top | item 47040052

(no title)

boricj | 13 days ago

Might as well plug in my own extension: https://github.com/boricj/ghidra-delinker-extension

It's a relocatable object file exporter that supports x86/MIPS and ELF/COFF. In other words, it can delink any program selection and you can reuse the bits for various use-cases, including making new programs Mad Max-style.

It carved itself a niche in the Windows decompilation community, used alongside objdiff or decomp.me.

discuss

order

montymintypie|13 days ago

Easily one of the coolest RE projects out there, I've always looked on in awe.

> The relocation table synthesizer analyzer relies on a fully populated Ghidra database (with correctly declared symbols, data types and references) in order to work

It's a shame that this requirement exists (I am well aware that it's a functional necessity), because all the stuff I want to relink is far too big to make a full db!

boricj|13 days ago

You only need a full DB if you want to fully delink your artifact. You can just clean up the subset you're interested in exporting (the fully populated disclaimer is just there because there's a lot you can get away with, as long as you know precisely what you are doing).

Even then, a full DB is quite achievable, even on large projects. The biggest public project using ghidra-delinker-extension out there is the FUEL decompilation: https://github.com/widberg/FUELDecompilation

The executable is 7 MiB, has over 30,000 functions and has more than 250,000 relocations spots. The user made the game relocatable in six weeks (with four of them debugging issues with my extension). They then managed to replace code in spite of the fact that the artifact was built with LTO by binary patching __usercall into MSVC.

There's a write-up about all of that that is well worth a read: https://github.com/widberg/fmtk/wiki/Decompilation

I've also had one user manage to fully delink the original Halo on the Xbox in one week. To be fair, they were completely nerd-sniped and worked non-stop on it, but it still counts.

evmar|13 days ago

Where can I learn more about the Windows decompilation community? (This is an area I kind of work in, and I am interested in participating!)

boricj|13 days ago

Most of my known userbase hangs out in the decomp.me Discord server. Each project also tends to have its own dedicated Discord server.

The Windows decompilation community is far more fragmented than the console one, as it hasn't coalesced around a common set of tools like splat or decomp-toolkit.

WalterGR|13 days ago

What is Mad Max-style?

barfiure|13 days ago

I imagine PIE chunks that you can kludge into other programs to Frankenstein implementations? Kind of like how mad max cars are made of bits and pieces bolted together