boricj

17 ms·

211.
by boricj 2y ago
For context, my tooling is a Ghidra extension, so there's all the usual Ghidra stuff that applies here. Indeed, it depends what the API boundary is for the selection to be exported. If it's the whole program without some well-know
212.
by boricj 2y ago
Well, it's one of those things where you know the rules so well that you can break them, but my Ghidra extension is indeed on GitHub: https://github.com/boricj/ghidra-delinker-extension Unless you meant copying so
213.
by boricj 2y ago
It's very useful if you don't have access to the original source code. You can do things like decompiling a program piece by piece like the Ship of Theseus. The linker will mend both original and rewritten parts together into a wo
214.
by boricj 2y ago
> You can't use individual functions without knowing the data structures they operate on, and info about data structures is usually not present in the final binary. It turns out you can. Linkers do not care about types or data struc
215.
by boricj 2y ago
No, it's actually ripping out bits from an executable and turning them into relocatable object files. The technical term I've come up with for this is delinking, although the decompilation community calls it binary splitting. Putt
216.
by boricj 2y ago
Artisans can make objects out of raw material, but they can also take apart objects to reclaim raw material. Software engineering tends to only ever do the former, because traditional toolchains are a one-way street from source code to asse
217.
by boricj 2y ago
Same, although I recommend not relying on GitHub pages for generating the site due to the age of the gems available on it. I've initially kept my blog compatible with it even though I'm serving it from my NAS, but I ended up ditch
218.
by boricj 2y ago
Even if there is a stable ABI driver to the point where upstream is oblivious of any Rust stuff going on inside drivers, that doesn't solve the problem of fragmentation amongst forks (assuming upstreaming to Illumos is a goal).
219.
by boricj 2y ago
I was mostly aware of https://llvm.org/docs/PDB/index.html , which paints a rather complex high-level picture. At any rate, while my extension has exporters for both ELF and COFF I'm personally using only the
220.
by boricj 2y ago
I've developed a Ghidra extension that exports object files. I've considered generating debugging symbols in order to improve the debugging experience when reusing these object files in new programs, but I keep postponing that fea
221.
by boricj 2y ago
From what I've seen, perception of time depends a lot on how much time one has experienced. Five years is a quarter of the time experienced by a 20 year old, but not even a tenth for a 60 year old.
222.
by boricj 2y ago
> Trying to extend the input handling that never had this handling, unless the original is 50% NOPs, mean writing a new implementation at the end, and having the old implementation jump out and back. While traditional in-place binary pat
223.
by boricj 2y ago
Regardless of difficulty, reverse-engineering is time-consuming. The author achieved their stated objective with the least amount of effort applied, which is how binary patching (at least the traditional kind) tends to go.
224.
by boricj 2y ago
Definitely not. I'm reverse-engineering Tenchu: Stealth Assassins and the original Japanese release's game code is written entirely in C as far as I can tell. It does use the Psy-Q SDK which contains assembly, but it's not
225.
by boricj 2y ago
From the linked forum thread, 18 months later ( https://forum.vmssoftware.com/viewtopic.php?t=183#p17812 ): > The Atom project as shown in the YouTube video is not a VMS Software Inc. product. As Andrew pointed out using O
226.
by boricj 2y ago
xv6 is now targeting RISC-V and has displaced MINIX as a better pedagogical tool in my opinion. MINIX is dead for multiple reasons, including technical ones [1]. Simply put, its design and implementation are no longer fit for purpose on mod
227.
by boricj 2y ago
> Will this also work without painstakingly reversing things in the binary, say in the case of a giant game executable? You can get away with a Ghidra database that isn't accurate, as long as you know what you're doing. Basic
228.
by boricj 2y ago
The boundaries aren't important during delinking, as long as you do not cut across a variable or function. To the linker, sections are just arrays of bytes. It doesn't care what's inside those, all it has to do is lay them ou
229.
by boricj 2y ago
> Would it be possible to export basically the entire program at once and then slice off individual functions one by one? Yes. The exporters can handle whatever meaningful address selection you can throw at them, including multiple disjo
230.
by boricj 2y ago
During delinking we only really care about relocation spots, the actual algorithms of the program are mostly irrelevant. Assuming it doesn't reference any other global data and only contains relative jumps and branches, computeOffset(
231.
by boricj 2y ago
Thanks! I should get back to this project one of these days. I did one version tracking session too many in a row and had to take a break, plus that delinking side-quest keeps snowballing out of control.
232.
by boricj 2y ago
To keep things short, object files are made of three parts: relocatable section bytes, relocation tables and a symbol table. When a linker is invoked to generate an executable from a bunch of object files, it will lay out their sections in
233.
by boricj 2y ago
There are links to various case studies on my blog inside the README of the repository. https://github.com/boricj/ghidra-delinker-extension/blob/mas...
234.
by boricj 2y ago
> How much work is it to figure out which sections of the executable to export? As long as you do not cut across a variable or a function, you can export pretty much however you want, you don't have to follow the original object fil
235.
by boricj 2y ago
> So is this a completely fool-proof process? That's... complicated to answer. My analyzers rely on an accurate Ghidra database, at least for the parts you want to export. While I've put a fair amount of effort into logging the
236.
by boricj 2y ago
> I'm actually a pretty big n00b when it comes to Ghidra and haven't even really figured out a good way to select the ranges for delinking from a large binary. One way to keep track of things to delink is to use folders and fra
237.
by boricj 2y ago
Tangentially, I've considered generating debugging symbols for the exported object files, based on the contents of the Ghidra database, in order to improve the debugging experience when using them. I haven't implemented that featu
238.
by boricj 2y ago
While objcopy can do many things, it can't undo the work of the linker. If relocations aren't unapplied and a new relocation table generated, these spots inside the new object file will reference the original program's addres
239.
Show HN: A Ghidra extension for exporting parts of a program as object files(github.com)
304 points by boricj 2y ago|36 comments
240.
by boricj 2y ago
SBOMs can't flag vulnerable dependencies until after those are publicly known. Traceability is useful when mitigating a crisis, but it won't prevent one.

More ›