Skip to content

v2.0.0—Ghidra Backend

Latest

Choose a tag to compare

@ebrocas ebrocas released this 07 Jul 15:05
a052793

Features

  • All mappers now share a single disassembler --backend value (ida/ghidra) implemented in one common place, replacing the previous per-mapper disassembler/exporter selection.
  • Remove the qbinary/Quokka dependency: fs-cg and decomp now interact directly with the disassemblers (IDA, Ghidra), so Pyrrha can run on systems without Quokka.
  • Add ELF SONAME support: binaries are indexed by their DT_SONAME so imports referencing a SONAME resolve even without a matching symlink.
  • decomp mapper: full rework around a class-based object integrated with the common backend layer.
  • decomp mapper: add a -e/--export option to dump the result as JSON, loadable through the new ExportedDecompilation object exposed by Pyrrha.
  • Expose Binary image base and relocatable information on the internal representation.
  • cli: revamp the console output rendering.
  • Improve the documentation (installation, quick summary, decomp mapper) and migrate the documentation build from MkDocs to Zensical.
  • Add unit tests for the decomp export model plus functional tests for the decomp mapper.

Fixes

  • intercg mapper: various fixes around addresses and demangled names, missing Ghidra thunks, extended ignore list, and argument renaming.
  • fs-cg mapper: avoid an infinite loop in trampoline resolution and add a real timeout to program loading.
  • fs/fs-cg mappers: pass load_binary arguments through a partial mechanism and improve multiprocessing error handling.
  • decomp mapper: fix the mapping run (map now reports success/failure, runs the decompilation and call-graph indexing phases, and records the binary node so functions get a valid parent).
  • decomp mapper: fix call-graph source cross-references (call-site locations are looked up by callee address and no longer raise on the first reference).
  • decomp mapper: fix command-line arguments and improve the decompilation script (correct NamedTemporaryFile usage, better IDA decompilation output).
  • decomp mapper (IDA backend): use the ida_domain 0.5.0 pseudocode API (get_pseudocode(func).to_text(...)), fixing a TypeError that broke every IDA decompilation run.
  • decomp mapper: skip imported functions during source and call-graph indexing (they have no decompiled body), removing spurious per-function error/warning logs.
  • decomp mapper: write decompiled source via a portable temporary file, fixing a TypeError (delete_on_close) that aborted every run on Python 3.11.
  • decomp mapper: attach call-site locations to the call reference returned by record_ref_call instead of the callee symbol id.
  • decomp mapper: record each function's source file under a per-function unique name, fixing a UNIQUE constraint failed: file.id crash when two functions share a name.
  • decomp mapper (IDA backend): fix the function type reported by IDA.
  • decomp mapper: fix small remaining issues in database handling.
  • imports mapper: fix duplicate-import resolution not honoring the INTERACTIVE cache on a cache hit, which could leave the resolution prompt loop stuck.
  • cli: keep an existing suffix in the DB path and annotate the decomp mapper variable with its base type to fix a type-checking error.

Internal

  • Reorganize the repository into two submodules (backend and mappers) and rework the mappers so backend support lives in a single common place; remove unused modules and the heimdallr/disassembly-sync prototype.
  • CI: build and test IDA and Ghidra Docker images, run the decomp export-model and functional tests, export test artifacts, and trigger builds only on relevant changes.
  • CI: expand the supported Python version range.
  • Add backend-free unit tests for the decomp, imports and intercg mappers and the CLI, raising coverage without needing a disassembler; run them in CI and merge their coverage into the global report.
  • Tests: make export-artifact collection best-effort so a read-only pre-existing destination (e.g. artifacts downloaded from another job) no longer fails the test at teardown.
  • CI: run coverage in parallel mode, add a coverage job that combines the data files from every test job into a single global coverage report (the union of all lines exercised by the whole suite), preserve each job's coverage data ahead of that combine step so nothing is lost, and refine the coverage targets.

Full Changelog: v1.0.1...v2.0.0