3 ms·
You can find it here: https://github.com/boricj/ghidra-delinker-extension https://github.com/boricj/ghidra-delinker-extension I've demonstrated a bunch of use-
by boricj 2y ago
You can find it here: https://github.com/boricj/ghidra-delinker-extension https://github.com/boricj/ghidra-delinker-extension
I've demonstrated a bunch of use-cases on my blog, ranging from porting software to pervasive binary patching and pilfering application code into libraries, all done on artifacts without source code available.
I have one user in particular who successfully used it on a huge (7 MiB) program in a span of a couple of weeks, most of them spent fixing bugs on my end. They then proceeded to crank up the insanity to 11 by splitting that link-time optimized artifact into pieces and swapping parts out willy-nilly. That is theoretically impossible because LTO turns the entire program into a single translation unit subject to inter-procedure optimizations, so functions will exhibit nonstandard calling conventions you can't replicate with freshly built source code, but I guess anything's possible when you binary patch __usercall into MSVC.
I should get back to it once work is less hectic. Delinking is an exquisitely intricate puzzle to solve algorithmically and I've managed to make that esoteric but powerful reverse-engineering technique not only scalable to megabytes worth of code, but also within reach of everyday reverse-engineers.
- PerryStyle 2y agoWow this one of the most interesting things I’ve come across. Definitely could learn a lot by tinkering with this. Thanks!
- dgellow 2y agoThat’s insanely impressive. Your blog is a gold mine, thank you for sharing
- boricj 2y agoI've been meaning to write more articles and not just about delinking or reverse-engineering. I've been hoarding some lower-grade cursed stuff, like a git proxy/cache written in a hundred lines of bash, or a Jenkins plugin that exposes a Debian source repository as a SCM provider and enables one to trivially create a Debian package build server with it (complete with dependency management). Guess I'd better unbrick my Chromebook first. I still don't know how changing its battery managed to bork an unmodded, non-developer mode Chromebook so thoroughly that the official recovery claims it doesn't know what model it is ("no defined device identities matched this device.").