From 48a86b945aeff7c08911104df5d4579e21e03833 Mon Sep 17 00:00:00 2001 From: Ryan Kurtz Date: Wed, 24 Sep 2025 13:04:54 -0400 Subject: [PATCH 1/4] GP-0: Finding dev mode extensions in all application root dirs --- .../src/main/java/ghidra/GhidraApplicationLayout.java | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/Ghidra/Framework/Utility/src/main/java/ghidra/GhidraApplicationLayout.java b/Ghidra/Framework/Utility/src/main/java/ghidra/GhidraApplicationLayout.java index 802cc4b186..e0a9336ad3 100644 --- a/Ghidra/Framework/Utility/src/main/java/ghidra/GhidraApplicationLayout.java +++ b/Ghidra/Framework/Utility/src/main/java/ghidra/GhidraApplicationLayout.java @@ -240,10 +240,11 @@ public class GhidraApplicationLayout extends ApplicationLayout { dirs.add(new ResourceFile(new File(userSettingsDir, "Extensions"))); if (SystemUtilities.isInDevelopmentMode()) { - ResourceFile rootDir = getApplicationRootDirs().iterator().next(); - File temp = new File(rootDir.getFile(false), "Extensions"); - if (temp.exists()) { - dirs.add(new ResourceFile(temp)); // ghidra/Ghidra/Extensions + for (ResourceFile rootDir : getApplicationRootDirs()) { + File temp = new File(rootDir.getFile(false), "Extensions"); + if (temp.exists()) { + dirs.add(new ResourceFile(temp)); // i.e., ghidra/Ghidra/Extensions + } } } else { From 0815f463f543e0f09e582de612e04b612460bc4d Mon Sep 17 00:00:00 2001 From: emteere <47253321+emteere@users.noreply.github.com> Date: Wed, 24 Sep 2025 18:01:43 +0000 Subject: [PATCH 2/4] GP-5998 Added security_check_cookie function patterns and callfixup for VS2022 based binaries. --- .../Processors/x86/data/languages/x86-64-win.cspec | 9 +++++++++ Ghidra/Processors/x86/data/languages/x86win.cspec | 9 +++++++++ .../x86/data/patterns/x86-64win_patterns.xml | 13 +++++++++++++ .../x86/data/patterns/x86win_patterns.xml | 9 +++++++++ 4 files changed, 40 insertions(+) diff --git a/Ghidra/Processors/x86/data/languages/x86-64-win.cspec b/Ghidra/Processors/x86/data/languages/x86-64-win.cspec index 846134c13f..5310d4e1af 100644 --- a/Ghidra/Processors/x86/data/languages/x86-64-win.cspec +++ b/Ghidra/Processors/x86/data/languages/x86-64-win.cspec @@ -233,4 +233,13 @@ ]]> + + + + + + + diff --git a/Ghidra/Processors/x86/data/languages/x86win.cspec b/Ghidra/Processors/x86/data/languages/x86win.cspec index d759822606..19c6a28786 100644 --- a/Ghidra/Processors/x86/data/languages/x86win.cspec +++ b/Ghidra/Processors/x86/data/languages/x86win.cspec @@ -386,4 +386,13 @@ ]]> + + + + + + + diff --git a/Ghidra/Processors/x86/data/patterns/x86-64win_patterns.xml b/Ghidra/Processors/x86/data/patterns/x86-64win_patterns.xml index 50b144afae..0b3d282905 100644 --- a/Ghidra/Processors/x86/data/patterns/x86-64win_patterns.xml +++ b/Ghidra/Processors/x86/data/patterns/x86-64win_patterns.xml @@ -89,4 +89,17 @@ 0xcccc * 0x4c8b 11...100 01001.01 0x89 + + + 01001... 0x3b 0x0d ........ ........ ........ ........ + 0x75 0x10 + 01001... 0xc1 0xc1 0x10 + 0x66 0xf7 0xc1 0xff 0xff + 0x75 0x01 + 0xc3 + 01001... 0xc1 0xc9 0x10 + 0xe9 + + + diff --git a/Ghidra/Processors/x86/data/patterns/x86win_patterns.xml b/Ghidra/Processors/x86/data/patterns/x86win_patterns.xml index 4c4b59e73c..c048c9f334 100644 --- a/Ghidra/Processors/x86/data/patterns/x86win_patterns.xml +++ b/Ghidra/Processors/x86/data/patterns/x86win_patterns.xml @@ -144,4 +144,13 @@ + + 0x3b 0x0d 0x.. 0x.. 0x.. 0x.. + 0x75 0x01 + 0xc3 + 0xe9 + + + + From 69ed84a069255d06e500691dfd9229067bb8b209 Mon Sep 17 00:00:00 2001 From: emteere <47253321+emteere@users.noreply.github.com> Date: Wed, 24 Sep 2025 18:03:10 +0000 Subject: [PATCH 3/4] GP-5526 bug fix for .plt.sec and pattern matching optimization --- .../app/cmd/function/CreateThunkFunctionCmd.java | 6 ++++++ .../ghidra/app/analyzers/FunctionStartAnalyzer.java | 13 +++++++++---- .../x86/data/patterns/x86gcc_prepatterns.xml | 8 ++++---- 3 files changed, 19 insertions(+), 8 deletions(-) diff --git a/Ghidra/Features/Base/src/main/java/ghidra/app/cmd/function/CreateThunkFunctionCmd.java b/Ghidra/Features/Base/src/main/java/ghidra/app/cmd/function/CreateThunkFunctionCmd.java index 24eb186393..1743a23304 100644 --- a/Ghidra/Features/Base/src/main/java/ghidra/app/cmd/function/CreateThunkFunctionCmd.java +++ b/Ghidra/Features/Base/src/main/java/ghidra/app/cmd/function/CreateThunkFunctionCmd.java @@ -566,6 +566,12 @@ public class CreateThunkFunctionCmd extends BackgroundCommand { if (instr == null) { return null; } + // if there is no pcode, go to the next instruction + // assume fallthrough (ie. x86 instruction ENDBR64) + // TODO: at some point, might need to do a NOP detection + if (instr.getPcode().length == 0) { + instr = listing.getInstructionAfter(entry); + } FlowType flowType; diff --git a/Ghidra/Features/BytePatterns/src/main/java/ghidra/app/analyzers/FunctionStartAnalyzer.java b/Ghidra/Features/BytePatterns/src/main/java/ghidra/app/analyzers/FunctionStartAnalyzer.java index c02e18321e..a19668ff81 100644 --- a/Ghidra/Features/BytePatterns/src/main/java/ghidra/app/analyzers/FunctionStartAnalyzer.java +++ b/Ghidra/Features/BytePatterns/src/main/java/ghidra/app/analyzers/FunctionStartAnalyzer.java @@ -17,6 +17,7 @@ package ghidra.app.analyzers; import java.math.BigInteger; import java.util.*; +import java.util.regex.Matcher; import generic.jar.ResourceFile; import ghidra.app.cmd.function.CreateFunctionCmd; @@ -209,7 +210,7 @@ public class FunctionStartAnalyzer extends AbstractAnalyzer implements PatternFa private String label = null; private boolean isThunk = false; // true if this function should be turned into a thunk private boolean noreturn = false; // true to set function non-returning - private String sectionName = null; // required section name + private java.util.regex.Pattern sectionNamePattern = null; // required section name as a regex pattern boolean validFunction = false; // must be defined at a function private boolean contiguous = true; // require validcode instructions be contiguous @@ -227,9 +228,13 @@ public class FunctionStartAnalyzer extends AbstractAnalyzer implements PatternFa protected boolean checkPreRequisites(Program program, Address addr) { // check required section name - if (sectionName != null) { + if (sectionNamePattern != null) { MemoryBlock block = program.getMemory().getBlock(addr); - if (block == null || !block.getName().matches(sectionName)) { + if (block == null) { + return false; + } + Matcher m = sectionNamePattern.matcher(block.getName()); + if (!m.matches()) { return false; } } @@ -651,7 +656,7 @@ public class FunctionStartAnalyzer extends AbstractAnalyzer implements PatternFa break; case "section": - sectionName = attrValue; + sectionNamePattern = java.util.regex.Pattern.compile(attrValue); break; case "noreturn": diff --git a/Ghidra/Processors/x86/data/patterns/x86gcc_prepatterns.xml b/Ghidra/Processors/x86/data/patterns/x86gcc_prepatterns.xml index 190acf223f..84b6d20dee 100644 --- a/Ghidra/Processors/x86/data/patterns/x86gcc_prepatterns.xml +++ b/Ghidra/Processors/x86/data/patterns/x86gcc_prepatterns.xml @@ -6,15 +6,15 @@ 0x68......00 0xe9......ff - + - 0xf3 0x0f 0x1e 0x1a - 0xf2 0xff 0x25 .. .. .. .. + 0xf3 0x0f 0x1e 0xfa + 0xf2 0xff 0x25 - + From dc069a18c602b71dbbb3bb7d150adb5b39565b8f Mon Sep 17 00:00:00 2001 From: emteere <47253321+emteere@users.noreply.github.com> Date: Wed, 24 Sep 2025 18:06:03 +0000 Subject: [PATCH 4/4] GP-5287 Added ENDBR jump target checking instructions as function start patterns for x86 gcc binaries --- .../x86/data/patterns/x86-64gcc_patterns.xml | 61 ++++++++++++++++++- .../x86/data/patterns/x86gcc_patterns.xml | 26 ++++++++ 2 files changed, 86 insertions(+), 1 deletion(-) diff --git a/Ghidra/Processors/x86/data/patterns/x86-64gcc_patterns.xml b/Ghidra/Processors/x86/data/patterns/x86-64gcc_patterns.xml index 2daa852e44..9c70076c5a 100644 --- a/Ghidra/Processors/x86/data/patterns/x86-64gcc_patterns.xml +++ b/Ghidra/Processors/x86/data/patterns/x86-64gcc_patterns.xml @@ -48,11 +48,70 @@ 0x41564155 0x41554154 0x41 010101.. 0100100. 0x89 11...... 0x55 - 0x41 010101.. 0x41 010101.. 0100100. 0x89 11...... + + + + 0xf3 0x0f 0x1e 0xfa 0x48 0x89 0x5c 0x24 11...000 0x48 0x89 0x6c 0x24 11...000 + 0xf3 0x0f 0x1e 0xfa 0x48 0x89 0x5c 0x24 11...000 0x4c 0x89 0x64 0x24 111..000 + 0xf3 0x0f 0x1e 0xfa 0x48 0x89 0x6c 0x24 11...000 0x4c 0x89 0x64 0x24 111..000 + 0xf3 0x0f 0x1e 0xfa 0x5589e5 + 0xf3 0x0f 0x1e 0xfa 0x554889e5 + 0xf3 0x0f 0x1e 0xfa 0x534889fb + 0xf3 0x0f 0x1e 0xfa 0x554889fd + 0xf3 0x0f 0x1e 0xfa 0x534889fb + 0xf3 0x0f 0x1e 0xfa 0x53 0x48 0x83 0xec 0....000 + 0xf3 0x0f 0x1e 0xfa 0x53 0x48 0x81 0xec .....000 00...... 0x00 + + 0xf3 0x0f 0x1e 0xfa 0x55 0x48 0x89 0xe5 0x48 100000.1 0xec .....000 + 0xf3 0x0f 0x1e 0xfa 0x554889e553 + 0xf3 0x0f 0x1e 0xfa 0x554889fd53 + 0xf3 0x0f 0x1e 0xfa 0x554889e548897df8 + 0xf3 0x0f 0x1e 0xfa 0x53 0x48 0x89 0xfb 0xe8 ........ ........ 0xff 0xff + 0xf3 0x0f 0x1e 0xfa 0x4154 0x55 0100100. 0x89 11...... + 0xf3 0x0f 0x1e 0xfa 0x4154 0x55 0x53 0100100. 0x89 11...... + + 0xf3 0x0f 0x1e 0xfa 0x415741564155 + 0xf3 0x0f 0x1e 0xfa 0x41564155 + 0xf3 0x0f 0x1e 0xfa 0x41554154 + 0xf3 0x0f 0x1e 0xfa 0x41 010101.. 0100100. 0x89 11...... 0x55 + 0xf3 0x0f 0x1e 0xfa 0x41 010101.. 0x41 010101.. 0100100. 0x89 11...... + + + + 0x90 0x90 + 0xc3 0x90 + 0x6690 + 0xc9 0xc3 + 0xe9........ + 0xe9........90 + 0xeb.. + 0xeb..90 + 0x5d 0xc3 + 0x5b 0xc3 + 0x41 010111.. 0xc3 + 0x31c0 0xc3 + 0x4883c4 ....1000 0xc3 + 0x666690 + 0x0f1f00 + 0x0f1f4000 + 0x0f1f440000 + 0x660f1f440000 + 0x0f1f8000000000 + 0x0f1f840000000000 + 0x660f1f840000000000 + + + 0xf3 0x0f 0x1e 0xfa + + + + + 0x5589e5 diff --git a/Ghidra/Processors/x86/data/patterns/x86gcc_patterns.xml b/Ghidra/Processors/x86/data/patterns/x86gcc_patterns.xml index 89885e5aea..fd06503cb3 100644 --- a/Ghidra/Processors/x86/data/patterns/x86gcc_patterns.xml +++ b/Ghidra/Processors/x86/data/patterns/x86gcc_patterns.xml @@ -108,9 +108,35 @@ 0x5589e5 0x8d 0x4c ..100100 0x04 0x83 0xe4 0xf. 0x57 0x8d 0x7c ..100100 0x08 0x83 0xe4 0xf. + + + 0xf3 0x0f 0x1e 0xfb 0x5589e5 + 0xf3 0x0f 0x1e 0xfb 0x8d 0x4c ..100100 0x04 0x83 0xe4 0xf. + 0xf3 0x0f 0x1e 0xfb 0x57 0x8d 0x7c ..100100 0x08 0x83 0xe4 0xf. + + + + 0x90 + 0xc3 + 0xe9........ + 0xeb.. + 0x89f6 + 0x8d7600 + 0x8d742600 + 0x8db600000000 + 0x8dbf00000000 + 0x8dbc2700000000 + 0x8db42600000000 + + + 0xf3 0x0f 0x1e 0xfb + + + +