yetangitu/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2025-10-05 19:42:36 +02:00
Code Issues Releases Wiki Activity
15408 commits 3 branches 48 tags 436 MiB
Commit graph

15408 commits

This branch
This branch
All branches
Author SHA1 Message Date
Ryan Kurtz
c892ad1695 Merge remote-tracking branch 'origin/GP-1-dragonmacher-color-chooser-history-fix' 2025-07-29 09:44:28 -04:00
Ryan Kurtz
6c85ba4563 Merge remote-tracking branch 
'origin/GP-5759_ghidorahrex_PR-8192_p1pkin_sh4_fsca_fix' (Closes #8192)
 2025-07-29 09:12:19 -04:00
Ryan Kurtz
391a052e55 Merge remote-tracking branch 'origin/patch' 2025-07-29 09:10:56 -04:00
ghidorahrex
4abf6d55ad GP-5766: Fixed instruction AVX512 disassembly errors 2025-07-29 08:56:43 -04:00
Ryan Kurtz
9b8468b6b6 Merge remote-tracking branch 
'origin/GP-5592_ghidorahrex_PR-7982_niooss-ledger_ebpf-ISA-v4' into
patch (Closes #7982)
 2025-07-29 08:53:18 -04:00
Nicolas Iooss
24d19f6e8c Add eBPF ISA v4 instructions 
In 2023, the eBPF instruction set was modified to add several
instructions related to signed operations (load with sign-extension,
signed division, etc.), a 32-bit jump instruction and some byte-swap
instructions. This became version 4 of eBPF ISA.

Here are some references about this change:

- https://pchaigno.github.io/bpf/2021/10/20/ebpf-instruction-sets.html
  (a blog post about eBPF instruction set extensions)
- https://lore.kernel.org/bpf/4bfe98be-5333-1c7e-2f6d-42486c8ec039@meta.com/
  (documentation sent to Linux Kernel mailing list)
- https://www.rfc-editor.org/rfc/rfc9669.html#name-sign-extension-load-operati
  (IETF's BPF Instruction Set Architecture standard defined the new
  instructions)
- https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/kernel/bpf/core.c?h=v6.14#n1859
  (implementation of signed division and remainder in Linux kernel.
  This shows that 32-bit signed DIV and signed MOD are zero-extending
  the result in DST)
- https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/kernel/bpf/core.c?h=v6.14#n2135
  (implementation of signed memory load in Linux kernel)
- https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f9a1ea821ff25353a0e80d971e7958cd55b47a3
  (commit which added signed memory load instructions in Linux kernel)

This can be tested with a recent enough version of clang and LLVM (this
works with clang 19.1.4 on Alpine 3.21).
For example for signed memory load instructions:

    signed int sext_8bit(signed char x) {
        return x;
    }

produces:

    $ clang -O0 -target bpf -mcpu=v4 -c test.c -o test.ebpf
    $ llvm-objdump -rd test.ebpf
    ...
    0000000000000000 <sext_8bit>:
           0:  73 1a ff ff 00 00 00 00  *(u8 *)(r10 - 0x1) = r1
           1:  91 a1 ff ff 00 00 00 00  r1 = *(s8 *)(r10 - 0x1)
           2:  bc 10 00 00 00 00 00 00  w0 = w1
           3:  95 00 00 00 00 00 00 00  exit

(The second instruction is a signed memory load)

Instruction MOVS (Sign extend register MOV) uses offset to encode the
conversion (whether the source register is to be considered as signed
8-bit, 16-bit or 32-bit integer). The mnemonic for these instructions is
quite unclear:

- They are all named MOVS in the proposal
  https://lore.kernel.org/bpf/4bfe98be-5333-1c7e-2f6d-42486c8ec039@meta.com/
- LLVM and Linux disassemblers only display pseudo-code (`r0 = (s8)r1`)
- RFC 9669 (https://datatracker.ietf.org/doc/rfc9669/) uses MOVSX for
  all instructions.
- GCC uses MOVS for all instructions:
  https://github.com/gcc-mirror/gcc/blob/releases/gcc-14.1.0/gcc/config/bpf/bpf.md?plain=1#L326-L365

To make the disassembled code clearer, decode such instructions with a
size suffix: MOVSB, MOVSH, MOVSW.

