Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Suggestion] Make header file compatible with Ghidra #287

Closed
masagrator opened this issue May 6, 2020 · 6 comments
Closed

[Suggestion] Make header file compatible with Ghidra #287

masagrator opened this issue May 6, 2020 · 6 comments
Labels

Comments

@masagrator
Copy link
Contributor

masagrator commented May 6, 2020

Currently generated header file is not compatible with Ghidra "Parse C Source" option.

It needs typedefed C++ types to match Ghidra types. List of used by me typedefs I'm adding at the beginning for AArch64

typedef pointer uintptr_t;
typedef pointer intptr_t;
typedef qword int64_t;
typedef dword int32_t;
typedef word int16_t;
typedef byte int8_t;
typedef qword uint64_t;
typedef dword uint32_t;
typedef word uint16_t;
typedef byte uint8_t;

So for example instead of

struct VirtualInvokeData
{
    uintptr_t methodPtr;
    void* method;
};

struct Il2CppType
{
    void* data;
    unsigned int bits;
};

we need

typedef pointer uintptr_t;

struct VirtualInvokeData
{
    uintptr_t methodPtr;
    void* method;
};

struct Il2CppType
{
    void* data;
    unsigned int bits;
};

Maybe it will be easier to just include in repo .prf parse configuration that will be used for il2cppheader files, so it won't conflict with IDA.

@AndnixSH
Copy link

AndnixSH commented Jun 1, 2020

Would be great to support Ghidra

@therealchjones
Copy link
Contributor

Additional change necessary to properly parse header into Ghidra: eliminate C++ style inheritance from structs. Even with addition of the above typedefs, the following results in an error from Ghidra:

struct Super {
    int foo;
};

struct Derived : Super{
    int bar;
};

whereas the following results in the expected behavior:

struct Super {
    int foo;
};

struct Derived {
    int foo;
    int bar;
};

I wrote a (terrible, brute force, slow, ugly shell) script to convert a large il2cpp.h from the former to the latter form (with the aforementioned typedefs), and it parsed as expected. Attached here in case it's useful to you or someone else, but it likely does just what you expect and would obviously be improved if done at generation time.
il2cpp-hmaker.txt

@MidnightCowUK
Copy link

MidnightCowUK commented Aug 30, 2020

I wrote a (terrible, brute force, slow, ugly shell) script to convert a large il2cpp.h from the former to the latter form (with the aforementioned typedefs), and it parsed as expected. Attached here in case it's useful to you or someone else, but it likely does just what you expect and would obviously be improved if done at generation time.
il2cpp-hmaker.txt

Don't suppose you can be bothered to create a windows friendly version of that shell script? I tested in Git Bash but wouldn't run..

It would be great to get a Ghidra compatible header file from Il2CppDumper, currently the IDA python script does use the .h file and works great, however Ghidra is open source / free and has the added benefit of browsing the machine code as decompiled C which is a ton more readable..

@TellowKrinkle
Copy link
Contributor

Instead of inlining all the fields, you can do a regex replace of struct\s*(\S+)\s*:\s*(\S+)\s*\{ with struct $1 {\n\t$2 super; to replace all inherited structs with a super member, should work unless some things inherit from zero-size structs

This version of the Ghidra script will automatically assign signatures to all the functions ghidra.py.gz

@therealchjones
Copy link
Contributor

Don't suppose you can be bothered to create a windows friendly version of that shell script? I tested in Git Bash but wouldn't run..

Honestly I don't really want to spend the time refining the proof-of-concept shell script; I'd rather integrate the changes into il2cppdumper itself, or at least have it as an option. I'm sure I'll work toward that at some point. (Any day now...)

@therealchjones
Copy link
Contributor

Filed PR #371 to add aforementioned typedefs and inline all inherited struct info, WFM but will need more testing.

For the script changes by @TellowKrinkle adding function/parameter info, refer to separate issue #366

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

6 participants