4 ms·
> However, as you've said, there's basically no tools for this, so it's a bit demoralizing. I wrote a Ghidra extension to do that, you can check it out there:
by boricj 2y ago
> However, as you've said, there's basically no tools for this, so it's a bit demoralizing.
I wrote a Ghidra extension to do that, you can check it out there: https://github.com/boricj/ghidra-delinker-extension https://github.com/boricj/ghidra-delinker-extension
- jchw 2y agoNice! I'm mainly touching Win32 stuff so I suppose it would need quite a lot of adapting (and a COFF implementation) but this is very intriguing, I'll need to dive into this.
- boricj 2y agoDepending on what you want to do, most of the pieces might already be there. I've designed my Ghidra extension so that the object file exporters are decoupled from the relocation analyzers through a generic relocation data model. I've already implemented a relocation synthesizer for 32-bit x86, so writing a COFF object file format exporter should be a fairly self-contained project that doesn't impact the rest of the extension. A while ago somebody stumbled upon my stuff and asked some questions related to delinking C++ code on Windows, you might find some answers there: https://github.com/boricj/ghidra-delinker-extension/issues/4 https://github.com/boricj/ghidra-delinker-extension/issues/4 Don't hesitate to contact me directly if you want to discuss this stuff more in-depth.
- jchw 2y agoThanks for extending the offer! I am a bit busy but I really appreciate all of the information. I've got plenty of new things to dig into now, I'll have to seriously set aside some time to take another look, this could seriously help me with some of my reversing projects. I'm willing to put in tons of manual effort to bridge the gap, and it feels like if I could leverage this it could act as quite a force multiplier.