Ghidra loader scripts

[czietz]

Inspired by sarnau's recent post, I worked on adding support for Atari TOS programs and ROM images to the open-source reverse engineering framework (i.e. powerful disassembler and more) Ghidra. As it turns out, a full-fledged, "first-class" file format support would need to be written in Java and Ghidra would need to be recompiled. (Unlike with Radare2 and IDA, it does not seem to be possible to add a file format to Ghidra in a scripting language.)

However, one can use the powerful scripting (Python or Java) API of Ghidra to import the files using a generic binary file format importer and afterwards modifying the result to create TEXT, DATA, BSS sections (in case of a program) or to set the address range correctly (in case of a TOS ROM).

You can find my scripts at https://github.com/czietz/ghidraScripts_for_Atari. Note that I'm fairly new to Ghidra and the scripts build on what I learned about its API in a few hours from the sample scripts and documentation. Most likely, I'm not doing everything the optimal way.

[ggn]

Pretty good . I also have a strong aversion to python so I'd probably never get this done, so it's good that someone else did it!

[dhedberg]

Thanks! I think I'll have to have a go with Ghidra!
Thanks also for the link to page with the quick overview. Too bad Ghidra is written in Java... and just as GGN I'm not a fan of Python either.

[czietz]

Updates:
- I have added symbol table support to the PRG importer.
- I have added a script to load a.out-format object files, including symbols, as created by gcc.

[czietz]

Update: Started function ID database for MiNTLib.

A nice feature of Ghidra is Function ID. Quoting the documentation: »Function ID is an analyzer that performs function identification analysis on a program. [...] Function ID is suitable for identifying statically linked libraries [...]. Because of the hashing strategy, functions remain identifiable even if the library is relocated during linking.«

I added a database for MiNTLib as provided by Vincent Rivière's m68k-atari-mint cross-tools. Currently it only contains the standard C library for the 68000 target. mintlib.fidbf needs to be copied to Ghidra/Features/FunctionID/data. When loading a program built using this MiNTLib version, Ghidra can be told via Analysis -> One Shot -> Function ID to identify any standard library functions, greatly simplifying analysis of unknown programs.

E.g. you can see in this screenshot how it has auto-identified a call to printf:

functionid.png

[mfro]

...I added a database for MiNTLib as provided by Vincent Rivière's m68k-atari-mint cross-tools. Currently it only contains the standard C library for the 68000 target. mintlib.fidbf needs to be copied to Ghidra/Features/FunctionID/data. When loading a program built using this MiNTLib version, Ghidra can be told via Analysis -> One Shot -> Function ID to identify any standard library functions, greatly simplifying analysis of unknown programs.

So if you want to trick the NSA, you better write your malicious library following this patterns doing something completely different inside?