ghidra decompiler

[srvaldez]

saw this at the Purebasic forum, the ghidra reverse engineering tool is free https://ghidra-sre.org
I tested this simple FB program, compiling with -gen gcc

Code: Select all

print "hello world"

the decompiled C code

Code: Select all

undefined8 entry(undefined8 uParm1,undefined8 uParm2)

{
  undefined8 uVar1;
  
  _fb_Init(uParm1,uParm2,0);
  uVar1 = _fb_StrAllocTempDescZEx("hello world",0xb);
  _fb_PrintString(0,uVar1,1);
  _fb_End(0);
  return 0;
}

my steps were as follows
1: create a new project
2: import the executable
3: runTool codebrowser
4: open the exe
5: analyze
6: click on exports
7: click on function entry

[dodicat]

Kind of reminds me of the dos command for .a files (adjusted in some way for .exe files)
Instead of compiling hello.bas to .exe, compile with -lib switch to get libhello.a
Then use this little sub

Code: Select all

sub look(libname as string)
    shell "nm -A "+ libname+" | more"
end sub



look "libhello.a"

print
 
sleep
  

I think Linux might also do executables but have not tested.
https://www.thegeekstuff.com/2012/03/linux-nm-command/

[dodicat]

Looks like the shell nm command will work on .exe files if they are not stripped.
(Freebasic strips the .exe)
But plain gcc (as in Dev-c++), doesn't strip the .exe.
I tested on pascal .exe files, but
nm: hello.exe: File format not recognized
is given.

Code: Select all

 
function pipeout(byval s as string="") byref as string
    var f=freefile
    dim as string tmp
    Open Pipe s For Input As #f 
     s=""
    Do Until EOF(f)
    Line Input #f,tmp
    s+=tmp+chr(10)
    Loop
    close #f
    return s
    end function

function look(filename as string,switch as string="") as string
    return pipeout( "nm  "+ " "+switch+" "+filename)
end function



var info= look ("hello.exe")  'compiled by a c compiler, unstripped .exe

print info
 
sleep

'============================

/'    SWITCHES
-A 
prefixes each line with the file name or archive member name.

-a 
displays all symbols, including line number entries on systems which support them.

-e 
displays only global (external) and static symbols.

-f 
displays full output. This is the default, since this implementation does not suppress any output.

-g 
displays only global symbols.

-n 
is equivalent to -v.

-o 
displays output in octal (same as -t o).

-P 
displays output in a portable POSIX-compliant format, with blanks separating the output fields. If you specified -A and file is not a library, the format is

file: name type value size
If you specified -A and file is a library, the format is

file[object_file]: name type value size
where object_file is the object file in the library which contains the symbol being described. If you did not specify -A, the format is

name type value size
If you did not also specify the -t option, nm displays value and size in hexadecimal.

If you did not specify -A and the command line contains more than one file, or file is a library, nm displays a line preceding the list of symbols for each specified file or each object file in a specified library. If file is a library, this line has the following format:

file[object_file]:
If file is not a library, the format is simply

file:
-p 
does not sort output.

-r 
reverses sort order.

-s 
includes symbol size for each symbol.

-t format 
defines the numeric value formatting base. The format shall be one of d, o, or x, for decimal, octal, or hexadecimal, respectively. If this option is not used, numbers are displayed in decimal.

-u 
displays only undefined symbols.

-v 
sorts output by value.

-x 
displays information in hexadecimal (same as -t x).
'/

 

So ghidra doesn't seem to need the symbols (if stripped)

[marcov]

I tested on pascal .exe files

Here nm works fine on pascal files, very long lists of mangled symbols like below. Might depend on bittiness (though I test 32-bit here), compiler, and used nm (cygwin vs mingw)

I used the cygwin one.

0047d9c0 T AASMTAI$_$TAI_CPU_ABSTRACT_$__$$_LOADREG$LONGINT$TREGISTER

[dodicat]

OK marcov
I compiled a project1.lpr with Lazarus and I get (for a writeln('hello world'))

00000000 A _$dll$kernel32$CreateDirectoryW
00000000 A _$dll$kernel32$DeleteFileW
00000000 A _$dll$kernel32$FreeLibrary
00000000 A _$dll$kernel32$GetCurrentDirectoryW
00000000 A _$dll$kernel32$GetFileAttributesW
00000000 A _$dll$kernel32$GetFullPathNameW
00000000 A _$dll$kernel32$GetLargestConsoleWindowSize
00000000 A _$dll$kernel32$GetSystemInfo
00000000 A _$dll$kernel32$GetTickCount
00000000 A _$dll$kernel32$GlobalAlloc

...
and many more
But when compiled with dev-pas ide I get File format not recognized
Lazarus gave me two extra folders (Backup and lib) and the files
.exe, .lpi, .lps.
which I don't really want cluttering up everything, but that's another issue.

[marcov]

But when compiled with dev-pas ide I get File format not recognized

dev-pas with what? It might be stripping (IIRC some ancient FPC's came with a strip that would not entirely strip in a compatible way).

Lazarus gave me two extra folders (Backup and lib) and the files
.exe, .lpi, .lps.
which I don't really want cluttering up everything, but that's another issue.

lpi/lps, ok. lpi is like Delphi-ancient's project.cfg or Delphi-not-ancient's .dproj. .lps is some cache for symbols. Afaik it can be turned off, but I never tried (couldn't be bothered).

The directories I don't recognize. Must be something new (and I use older lazarus config files)

[dodicat]

I have the latest 3.0.4 freepascal, 32 and 64 bits.
The .lpi file starts
<?xml version="1.0" encoding="UTF-8"?>

I notice that .exe files from qb64 give no symbols.
I think I am out of compilers now.
(How can you switch off strip from freebasic .exe files?)

[srvaldez]

(How can you switch off strip from freebasic .exe files?)

just a thought, not tested, perhaps with the -g switch?
it would seem counterproductive to strip an exe with debug information.
[edit]
confirmed, with the -g switch the strip command is omitted.

[dodicat]

Yea that's it srvaldez.
-g switch.