Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> However, as you've said, there's basically no tools for this, so it's a bit demoralizing.

I wrote a Ghidra extension to do that, you can check it out there: https://github.com/boricj/ghidra-delinker-extension



Nice! I'm mainly touching Win32 stuff so I suppose it would need quite a lot of adapting (and a COFF implementation) but this is very intriguing, I'll need to dive into this.


Depending on what you want to do, most of the pieces might already be there.

I've designed my Ghidra extension so that the object file exporters are decoupled from the relocation analyzers through a generic relocation data model. I've already implemented a relocation synthesizer for 32-bit x86, so writing a COFF object file format exporter should be a fairly self-contained project that doesn't impact the rest of the extension.

A while ago somebody stumbled upon my stuff and asked some questions related to delinking C++ code on Windows, you might find some answers there: https://github.com/boricj/ghidra-delinker-extension/issues/4

Don't hesitate to contact me directly if you want to discuss this stuff more in-depth.


Thanks for extending the offer! I am a bit busy but I really appreciate all of the information. I've got plenty of new things to dig into now, I'll have to seriously set aside some time to take another look, this could seriously help me with some of my reversing projects. I'm willing to put in tons of manual effort to bridge the gap, and it feels like if I could leverage this it could act as quite a force multiplier.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: