undefined | Better HN

0 pointsjchw1y ago0 comments

>For example, personally I went down the path of delinking programs back into object files in my own project.

Wow, that's exactly the approach I wanted to take. However, as you've said, there's basically no tools for this, so it's a bit demoralizing.

0 comments

boricj1y ago

> However, as you've said, there's basically no tools for this, so it's a bit demoralizing.

I wrote a Ghidra extension to do that, you can check it out there: https://github.com/boricj/ghidra-delinker-extension

jchwOP1y ago

Nice! I'm mainly touching Win32 stuff so I suppose it would need quite a lot of adapting (and a COFF implementation) but this is very intriguing, I'll need to dive into this.

boricj1y ago

Depending on what you want to do, most of the pieces might already be there.

I've designed my Ghidra extension so that the object file exporters are decoupled from the relocation analyzers through a generic relocation data model. I've already implemented a relocation synthesizer for 32-bit x86, so writing a COFF object file format exporter should be a fairly self-contained project that doesn't impact the rest of the extension.

A while ago somebody stumbled upon my stuff and asked some questions related to delinking C++ code on Windows, you might find some answers there: https://github.com/boricj/ghidra-delinker-extension/issues/4

Don't hesitate to contact me directly if you want to discuss this stuff more in-depth.

1 more reply

j / k navigate · click thread line to collapse

0 comments

boricj1y ago

> However, as you've said, there's basically no tools for this, so it's a bit demoralizing.

I wrote a Ghidra extension to do that, you can check it out there: https://github.com/boricj/ghidra-delinker-extension

jchwOP1y ago

Nice! I'm mainly touching Win32 stuff so I suppose it would need quite a lot of adapting (and a COFF implementation) but this is very intriguing, I'll need to dive into this.

boricj1y ago

Depending on what you want to do, most of the pieces might already be there.

Don't hesitate to contact me directly if you want to discuss this stuff more in-depth.

1 more reply

j / k navigate · click thread line to collapse