toor-de-force / ghidrall

Adaption of the r2ghidra-dec product to lift binaries to LLVM IR

GHIDRALL

This is an adaption of the r2ghidra-dec project. It leverages the ghidra decompiler's internal datastructures to emit P-code at a higher level than low/high p-code.

Installing

Requires r2.

Same instructions from r2ghidra-dec.

First, make sure the submodule contained within this repository is fetched and up to date:

git submodule init
git submodule update

Then, the radare2 plugin can be built and installed as follows:

mkdir build && cd build
cmake -DCMAKE_INSTALL_PREFIX=~/.local ..
make
make install

Usage

Simply run the ghidrall.py script with your target binary as the input.

Running tests

cd ghidrall/tests mkdir build; cd build cmake .. cmake --build . cd ../.. python run-tests.py

This will compile all the test programs that are pre-instrumented with analysis, decompile, lift and verify them all for verification.

Docker

The following docker container incorporates Seahorn for testing and maintains older versions of modules for compatibility's sake:

https://hub.docker.com/repository/docker/toordeforce/ghidralltester

ghidrall's Issues

Stack overflow error occurs with some binaries

I tried it with the following binary:
https://ece.uwaterloo.ca/~agurfink/secret.bin

Debug flags

Give Ghidrall debug flags to optionally emit intermediate files.

Expand test set

The following are good testsets to expand the support for:

https://samate.nist.gov/SARD/testsuite.php
https://github.com/trailofbits/cb-multios
https://github.com/llvm/llvm-test-suite

Ghidra mislabels some blocks

For example, in this CBRANCH op, the address 0x80511a1 is referred to but there is no block with that label:

CBRANCH


0x80511a1
code
1


register0x00000206
bool
1

Handle case where output varnode is also an input varnode (i.e. contains arg in name)

fix loop_even_odd_nongoal test

Missing test cases - Return one liner failing

The following test cases are commented out in run-tests.py: seq_call_five, seq_call_four, seq_call_one, seq_call_three, seq_call_two, inter_rv, condcall_two. They all have a common theme of having a function with a return 1-liner and the result not being present in the xml files emitted, so the lifting fails.

Implement BOOL_XOR, BOOL_AND, BOOL_OR functionality

No check if types are same when performing comparisons with IntType

fix by setting both operands to larger type

handle case where STORE op has non pointer targets

Function Variables as a stack-struct

As it stands R2 recovers arrays as individual arrays. We want to test 3 options:

• Represent stack variables a single struct with variables within it.
• Represent stack variables as a single memory allocation and byte addressable.
• Represent stack variables as a single memory allocation and word addressable.

Registers allocated twice

Register types are sometimes allocated twice

Handle case where blocks with the same address label are found (causes failure in verfication)

Handle variable used before declared situation

The binary 3D_Image_Toolkit has this problem in the function 'sym.cgc_init_freelist'