mirror of https://github.com/pwndbg/pwndbg.git
improve ghidra integratino docs (#3171)
parent
33002925f8
commit
46047f6530
|
After Width: | Height: | Size: 140 KiB |
@ -1,27 +1,66 @@
|
|||||||
# Ghidra
|
# Ghidra
|
||||||
|
|
||||||
With the help of [radare2](https://github.com/radareorg/radare2) or [rizin](https://github.com/rizinorg/rizin) it is possible to show the decompiled source code of the ghidra decompiler.
|
Unlike with IDA and Binary Ninja, Ghidra is not considered an "integration provider". You cannot synchronise your Ghidra reverse engineering progress to Pwndbg.
|
||||||
|
You can however integrate Ghidra's decompiler into Pwndbg such that the decompiled version of any function you're in is shown in the Pwndbg context.
|
||||||
|
|
||||||
However, this comes with some prerequisites.
|
??? example "Example Screenshot"
|
||||||
|

|
||||||
|
|
||||||
* First: you have to have installed radare2 or rizin and it must be found by GDB (within path)
|
To do this, we will need the help of [radare2](https://github.com/radareorg/radare2) or [rizin](https://github.com/rizinorg/rizin).
|
||||||
* Second: you have to install the ghidra plugin for radare2
|
|
||||||
[r2ghidra](https://github.com/radareorg/r2ghidra) or install the ghidra plugin for rizin [rz-ghidra](https://github.com/rizinorg/rz-ghidra)
|
|
||||||
* Third: r2pipe has to be installed in the python-context GDB is using (or if you are using rizin, install rzpipe instead)
|
|
||||||
|
|
||||||
The decompiled source be shown as part of the context by adding `ghidra` to `set context-sections`
|
## Setup
|
||||||
or by calling `ctx-ghidra [function]` manually.
|
|
||||||
|
|
||||||
Be warned, the first call to both radare2/r2ghidra and rizin/rz-ghidra are rather slow! Subsequent requests for decompiled
|
=== "rizin"
|
||||||
source will be faster. And it does take up some resources as the radare2/rizin instance is kept by r2pipe/rzpipe
|
1. Install [rizin](https://github.com/rizinorg/rizin). It must be found by the debugger (within path).
|
||||||
to enable faster subsequent analysis.
|
2. Install the Ghidra plugin for rizin: [rz-ghidra](https://github.com/rizinorg/rz-ghidra).
|
||||||
|
3. Install [rzpipe](https://pypi.org/project/rzpipe/) and make sure the python used by the debugger can access it.
|
||||||
|
4. Add `set r2decompiler rizin` to your `~/.gdbinit` after Pwndbg is sourced.
|
||||||
|
|
||||||
With those performance penalties it is reasonable to not have it launch always. Therefore it includes
|
Regarding the third step, if you don't install to your user or system-wide python (but rather a virtual environment), you may add something like this to the beginning of your `~/.gdbinit`:
|
||||||
an option to only start it when required with `set context-ghidra`:
|
```
|
||||||
|
python
|
||||||
|
import sys
|
||||||
|
import os
|
||||||
|
from glob import glob
|
||||||
|
|
||||||
* `set context-ghidra always`: always trigger the ghidra context
|
venv = os.path.expanduser('~/tools/rizin/venv')
|
||||||
* `set context-ghidra never`: never trigger the ghidra context except when called manually
|
site_dir_pattern = os.path.join(venv, 'lib', 'python*/site-packages')
|
||||||
* `set context-ghidra if-no-source`: invoke ghidra if no source code is available
|
site_dirs = glob(site_dir_pattern)
|
||||||
|
sys.path.insert(0, site_dirs[0])
|
||||||
|
import rzpipe
|
||||||
|
end
|
||||||
|
```
|
||||||
|
=== "radare2"
|
||||||
|
1. Install [radare2](https://github.com/radareorg/radare2). It must be found by the debugger (within path).
|
||||||
|
2. Install the Ghidra plugin for radare2: [r2ghidra](https://github.com/radareorg/r2ghidra).
|
||||||
|
3. Install [r2pipe](https://pypi.org/project/r2pipe/) and make sure the python used by the debugger can access it.
|
||||||
|
4. Add `set r2decompiler radare2` to your `~/.gdbinit` after Pwndbg is sourced.
|
||||||
|
|
||||||
|
Regarding the third step, if you don't install to your user or system-wide python (but rather a virtual environment), you may add something like this to the beginning of your `~/.gdbinit`:
|
||||||
|
```
|
||||||
|
python
|
||||||
|
import sys
|
||||||
|
import os
|
||||||
|
from glob import glob
|
||||||
|
|
||||||
|
venv = os.path.expanduser('~/tools/radare2/venv')
|
||||||
|
site_dir_pattern = os.path.join(venv, 'lib', 'python*/site-packages')
|
||||||
|
site_dirs = glob(site_dir_pattern)
|
||||||
|
sys.path.insert(0, site_dirs[0])
|
||||||
|
import r2pipe
|
||||||
|
end
|
||||||
|
```
|
||||||
|
|
||||||
|
## Usage
|
||||||
|
|
||||||
|
Append `set context-ghidra if-no-source` to your `~/.gdbinit`. You should be able to see the
|
||||||
|
`[ GHIDRA DECOMPILE ]` context now right below your disassembly. If you want to temporarily enable/disable
|
||||||
|
it or move around the context sections, see [context-ghidra](../../configuration/config.md#context-ghidra)
|
||||||
|
and [contextoutput](../../commands/context/contextoutput.md).
|
||||||
|
|
||||||
|
Be warned, the first call to both radare2/r2ghidra and rizin/rz-ghidra are rather slow!
|
||||||
|
Subsequent requests for decompiled source will be faster. And it does take up some resources
|
||||||
|
as the radare2/rizin instance is kept by r2pipe/rzpipe to enable faster subsequent analysis.
|
||||||
|
|
||||||
Remark: the plugin tries to guess the correct current line and mark it with "-->", but it might
|
Remark: the plugin tries to guess the correct current line and mark it with "-->", but it might
|
||||||
get it wrong.
|
get it wrong.
|
||||||
|
|||||||
Loading…
Reference in new issue