Skip to content

Ghidra plugin that adds a window showing the high P-code for the current function.

License

Notifications You must be signed in to change notification settings

twevs/HighPCodeViewer

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

High P-Code Viewer

This is a Ghidra plugin that adds a window showing the high P-code for the current function; when a pseudo-C statement is clicked on in the Decompile window, the corresponding high P-code is highlighted and scrolled into focus:

HighPCodeViewer

What is high P-code and why can it be useful?

High P-code is Ghidra's final intermediate representation of the decompiled binary, coming after data and control flow analysis and before the generation of pseudo-C code:

image

As such, it is the highest level at which pattern detection can conveniently be performed programmatically and therefore well suited for scripting detection of patterns in decompiler output. For a more in-depth explanation and illustration, read this article.

Installation

  1. Download the release targeting your version of Ghidra.
  2. In the main Ghidra window (not the CodeBrowser), click on File > Install Extensions..., then Add extension, and select the downloaded ZIP file.
  3. If, after restarting, you do not see High P-Code Viewer in the CodeBrowser's Window menu, click on File > Configure... > [Miscellaneous] Configure and make sure HighPCodeViewerPlugin is enabled.

Once displayed, the viewer can be docked with the console for greater convenience.

Building

  1. In Eclipse, install the GhidraDev extension from [Ghidra root folder]/Extensions/Eclipse/GhidraDev. This will add a GhidraDev element to the menu bar.
  2. Add your Ghidra root folder to GhidraDev > Preferences > Ghidra Installations....
  3. Clone this repository and import it via File > Import... > Existing Projects into Workspace.
  4. Right-click on the project name and in the context menu, click on GhidraDev > Link Ghidra...; the Run As... and Debug As... options should now enable you to launch Ghidra with the built plugin. (Note that a conflict is possible if you have already installed it from within Ghidra.)
  5. You can export the plugin using the aforementioned context menu, via GhidraDev > Export > Ghidra Module Extension....

About

Ghidra plugin that adds a window showing the high P-code for the current function.

Resources

License

Stars

Watchers

Forks

Packages

No packages published