项目作者: extremecoders-re

项目描述 :
jni.h compiled for Ghidra
高级语言: C
项目地址: git://github.com/extremecoders-re/ghidra-jni.git
创建时间: 2019-06-22T22:18:09Z
项目社区:https://github.com/extremecoders-re/ghidra-jni

开源协议:

下载


ghidra-jni

All in-one jni.h compiled for Ghidra.

How to load in Ghidra?

Go to File -> Parse C Source

Create a new Parse Configuration Profile with the following Parse Options

  1. -D_X86_
  2. -D__STDC__
  3. -D_GNU_SOURCE
  4. -D__WORDSIZE=64
  5. -Dva_list=void *
  6. -D__DO_NOT_DEFINE_COMPILE
  7. -D_Complex
  8. -D_WCHAR_T
  9. -D__NO_STRING_INLINES
  10. -D__signed__
  11. -D__extension__=""
  12. -D_Bool="bool"
  13. -D__GLIBC_HAVE_LONG_LONG=1
  14. -D__need_sigset_t
  15. -Daligned_u64=uint64_t
  16. -Daligned_u64=uint64_t

Under source files to parse, add jni-ghidra.h to the list. Remove any other existing file (if any).

How was this generated ?

The default jni.h from Java fails to parse correctly in Ghidra. As a result, I have taken a precompiled jni.h intended for IDA Pro from here and pre-processed it (gcc -E/cpp). The pre-processed file contain several lines begining with # which correspond to source files. These lines must be removed or else Ghidra will fail to parse.

As a result of pre-processing this does not contain C++ definitions for the various JNI types. If you want C++ type definitions as well use the one intended for IDA Pro.

Useful Info

Adding a function data type using the API

A function data type can also be added using the Ghidra Python API. An example is shown below

  1. from ghidra.app.util.cparser.C.CParserUtils import parseSignature
  2. from ghidra.program.model.data import DataTypeConflictHandler
  3. fn_sign = 'void function1(int p1, int p2)'
  4. fn_defn = parseSignature(None, currentProgram, fn_sign)
  5. dtm = currentProgram.getDataTypeManager()
  6. dtm.addDataType(fn_defn, DataTypeConflictHandler.DEFAULT_HANDLER)

Creating structures programmatically

From my answer on RE.SE

  1. from ghidra.program.model.data import DataTypeConflictHandler
  2. from ghidra.app.util.cparser.C import CParser
  3. mystruct_txt = """
  4. struct mystruct{
  5. uint32_t field1;
  6. uint32_t field2;
  7. };"""
  8. # Get Data Type Manager
  9. data_type_manager = currentProgram.getDataTypeManager()
  10. # Create CParser
  11. parser = CParser(data_type_manager)
  12. # Parse structure
  13. parsed_datatype = parser.parse(mystruct_txt)
  14. # Add parsed type to data type manager
  15. data_type_manager.addDataType(parsed_datatype, DataTypeConflictHandler.DEFAULT_HANDLER)