Skip to content

Syntax Highlightning, Comment Function + Bugfixes #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 40 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
40 commits
Select commit Hold shift + click to select a range
43f4c13
adding some more colors to your life
alexander-pick Apr 23, 2020
f9d17b6
started to improve strings and fixed something with externs
Apr 24, 2020
31ed778
started to improve strings and fixed something with externs
Apr 24, 2020
237c0a9
string references resolve better now
alexander-pick Apr 24, 2020
ed09011
removed a verbose message
alexander-pick Apr 24, 2020
91fedc1
cleanup
alexander-pick Apr 24, 2020
3a9bf83
small fixes
alexander-pick Apr 25, 2020
b98808c
small fixes
alexander-pick Apr 25, 2020
52f5792
small things
alexander-pick Apr 26, 2020
3be918b
started to add comment functionality
alexander-pick Apr 26, 2020
924f39b
now with comments
Apr 27, 2020
aa9366e
now with comments, small fix
Apr 27, 2020
0ca2a4d
new comment function, small fix
alexander-pick Apr 27, 2020
50eda8c
IDA 7.5 adjustments
Apr 28, 2020
1d0e48c
comment fixes
Apr 28, 2020
ceb25cc
IDA 7.5 stuff, minor typo fix
alexander-pick Apr 28, 2020
6568c7f
fixed a bug
alexander-pick Apr 28, 2020
13515dc
handling of names with :
Apr 29, 2020
ffd6218
crossrefs on x
alexander-pick Apr 29, 2020
197caee
more string stuff
alexander-pick Apr 29, 2020
ed16c85
added refresh hotkey and updated readme
Apr 30, 2020
88f4993
remove refresh hotkey as unneeded and fixed rename instead
Apr 30, 2020
c29847c
small polish
Apr 30, 2020
07d95c3
BUGFIX: missing func name in debugger decom view
alexander-pick May 1, 2020
14d1648
BUGFIX: changes outside decompiler not recognized corrently
alexander-pick May 4, 2020
1b38c4f
BUGFIX: the now show bug in decompiler again, hopefully now once for …
alexander-pick May 4, 2020
90bc459
BUGFIX: the now show bug in decompiler again, hopefully now once for …
alexander-pick May 4, 2020
880900b
BUGFIX: labelnames cannot be renamed
alexander-pick May 6, 2020
ccbaa5e
BUGFIX: labelnames cannot be renamed, some stuff with :: in names
alexander-pick May 6, 2020
3a487ca
BUGFIX: labelnames cannot be renamed, some stuff with :: in names
alexander-pick May 6, 2020
5362dbf
merged latest changes by CE
alexander-pick Aug 12, 2020
e035423
After merge fixes
alexander-pick Aug 12, 2020
ea6ebd5
Header
alexander-pick Aug 12, 2020
1057407
Mini fixes, added C as hotkey for comments and fixed banner if CPU no…
alexander-pick Aug 12, 2020
4d54e7f
new proc support, small fixes
Aug 14, 2020
d3f4eea
Fixed a import but regarding the .idata segment
alexander-pick Aug 18, 2020
7994d89
v850 support for the new Ghidra 9.2 Module
Aug 27, 2020
b6d517d
Merged master updates to fork
alexander-pick Nov 19, 2020
7cc59ba
VS Project update
alexander-pick Nov 19, 2020
882631d
minor change regarding casts
alexander-pick Nov 19, 2020
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
# build residue
/.vs/*
/x86/*
/x64/*
/obj32/*
/obj64/*
/bin/*
Expand Down
254 changes: 131 additions & 123 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,124 +1,132 @@
## WARNING: THIS CODE IS VERY RAW AND PROBABLY VERY BUGGY!

## Introduction

This is the blc (Binary Lifting Contraption) plugin for IDA Pro. It is the Bastard
love child of Ghidra's decompiler with Ida Pro.

The plugin integrates Ghidra's decompiler code into an Ida plugin an provides a
basic decompiler capability for all platforms support by both Ida and Ghidra. It
provides a basic source code display that attempts to mimic that of the Hex-Rays
decompiler. It has only been written with Ida 7.x in mind.

## BUILDING:

On all platforms you should clone blc into your IDA SDK's plugins sub-directory
so that you end up with `<sdkdir>/plugins/blc`. This is because the build files
all use relative paths to find necessary IDA header files and link libraries.

