3 ms·
> - Decompiler too stubborn sometimes, ignoring user input (e.g. manually specified types). This is the thing that sticks out the most IMO. IDA decompiler is q
by roblabla 4y ago
> - Decompiler too stubborn sometimes, ignoring user input (e.g. manually specified types).
This is the thing that sticks out the most IMO. IDA decompiler is quite a bit more flexible than Ghidra's. When you assert a type, it will usually not ignore it. It may sometime get a bit lost if you give conflicting types to dependant variables, but otherwise, it's pretty good at this.
One of the annoying bits of ghidra (though it may have improved, it's been around a year since I last used it) is that there's no way to "split" a variable. Sometimes, ghidra will have some code that looks roughly like:
int x;
x = 0;
doSomething(x);
x = 1;
doSomething2(x);
(Obviously, really simplified).
The problem is, sometimes, x needs to be an int for the first function, and a bitflag structure for the second. But Ghidra has no way to say, "hey, from this assignment on, treat `x` as another variable", so you have to either generate a union (ugly) or deal with sending the wrong type (also ugly).
IDA tends to be much better at this. All variables start out as "split" as it can make it (almost in static single assignment form). Then, the user can tell it "Those two variables are actually the same, please treat them as one". I find this flow works really, really well.
- q3k 4y ago> is that there's no way to "split" a variable Right click -> “Split Out As New Variable”, but it seems like this doesn't work for stack reuse yet (just registers, or more generally, simple varnodes). https://github.com/NationalSecurityAgency/ghidra/issues/2573 https://github.com/NationalSecurityAgency/ghidra/issues/2573
- nyanpasu64 4y agoIn my experience, in Ghidra you can Ctrl+L to mark a variable as a different type, but retyping or renaming sometimes fails because it creates a HASH variable which sometimes fails to apply to the decompiler output (instead creating a new variable of the right type but the code still references the old wrong one). Also can I haz offset pointers pretty please? It's not in the last released version I tried, and the last Git version I tried had offset pointers but they didn't affect decompiler output so multiple inheritance and container_of linked lists still came out broken.
- hoosieree 4y agoThis was my biggest frustration when first using Ghidra (granted, I didn't spend much time reading the documentation before diving in). Big thanks to the people responding to your comment with workarounds!