10.0 BETA Release
| Version | Link | SHA-256 | Notes | Date |
|---|---|---|---|---|
| 10.0beta | ghidra_10.0-BETA_PUBLIC_20210521.zip | f549dfccd0f106f9befb0b5afb7f2f86050356631b29bc9dd15d7f0333acbc7e |
Notes | 2021-05-21 |
Ghidra 10.0 BETA - What's New
Projected Ghidra 10.0 Final Release
We anticipate pushing out the final Ghidra 10.0 release sometime towards mid to end of June 2021. We appreciate any feedback you can provide, especially in any new feature areas such as the debugger, and thanks for all your contributions and feedback you've already given!
Debugger
With the release of Ghidra 10.0-BETA, we are excited to officially introduce our new Debugger. It is still geared primarily for user-mode application debugging on Linux and Windows; however, you may find its components usable in other scenarios. To get started, please Ghidra Functionality / Debugger / Getting Started in the Help. For most, it is as easy as importing your program, opening it with the Debugger tool, and clicking the "bug" icon in the main toolbar. The Debugger's features include:
- Debugging user-mode Windows applications on x64 hosts via dbgeng.dll/WinDbg (including 32-bit x86 applications via WoW64)
- Debugging user-mode Linux applicaitons on amd64/x86_64 hosts via GDB (including 32-bit i686/x86 applications)
- Quick launch to locally debug the current program
- Recording of observations from a live debug session into a Ghidra Trace database
- NOTE: We do not currently plan to support Trace database upgrades in future releases
- Sharing of Trace databases via a Ghidra server
- Time-travel(-like) exploration and annotation of Trace databases.
- Includes capture of memory and register values over time
- Utilizes p-code emulation to interpolate and extrapolate ahead of the target
- Export a Trace's memory / listing (at a given time) to ASCII, Binary, HTML, Intel Hex, and XML
New Views:
- Targets list for managing platform debugger connections
- Interpreter Panel for accessing the platform debugger's command-line interface
- Console Panel for viewing log messages and resolving problems
- Objects Tree for accessing and commanding the platform debugger via a graphical user interface
Includes Resume, Interrupt, Step, Launch, etc.- Dynamic Listing for viewing and annotating memory in a Trace
- Breakpoint management:
- Breakpoints viewer showing breakpoints from all live sessions, as well as breakpoints bookmarked in Program databases
- Dynamic Listing actions permitting placement, toggling, and removal of breakpoints at the current address
- (Static) Listing actions permitting the bookmarking, placement, toggling, and removal of breakpoints
- Registers Table for viewing and annotating values in a Trace and/or modifying values of the target
- Watches Table for evaluating SLEIGH expressions on the Trace or target machine state
NOTE: Dependent registers and memory are captured to the Trace, if recording from a live target- Stack / Frame Table for navigating frame contexts
- Threads Timeline for listng threads and for navigating thread and time contexts
- Modules Table for viewing modules and sections, and for mapping live Trace addresses to static Program database addresses
- P-code Stepper/Emulator for debugging SLEIGH language specifications in-situ
- Memory/Time plotter for viewing trace events
New APIs:
- Trace database (backs our time-travel features and populates our machine-state UIs)
- Platform debugger model (our abstraction of platform debuggers into a reflexive API)
- Abstract SLEIGH / p-code execution (backs our emulation, trace interpolation, and SLEIGH watches)
Nascent support for the following:
- Other modes, including kernel-mode, and remote debugging, as supported by the platform debugger.
WARNING: Ghidra's Trace recorder may not know how to cope with the environment and objects presented, causing it to behave poorly, e.g., it may greedily record things, exhaust resources, crash Ghidra, crash your debugger, crash your target, etc.- Connection to WinDbg Preview (via dbgmodel.dll) on Windows
- Connection to a JVM or DalvikVM via JDI (JDWP)
- Support for tracing the following architectures via GDB: arm, m68k, mips, powerpc (depending on versions and variants)
- Support for tracing the following architectures via JDI: Java, Dalvik (depending on versions and variants)
User-defined Compiler Specification Extensions
Ghidra 10.0 adds support for user-defined extensions to the compiler specification assigned to a specific Program. In particular, users can now define their own:
- Calling Conventions - which inform analyis and decompilation how parameters are passed between functions,
- Call-Fixups - which substitute behavior for specific CALLs when analyzing a function that makes them, and
- Callother-Fixups - which substitute behavior for certain Instructions when analyzing a function that contains them.