### Build blc for Linux / OS X:

Use the include Makefile to build the plugin. You may need to adjust the paths
that get searched to find your IDA installation (`/Applications/IDA Pro N.NN` is
assumed on OSX and `/opt/ida-N.NN` is assumed on Linux, were N.NN is derived from
the name of your IDA SDK directory eg `idasdk73` associates with `7.3` and should
match your IDA version number). This is required to successfully link the plugin.

```
$ cd <sdkdir>/plugins/blc
$ make
```

Compiled binaries will end up in `<sdkdir>/plugins/blc/bin`

```
LINUX
-------------------------------------------
| ida | ida64 |
-------------------------------------------
IDA 7.x | | |
plugin | blc.so | blc64.so |
-------------------------------------------

OS/X
-------------------------------------------
| ida | ida64 |
-------------------------------------------
IDA 7.x | | | |
plugin | blc.dylib | blc64.dylib |
-------------------------------------------
```

Copy the plugin(s) into your `<IDADIR>/plugins` directory and blc should be
listed as an available plugin for all architectures supported both Ida
and Ghidra.

### Build blc for Windows

Build with Visual Studio C++ 2017 or later using the included solution (`.sln`)
file (`blc.sln`). Two build targets are available depending on which version
of IDA you are using:

```
-----------------------------------------
| ida | ida64 |
-----------------------------------------
IDA 7.x | Release/x64 | Release64/x64 |
plugin | blc.dll | blc64.dll |
-----------------------------------------
```

Copy the plugin(s) into your `<IDADIR>/plugins` directory and blc should be
listed as an available plugin for all architectures supported by both Ida
and Ghidra.

## INSTALLATION

Assuming you have installed IDA to `<idadir>`, install the plugin by copying the
compiled binaries from `<sdkdir>/plugins/blc/bin` to `<idadir>/plugins` (Linux/Windows)
or `<idadir>/idabin/plugins` (OS X).

The plugin is dependent on Ghira processor specifications which you will need to
copy over from your own Ghidra installation. Installing Ghidra is a simple matter
of unzipping the latest Ghidra release, for example: https://ghidra-sre.org/ghidra_9.1_PUBLIC_20191023.zip
Within the extracted Ghidra folder, you will find a `Ghidra` subdirectory which,
in turn, contains a `Processors` subdirectory. The decompiler needs access to
files contained under `Ghidra/Processors`. By default the plugin looks for the
environment variable `$GHIDRA_DIR` which it expects to point at your Ghidra
installation folder such that `$GHIDRA_DIR/Ghidra/Processors` exists. If
`$GHIDRA_DIR` is not set, then the plugin expects to find `<idadir>/plugins/Ghidra/Processors`
which you may create with a symlink or by copying the approprate directories
from your Ghidra installation.

### Pre-built binaries:

As an alternative to building the plugin yourself, pre-built binaries for
IDA 7.x (Windows, Linux, OS X) are available in the `blc/bins` directory.

## USING THE PLUGIN

With the plugin installed, open a binary of interest in IDA. In order for the
plugin to be become available, the binary's architecture must be supported by
both Ida and Ghidra.

With the cursor placed inside the body of an Ida function, select
`Edit/Plugins/Ghidra Decompiler`. A successful decompilation (which may take a bit
of time, will open a new window containing the C source generated by Ghidra's
decompiler. Within the source window, you may double click on a function name to
decompile tht function. Double clicking on a global data name will navigate you
to that symbol in the Ida disassembly view. The `ESC` key will navigate back to a
previous function, or close the source viewer if there is no previous function.

The `N` hot key may be used to rename any symbol in the source view. When a symbol
in the source view corresponds to a symbol in the Ida disassembly, the symbol will
also be renamed in the disassembly.

## POTENTIAL FUTURE WORK

* Allow user to set data types for symbols in the source view
* Provide IDA derived type information to the decompiler so that it can
do a better job with things like structures and pointer dereferencing
* Better (at least some) support for string literals
* Investigate what settings/info are necessary to get this standalone decompiler
to yield results identical to Ghidra's. Is this symbol information? Type information?
## WARNING: THIS CODE IS VERY RAW AND PROBABLY VERY BUGGY!

## Introduction

This is the blc (Binary Lifting Contraption) plugin for IDA Pro. It is the Bastard
love child of Ghidra's decompiler with Ida Pro.

The plugin integrates Ghidra's decompiler code into an Ida plugin an provides a
basic decompiler capability for all platforms support by both Ida and Ghidra. It
provides a basic source code display that attempts to mimic that of the Hex-Rays
decompiler. It has only been written with Ida 7.x in mind.

