This is a Ghidra plugin that adds a window showing the high P-code for the current function; when a pseudo-C statement is clicked on in the Decompile window, the corresponding high P-code is highlighted and scrolled into focus:
High P-code is Ghidra's final intermediate representation of the decompiled binary, coming after data and control flow analysis and before the generation of pseudo-C code:
As such, it is the highest level at which pattern detection can conveniently be performed programmatically and therefore well suited for scripting detection of patterns in decompiler output. For a more in-depth explanation and illustration, read this article.
- Download the release targeting your version of Ghidra.
- In the main Ghidra window (not the CodeBrowser), click on
File > Install Extensions...
, thenAdd extension
, and select the downloaded ZIP file. - If, after restarting, you do not see
High P-Code Viewer
in the CodeBrowser'sWindow
menu, click onFile > Configure... > [Miscellaneous] Configure
and make sureHighPCodeViewerPlugin
is enabled.
Once displayed, the viewer can be docked with the console for greater convenience.
- In Eclipse, install the GhidraDev extension from
[Ghidra root folder]/Extensions/Eclipse/GhidraDev
. This will add aGhidraDev
element to the menu bar. - Add your Ghidra root folder to
GhidraDev > Preferences > Ghidra Installations...
. - Clone this repository and import it via
File > Import... > Existing Projects into Workspace
. - Right-click on the project name and in the context menu, click on
GhidraDev > Link Ghidra...
; theRun As...
andDebug As...
options should now enable you to launch Ghidra with the built plugin. (Note that a conflict is possible if you have already installed it from within Ghidra.) - You can export the plugin using the aforementioned context menu, via
GhidraDev > Export > Ghidra Module Extension...
.