Prior releases only provided compiler specifications statically via .cspec files in the distribution. The new extensions are stored as part of the Program and can be added or adjusted dynamically as users build up their understanding. Extensions can be added from the Specification Extensions tab under the Options dialog for the Program.
Prototype Class Recovery From RTTI
A new prototype script RecoverClassesFromRTTIScript which recovers class information using RTTI structures has been added. The script recovers class hierarchy, inheritance types, constructors and destructors, class data types, and more. If available, pdb information is used to help fill in class structures with known names and types for class member data. If PDB is unavailable, the decompiler structure recovery is utilized to populate class data structure members.
NOTE: As this is a prototype script, the location, names, layout of data types, and default virtual function names created by this script are likely to change in the future once an official design for Object Oriented representation is determined.
NOTE: Windows class recovery is fairly complete and tested, however GCC class recovery is still in early development. GCC class data types have not been recovered yet but if the program has DWARF, there will be some amount of data recovered by the DWARF analyzer in the DWARF data folder.
NOTE: For best results, run this script on freshly imported and analyzed programs. No testing has been done on programs previously imported with pre-existing user mark-up.
PDB Symbol Server
Managing and applying PDB files has a much improved GUI, including support for multiple symbol server locations.
Saved Analysis Options Configuration
Analysis options configurations can be saved by name and quickly changed using a new feature in the Analysis configuration menu. The last used named configuration will be used as the default option the next time a program is analyzed even after exiting Ghidra. This can be useful to disable one or more options, such as Stack Analysis, if the analyzer is providing poor results or the analysis is not desired for a type of binary you will be working with. For example some analysis options should be turned off by default for all suspect malware binaries on the first pass to avoid issues with some types of obfuscation.
Graphs
Data types can get complicated and might have many references to other data structures, either by declaring them as a field or as a pointer at another data type. A general graph of data type relationships from the Data Type manager has been added. In addition defined data structures in memory can be graphed by following all references to other defined data or code using the Graph->Data menu.
A new favored edge and associated layout has been added for hierarchical graphs. This edge can help closely align graph nodes that should be arranged more closely to a neighboring node, for example the node from a fall-thru edge should be arranged closer than from a branching edge.
Structure/Union Changes
A significant refactor of the Composite datatype interfaces and internals has been completed which affects Structures and Unions. The changes are intended to provide a more understandable API and allow an alignment to be specified for non-packed composites (aka, composites with internal alignment disabled).
Editor Changes
Previously, the editor contained an Align checkbox which determined if packing should be performed or not. This checkbox has been replaced by a checkbox adjacent to the pack choices (i.e., enable/disable packing). Generally, this setting would be "not-checked" (i.e., disabled) when reverse-engineering the content of a structure so that components may be placed at specific offsets. Only when there is a complete understanding of all components, as conveyed by a source header file, should this be enabled with the appropriate pack and align settings specified. In addition, when pack is enabled it is important that the component datatypes eimit the correct alignment to ensure proper placement during packing.
The align setting may know be used when packing is disabled with the composite adopting the specified alignment. The default alignment for a non-packed composite is 1 which is consistent with the current behavior in Ghidra 9.x.
Composite API Changes
The various pack and align methods of the Composite (i.e., Structure and Union) API have been changed extensively. Since these changes were primarly intended to "cleanup" the interface it was decided not eliminate (not depricate) the old methods. It was felt leaving them in place would only confuse matters when attempting to understand the new interface. It is also believed that most uses of the API generally do not utilize the pack and align settings which should minimize the impact to existing user code.
Gradle
The build infrastructure has been moved to version gradle 6.8 or later. If you wish to build Ghidra, you will need to move to at least gradle 6.8.x
New Processors
We are working on .NET/CIL that may make it into the final 10.0 release, but most likely into 10.1
Binary Exporter
New exporters that write programs imported with the PE and ELF loaders back to their original file layout have been added. Any file-backed bytes that were modified by the user in the program database will be reflected in the written file. Bytes that are part of the import process such as relocations or modified Memory Maps are not currently handled.
Bug Fixes and Enhancements
Numerous other bug fixes and improvements are fully listed below.