## BUILDING:

On all platforms you should clone blc into your IDA SDK's plugins sub-directory
so that you end up with `<sdkdir>/plugins/blc`. This is because the build files
all use relative paths to find necessary IDA header files and link libraries.

### Build blc for Linux / OS X:

Use the include Makefile to build the plugin. You may need to adjust the paths
that get searched to find your IDA installation (`/Applications/IDA Pro N.NN` is
assumed on OSX and `/opt/ida-N.NN` is assumed on Linux, were N.NN is derived from
the name of your IDA SDK directory eg `idasdk73` associates with `7.3` and should
match your IDA version number). This is required to successfully link the plugin.

```
$ cd <sdkdir>/plugins/blc
$ make
```

Compiled binaries will end up in `<sdkdir>/plugins/blc/bin`

```
LINUX
-------------------------------------------
| ida | ida64 |
-------------------------------------------
IDA 7.x | | |
plugin | blc.so | blc64.so |
-------------------------------------------

OS/X
-------------------------------------------
| ida | ida64 |
-------------------------------------------
IDA 7.x | | | |
plugin | blc.dylib | blc64.dylib |
-------------------------------------------
```

Copy the plugin(s) into your `<IDADIR>/plugins` directory and blc should be
listed as an available plugin for all architectures supported both Ida
and Ghidra.

### Build blc for Windows

Build with Visual Studio C++ 2019 or later using the included solution (`.sln`)
file (`blc.sln`). Two build targets are available depending on which version
of IDA you are using:

```
-----------------------------------------
| ida | ida64 |
-----------------------------------------
IDA 7.x | Release/x64 | Release64/x64 |
plugin | blc.dll | blc64.dll |
-----------------------------------------
```

Copy the plugin(s) into your `<IDADIR>/plugins` directory and blc should be
listed as an available plugin for all architectures supported by both Ida
and Ghidra.

## INSTALLATION

Assuming you have installed IDA to `<idadir>`, install the plugin by copying the
compiled binaries from `<sdkdir>/plugins/blc/bin` to `<idadir>/plugins` (Linux/Windows)
or `<idadir>/idabin/plugins` (OS X).

The plugin is dependent on Ghira processor specifications which you will need to
copy over from your own Ghidra installation. Installing Ghidra is a simple matter
of unzipping the latest Ghidra release, for example:

https://ghidra-sre.org/ghidra_9.1.2_PUBLIC_20200212.zip

Within the extracted Ghidra folder, you will find a `Ghidra` subdirectory which,
in turn, contains a `Processors` subdirectory. The decompiler needs access to
files contained under `Ghidra/Processors`. By default the plugin looks for the
environment variable `$GHIDRA_DIR` which it expects to point at your Ghidra
installation folder such that `$GHIDRA_DIR/Ghidra/Processors` exists. If
`$GHIDRA_DIR` is not set, then the plugin expects to find `<idadir>/plugins/Ghidra/Processors`
which you may create with a symlink or by copying the approprate directories
from your Ghidra installation.

### Pre-built binaries:

As an alternative to building the plugin yourself, pre-built binaries for
IDA 7.x (Windows, Linux, OS X) are available in the `blc/bins` directory.

## USING THE PLUGIN

With the plugin installed, open a binary of interest in IDA. In order for the
plugin to be become available, the binary's architecture must be supported by
both Ida and Ghidra.

With the cursor placed inside the body of an IDA function, select
`Edit/Plugins/Ghidra Decompiler`. A successful decompilation (which may take a bit
of time, will open a new window containing the C source generated by Ghidra's
decompiler. Within the source window, you may double click on a function name to
decompile that function. Double clicking on a global data name will navigate you
to that symbol in the IDA disassembly view. The `ESC` key will navigate back to a
previous function, or close the source viewer if there is no previous function.

The `N` hot key may be used to rename any symbol in the source view. When a symbol
in the source view corresponds to a symbol in the Ida disassembly, the symbol will
also be renamed in the disassembly.

You can get xrefs of a functions by marking it and pressing `X`. To write a comment,
mark the line and press `/` (or `C`). If you have the hex-rays decompiler installed,
some keys might conflict and need to be changed for hex-rays. A feature to freely
select the hotkey values is planned.

## POTENTIAL FUTURE WORK

* Allow user to set data types for symbols in the source view
* Provide IDA derived type information to the decompiler so that it can
do a better job with things like structures and pointer dereferencing
* ~~Better (at least some) support for string literals~~
* Investigate what settings/info are necessary to get this standalone decompiler
to yield results identical to Ghidra's. Is this symbol information? Type information?
arch/platform/compiler settings?
Loading