The decoding of instructions 32-bit JA, BSWAP16, BSWAP32 and BSWAP64 is
straightforward.
 2025-07-29 12:45:06 +00:00
Ryan Kurtz
1929357e1d Merge remote-tracking branch 'origin/patch' 2025-07-29 08:33:22 -04:00
Ryan Kurtz
0d8a39a07a Merge remote-tracking branch 
'origin/GP-5857_ghidorahrex_PR-7979_niooss-ledger_ebpf-fix-load-zext'
into patch (Closes #7979)
 2025-07-29 08:24:03 -04:00
Ryan Kurtz
b4239911c9 Merge remote-tracking branch 
'origin/GP-5858_ghidorahrex_PR-7929_niooss-ledger_fix-ebpf-call-operand'
into patch (Closes #7929)
 2025-07-29 08:21:27 -04:00
Ryan Kurtz
179263a592 Merge remote-tracking branch 
'origin/GP-5593_ghidorahrex_PR-7985_niooss-ledger_ebpf-fix-semantic-byte-swap-instructions'
into patch (Closes #7985)
 2025-07-29 08:19:37 -04:00
Ryan Kurtz
28b46c5c93 Merge remote-tracking branch 
'origin/GP-5336_ghidorahrex_PR-7065_philpem_6805_hcs08_xidx_fix' into
patch (Closes #7065, Closes #7064)
 2025-07-29 08:16:11 -04:00
Ryan Kurtz
ce924f8ab5 Merge remote-tracking branch 'origin/GP-4977_DescriptorDecoderFix' 2025-07-29 10:14:27 +00:00
dragonmacher
24532a377d Minor refactor for tool closing bug in extension apps 2025-07-28 18:18:04 -04:00
caheckman
c05acfed1d Fix for testGetReturnTypeOfMethodDescriptor 2025-07-28 22:06:06 +00:00
ghidra1
1449eef894 Merge remote-tracking branch 'origin/patch' 2025-07-28 17:03:48 -04:00
ghidra1
296778319e GP-5881 Minor Structure editor event handling improvement 2025-07-28 17:01:42 -04:00
ghidra1
a63b39d14f GP-0 Added exception detail for composite resolution error 2025-07-28 14:58:31 -04:00
Ryan Kurtz
47bd5a50cb Merge remote-tracking branch 
'origin/GP-5871_dev747368_dwarf_strings_charset_option' (Closes #8346)
 2025-07-28 17:29:11 +00:00
Ryan Kurtz
1b7fae31f9 Merge remote-tracking branch 'origin/patch' 2025-07-28 17:28:07 +00:00
Ryan Kurtz
1486a06165 Merge remote-tracking branch 
'origin/GP-5877_Dan_fixReDisassembler--SQUASHED' into patch
(Closes #8382)
 2025-07-28 17:25:05 +00:00
Ryan Kurtz
b729d9b217 Merge remote-tracking branch 
'origin/GP-5876-dragonmacher-vt-column-exception-patch' into patch
(Closes #8094)
 2025-07-28 17:23:02 +00:00
Ryan Kurtz
538ee96e69 GP-0: Fixing javadoc (Closes #8369) 2025-07-28 15:57:42 +00:00
Ryan Kurtz
67ba8d5f6b Merge remote-tracking branch 'origin/patch' 2025-07-28 15:49:57 +00:00
Dan
39c0a83c0c GP-5877: Fix Patch Instruction action in some Harvard architectures. 2025-07-28 15:48:40 +00:00
Ryan Kurtz
60ff7c9791 Merge remote-tracking branch 'origin/GP-5867_dev747368_dwarf_only_iterate_defined_dtc' into patch 2025-07-28 15:46:50 +00:00
Dan
851264808b GP-5795: Add a "Comment" column in the "Watches" table. 2025-07-28 15:29:01 +00:00
Ryan Kurtz
598efa66d9 Merge remote-tracking branch 'origin/patch' 2025-07-28 12:44:07 +00:00
Ryan Kurtz
6f339247ef Merge remote-tracking branch 
'origin/GP-5788_Dan_addActionForciblyCloseTxes--SQUASHED' into patch
(Closes #8298)
 2025-07-28 12:41:31 +00:00
Ryan Kurtz
