You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on May 23, 2023. It is now read-only.
By "only arguments" I mean the feature of being able to at least have syscall calls in the decompiler show arguments. Ghidra doesn't let you re-define that syscall function (I assume it's a special kind of func defined somewhere), I'm not sure how to go about it from the GUI. But I assume that the extension is able to, somehow?
I'd be useful to re-define it as syscall(void *arg1, void *arg2, void *arg3) etc to at least aid with capturing arguments passed into it.
By "syscall support" I mean the more fully-fledged feature of having a hardcoded list of the syscalls in the extension (ID -> syscall proto), and on each syscall instruction the right one recognized from the value loaded in v1 and communicated with the decompiler to show it as the correct function (name + signature).
The text was updated successfully, but these errors were encountered:
VelocityRa
changed the title
Syscall support (or only arguments)
[Feature Request] Syscall support (or only arguments)
Sep 19, 2020
I think this should be possible by making the syscall instruction a call and then utilizing call fixup. I know there is a script in the ghidra repo to do this for linux syscalls.
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
By "only arguments" I mean the feature of being able to at least have
syscall
calls in the decompiler show arguments. Ghidra doesn't let you re-define thatsyscall
function (I assume it's a special kind of func defined somewhere), I'm not sure how to go about it from the GUI. But I assume that the extension is able to, somehow?I'd be useful to re-define it as
syscall(void *arg1, void *arg2, void *arg3)
etc to at least aid with capturing arguments passed into it.By "syscall support" I mean the more fully-fledged feature of having a hardcoded list of the syscalls in the extension (ID -> syscall proto), and on each
syscall
instruction the right one recognized from the value loaded inv1
and communicated with the decompiler to show it as the correct function (name + signature).The text was updated successfully, but these errors were encountered: