #201)
+- Processors. The M68000 BCD arithmetic instructions now have pcode semantics that allow disassembly to continue. (GT-2807, Issue #227)
+- Search. Fixed NullPointerException in Decompiler Data Type Reference Finder. (GT-2754. Issue #407)
Bugs
-
- Analysis. Constant reference analysis boundary controls for speculative references has been fixed. Speculative references are references created from computed constants passed as parameters, stored to a location, or from indexed offsets from a register. (Issue #228)
-- Decompiler. Fixed rendering bug in the Decompiler when the "Find" dialog is closed. (Issue #282)
-- Decompiler. Fixed decompiler handling of Function Definition data types. (Issue #247)
-- Decompiler. Fixed "Free Varnode" exception in RuleConditionalMove. (Issue #294)
-- Diff. Fixed exceptions that can occur in the Diff View for programs with overlays.
-- Documentation. Corrected the spelling of "listener" throughout the source code. (Issue #235)
-- Exporter. Exporting a selection as Intel Hex will now allow a selection of any length. Previously this was restricted to multiples of 16 bytes. (Issue #260)
-- GUI. Fixed exception that occurs after disabling MyProgramChangesDisplayPlugin.
-- GUI. Updated the "Open Program" dialog to disallow file drop operations. (Issue #252) -
- Multi-User:Ghidra Server. Corrected bug introduced into ghidraSvr.bat which could prevent Ghidra Server startup (Issue #279)
-- Processors. The ARM Thumb CMP.W and LSL instructions have been changed to correctly decode. There are still issues to work out with Unpredictable execution when Rd is the PC. (Issue #280)
-- Scripting. MultiInstructionMemReference script has been corrected to consider input and output registers when placing a reference on an instruction.
+- Analysis. Constant reference analysis boundary controls for speculative references has been fixed. Speculative references are references created from computed constants passed as parameters, stored to a location, or from indexed offsets from a register. (GT-2723, Issue #228)
+- Decompiler. Fixed Decompiler handling of Function Definition data types. (GT-2704, Issue #247)
+- Decompiler. Fixed rendering bug in the Decompiler when the "Find" dialog is closed. (GT-2716, Issue #282)
+- Decompiler. Fixed "Free Varnode" exception in RuleConditionalMove. (GT-2726, Issue #294)
+- Diff. Fixed exceptions that can occur in the Diff View for programs with overlays. (GT-2706)
+- Documentation. Corrected the spelling of "listener" throughout the source code. (GT-2702, Issue #235)
+- Exporter. Exporting a selection as Intel Hex will now allow a selection of any length. Previously this was restricted to multiples of 16 bytes. (GT-2703, Issue #260)
+- GUI. Fixed exception that occurs after disabling MyProgramChangesDisplayPlugin. (GT-2712)
+- GUI. Updated the "Open Program" dialog to disallow file drop operations. (GT-2705, Issue #252)
+- Multi-User:Ghidra Server. Corrected bug introduced into ghidraSvr.bat which could prevent Ghidra Server startup. (GT-2717, Issue #279)
+- Processors. The ARM Thumb CMP.W and LSL instructions have been changed to correctly decode. There are still issues to work out with Unpredictable execution when Rd is the PC. (GT-2722, Issue #280)
+- Scripting. MultiInstructionMemReference script has been corrected to consider input and output registers when placing a reference on an instruction. (GT-2723)
Security
-
- Basic Infrastructure. Added a property to support/launch.properties to prevent log4j from using jansi.dll on Windows. (Issue #286)
+- Basic Infrastructure. Added a property to support/launch.properties to prevent log4j from using jansi.dll on Windows. (GT-2725, Issue #286)
New Features
-
- Scripting. Created a script to show all equates within the current selection. (Issue #111)
+- Scripting. Created ShowEquatesInSelectionScript to show all equates within the current selection. (GT-2651, Issue #111)
Improvements
-
- Basic Infrastructure. Updated commons-compress library to version 1.18. (Issue #171)
-- Eclipse Integration. Ghidra now connects to the Eclipse GhidraDev plugin on 127.0.0.1 rather than localhost.