790fe71c41 Merge remote-tracking branch 'origin/GP-5553_Dan_lessTimingOut' into patch 2025-07-28 12:39:41 +00:00
Ryan Kurtz
89534eecaf Merge remote-tracking branch 'origin/patch' 2025-07-28 12:34:13 +00:00
Ryan Kurtz
35202441cc Merge remote-tracking branch 
'origin/GP-5764_ghidra007_rttiscript_vfunctions_dont_force_thiscalls--SQUASHED'
into patch (Closes #8163)
 2025-07-28 12:32:06 +00:00
Dan
1ad0a0f719 GP-5788: Add an action to forcibly close all transactions for a target (in case of back-end misbehavior) 2025-07-28 12:31:48 +00:00
Ryan Kurtz
bfb28de7d8 Merge remote-tracking branch 
'origin/GP-5875_dragonmacher_PR-8375_neuromancer_patch-1' (Closes #8375)
 2025-07-28 12:21:54 +00:00
Ryan Kurtz
c7f0253ac0 Merge remote-tracking branch 'origin/GP-5874_ghizard_PDB_CPP_fix_months_old_regression_in_assigning_vxt_types' 2025-07-28 12:19:38 +00:00
dragonmacher
0286fb59fa GP-5876 - Fixed table column exception seen when using Version Tracking 2025-07-25 19:29:07 -04:00
dragonmacher
ae5ecfc3fd Fixed import 2025-07-25 18:56:59 -04:00
neuromancer
2a8e4a54df Use L as a default shortcut for renaming symbols in symbol tree 2025-07-25 18:56:57 -04:00
ghidra007
cee04048cb GP-5764 added option to RecoverClassesFromRTTIScript enabling users to not force vfunctions to be thiscalls. 2025-07-25 22:15:27 +00:00
dragonmacher
2eca4e9d7e Fix for null context and actions that do not use action context, but 
rely on managed enablement
 2025-07-25 16:16:08 -04:00
Dan
9767073b32 GP-5553: Disable timing out when we have a ProgressService. 2025-07-25 19:36:55 +00:00
Ryan Kurtz
4aaf18f435 Merge remote-tracking branch 
'origin/GP-3091_ghidra_ElfPowerPC64_ELFv1Fixes' (Closes #570)
 2025-07-25 19:07:56 +00:00
dev747368
3aa00a125b GP-5871 add analyzer option to set charset used by DWARF importer 2025-07-25 18:32:34 +00:00
ghidra1
4a0e95ecd3 GP-3091 ppc64 ELF improvements for 32-bit addressing. Fixed default ELF 
GOT markup boundary condition.  Fixed improper EXTERNAL symbols with
.pltgot. prefix and duplication.
 2025-07-25 14:19:18 -04:00
ghizard
c1dbadade8 GP-5874 - PDB CPP - Fix month's old regression in assigning vxt types; 
add tests to prevent further regression
 2025-07-25 11:34:52 -04:00
Ryan Kurtz
a67720f028 Merge remote-tracking branch 'origin/patch' 2025-07-25 09:55:12 -04:00
Ryan Kurtz
c56d41a353 Merge remote-tracking branch 'origin/GP-5865_emteere_MultiWordReferenceDialogFix' into patch 2025-07-25 09:43:52 -04:00
Ryan Kurtz
7e6c01f283 Merge remote-tracking branch 'origin/patch' 2025-07-24 14:36:22 -04:00
Ryan Kurtz
0e5c95dfc2 Merge remote-tracking branch 
'origin/GP-5361_James_code_compare_exception_fix' into patch
(Closes #7028, Closes #8125, Closes #8289)
 2025-07-24 14:27:51 -04:00
Ryan Kurtz
1724227c31 Merge remote-tracking branch 'origin/patch' 2025-07-24 12:20:20 -04:00
Ryan Kurtz
4c8b9761fe Merge remote-tracking branch 'origin/GP-0_Dan_addTestDiagnostics' into patch 2025-07-24 12:14:20 -04:00