rbran / sleigh-rs

Ghidra Sleight (PCode) parsing library in Rust.

Sleigh-rs

This project is a Ghidra Sleigh parser.

The project is unfinished, and is not ready for use.

For an example on how this lib can be used, checkout sleigh2rust and sleigh3rust.

Ghidra Sleigh

The Sleigh language used by Ghidra, describes CPU instructions sets, designed to facilitate the reverse-engineering and and emulate cpu architectures.

TODO

• Unit tests.
• Implement the final version of the instruction execution parser.

sleigh-rs's Issues

Cpool not implemented

Used in JVM and Dalvik family.

Table export a value of len 0

The CPU architecture family 68000 (68040, 68030, 68020 and coldfire) all include the table fcc (variant sf) export a value of len 0.

It's unclear how Sleigh should handle a values of len 0.

Sparc output operation outputs 32bits, but input is bigger then 32bits.

Op 32bits value with Int greater then 32bits.

"SparcV9_32", "SparcV9_64"

Jump to addr with a len diferent then a default execution addr

eg: sometimes the dst addr is 32bits, other time 64bits

CPUs: "pa-risc32be", "8085", "x86", "x86-64"

Disassembly pointing to non context varnode

Some CPUs, in the disassembly execution context, points to varnodes that are not marked as context.

CPUs: "avr32a", "avr8xmega", "avr8eind"

Re-export from a table that also export const is also const

Sleigh need to mark a table export as const if it re-export from other table, that exports a const directly.

In AARCH64 family.

Performance question

Hi! Thank you for the great library. I am curious, have you compared the performance between your implementation and the original one? If so, what were the results?

Execution context assign values with diferent lenghts

In execution, some times values are assigned to variables with a bigger len.

eg: 8bit value into 16bit variable

Table expects a value from a non-exporting table.

CPUs from the MIPS family.

And possibly reduces the value len

AND-OP a 64bit value with a 32bit variable, outputting a 32bit value.

Affect all PPC Family.