-- GUI. Turned on font anti-aliasing by default for Linux. (Issue #212)
-- GUI. Fixed Options Dialog slow scrolling speed. (Issue #27)
-- Importer:ELF. Corrected bug in ELF loader which can improperly process the GOT, PLT and relocations - when multiple symbol tables exist within the ELF binary. (Issue #52)
-- Multi-User:Ghidra Server. Corrected the Ghidra Server service wrapper (YAJSW) configuration for - Mac OS X to prevent a startup timeout condition which could occur.
-- Processors. Added ARM/Thumb SRS instruction decodes for undefined modes. (Issue #216)
+- Basic Infrastructure. Updated commons-compress library to version 1.18. (GT-2657, Issue #171)
+- Eclipse Integration. Ghidra now connects to the Eclipse GhidraDev plugin on 127.0.0.1 rather than localhost. (GT-2691)
+- GUI. Turned on font anti-aliasing by default for Linux. (GT-2674, Issue #212)
+- GUI. Fixed Options Dialog slow scrolling speed. (GT-2679, Issue #27)
+- Importer:ELF. Corrected bug in ELF loader which can improperly process the GOT, PLT and relocations when multiple symbol tables exist within the ELF binary. (GT-2646, Issue #52)
+- Multi-User:Ghidra Server. Corrected the Ghidra Server service wrapper (YAJSW) configuration for Mac OS X to prevent a startup timeout condition which could occur. (GT-2637)
+- Processors. Added ARM/Thumb SRS instruction decodes for undefined modes. (GT-2676, Issue #216)
Bugs
-
- API. Fixed equals method on Varnode class. (Issue #97)
-- API. Fixed a bug in MaskImpl.comlementMask(). (Issue #187)
-- Basic Infrastructure. Fixed special character handling in idaxml.py. (Issue #75)
-- Basic Infrastructure. Ghidra now forces the locale to en_US by default. Only the en_US is currently supported. - This fixes certain unexpected exceptions. (Issue #209)
-- Diff. Fixed exceptions occasionally encountered when starting a Diff session. (Issue #211)
-- Documentation. Fixed javadoc search box redirecting to broken links. (Issue #129)
-- Function Graph. Fixed Function Graph exception when generating tooltip. (Issue #65)
-- GUI. Updated window placement to keep windows on screen. (Issue #41)
-- GUI. Add/Edit References dialog now restricts users to creating refs in valid memory address spaces.
-- GUI. Fixed exception when exiting Ghidra while a table is being edited. (Issue #51)
-- GUI. Fixed some touchpad scrolling issues. (Issue #2)
-- GUI. Fixed stack trace in the Data Type Manager's tooltip generation. (Issue #133)
-- GUI. User key binding settings for the Recently Used and Define Pointer actions no longer lost after re-launching tool. (Issue #152)
-- GUI. Toolbar buttons now respond to fast clicking.
-- Importer:MachO. The MachoLoader can now find import libraries found in Universal Binary files. (Issue #136)
-- Importer:PE. The PeLoader now correctly parses the GuardCFFunctionTable when entries are more than 4 bytes each. (Issue #220)
-- Multi-User:Ghidra Server. Removed support for native OS authentication from Ghidra Server (removed modes -a2 and -a3) - due to incompatibility with newer OS releases including Windows 10 and Windows Server 2016. Re-introduction of this will be - considered for a future release.
-- PDB. Corrected NPE error when processing PDB files. (Issues #138, #188)
-- Processors. Added missing PowerPC VLE conditional branch instructions: e_bdnz and e_bdz. (Issue #103)
-- Processors. Fixed instruction semantics for several instructions and added Control Flow Enforcement, NOP variants, CMP variants, UD1, and - prefixed call instructions to X86 processor specification. (Issues #22, #53, #158, #157)
-- Processors. The 68000 MOVE instruction now correctly sets the CF and VF flags. (Issue #163)
-- Processors. Added four missing MOVEM instruction variants to the 68000 processor. (Issue #219)
-- Processors. An incorrect usage of X instead of Y in indexed mode for the 6502 has been corrected.(Issue #201)
-- Processors. Added support for ARM Thumb half BL instruction on processor variants prior to v6. (Issue #39)
-- Scripting. Fixed a bug in ImportSymbolsScript.py that prevented it from running. (Issue #170)
+- API. Fixed equals method on Varnode class. (GT-2648, Issue #97)
+- API. Fixed a bug in MaskImpl.complementMask(). (GT-2694, Issue #187)
+- Basic Infrastructure. Fixed special character handling in idaxml.py. (GT-2669, Issue #75)
+- Basic Infrastructure. Ghidra now forces the locale to en_US by default. Only the en_US is currently supported. This fixes certain unexpected exceptions. (GT-2680, Issue #209)
+- Diff. Fixed exception occasionally encountered when starting a Diff session. (GT-2672, Issue #211)
+- Documentation. Fixed javadoc search box redirecting to broken links. (GT-2655, Issue #129)
+- Function Graph. Fixed Function Graph exception when generating tooltip. (GT-2650, Issue #65)
+- GUI. Updated window placement to keep windows on screen. (GT-1516, Issue #41)
+- GUI. Add/Edit References dialog now restricts users to creating refs in valid memory address spaces. (GT-2638)
+- GUI. Fixed exception when exiting Ghidra while a table is being edited. (GT-2642, Issue #51)
+- GUI. Fixed some touchpad scrolling issues. (GT-2647, Issue #2)
+- GUI. Fixed stack trace in the Data Type Manager's tooltip generation. (GT-2656, Issue #133)
+- GUI. User key binding settings for the Recently Used and Define Pointer actions no longer lost after re-launching tool. (GT-2659, Issue #152)
+- GUI. Toolbar buttons now respond to fast clicking. (GT-2689)
+- Importer:Mach-O. The Mach-O loader can now find import libraries found in Universal Binary files. (GT-2663, Issue #136)
+- Importer:PE. The PeLoader now correctly parses the GuardCFFunctionTable when table entries are more than 4 bytes each. (GT-2671, Issue #220)
+- Multi-User:Ghidra Server. Removed support for native OS authentication from Ghidra Server (removed modes -a2 and -a3) due to incompatibility with newer OS releases including Windows 10 and Windows Server 2016. Re-introduction of this will be considered for a future release. (GT-2653)
+- PDB. Corrected NPE error when processing PDB files. (GT-2673, Issues #138, #188)
+- Processors. Added missing PowerPC VLE conditional branch instructions: e_bdnz and e_bdz. (GT-2652, Issue #103)
+- Processors. Fixed instruction semantics for several instructions and added Control Flow Enforcement, NOP variants, CMP variants, UD1, and prefixed call instructions to X86 processor specification. (GT-2660, Issues #22, #53, #158, #157)
+- Processors. The M68000 MOVE instruction now correctly sets the CF and VF flags. (GT-2661, Issue #163)
+- Processors. Added four missing MOVEM instruction variants to the M68000 processor. (GT-2675, Issue #219)
+- Processors. An incorrect usage of X instead of Y in indexed mode for the 6502 has been corrected. (GT-2677, Issue #201)
+- Processors. PPC VLE now disassembles base PPC instructions that are valid in VLE mode. (GT-2681, Issue #127)
+- Processors. Added support for ARM Thumb half BL instruction on processor variants prior to v6. (GT-2684, Issue #39)
+- Scripting. Fixed a bug in ImportSymbolsScript.py that prevented it from running. (GT-2668, Issue #170)
Security
-
- Basic Infrastructure. Running Ghidra in debug mode no longer opens remotely accessible ports by default. (Issue #6)
-- GUI. The Defined Strings plugin no longer renders HTML in its table. (Issue #45)
-- Project Manager. Fixed an XXE vulnerability affecting projects and many other saved components. (Issue #71)
+- Basic Infrastructure. Running Ghidra in debug mode no longer opens remotely accessible ports by default. (GT-2641, Issue #6)
+- GUI. The Defined Strings plugin no longer renders HTML in its table. (GT-2686, Issue #45)
+- Project Manager. Fixed an XXE vulnerability affecting projects and many other saved components. (GT-2643, Issue #71)