Skip to content
This repository has been archived by the owner on May 23, 2023. It is now read-only.

[Feature Request] Syscall support (or only arguments) #34

Open
VelocityRa opened this issue Sep 19, 2020 · 2 comments
Open

[Feature Request] Syscall support (or only arguments) #34

VelocityRa opened this issue Sep 19, 2020 · 2 comments

Comments

@VelocityRa
Copy link
Contributor

VelocityRa commented Sep 19, 2020

  • By "only arguments" I mean the feature of being able to at least have syscall calls in the decompiler show arguments. Ghidra doesn't let you re-define that syscall function (I assume it's a special kind of func defined somewhere), I'm not sure how to go about it from the GUI. But I assume that the extension is able to, somehow?
    I'd be useful to re-define it as syscall(void *arg1, void *arg2, void *arg3) etc to at least aid with capturing arguments passed into it.

  • By "syscall support" I mean the more fully-fledged feature of having a hardcoded list of the syscalls in the extension (ID -> syscall proto), and on each syscall instruction the right one recognized from the value loaded in v1 and communicated with the decompiler to show it as the correct function (name + signature).

@VelocityRa VelocityRa changed the title Syscall support (or only arguments) [Feature Request] Syscall support (or only arguments) Sep 19, 2020
@VelocityRa
Copy link
Contributor Author

Note:
I'm aware there's already pattern matching for the syscalls, but

  • That's only for the wrappers, it does not apply to stray syscalls that aren't in these specific wrappers
  • There are no syscall function signatures, just the names

@astrelsky
Copy link
Contributor

astrelsky commented Oct 6, 2020

I think this should be possible by making the syscall instruction a call and then utilizing call fixup. I know there is a script in the ghidra repo to do this for linux syscalls.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants