TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

DWARF as a Shared Reverse Engineering Format

109 点作者 matt_d9 天前

7 条评论

nneonneo9 天前
Ghidra to DWARF was already possible via this plugin: <a href="https:&#x2F;&#x2F;github.com&#x2F;cesena&#x2F;ghidra2dwarf">https:&#x2F;&#x2F;github.com&#x2F;cesena&#x2F;ghidra2dwarf</a>. I’ve used this a lot (and contributed some patches) as it’s immensely useful in reverse engineering code. It gives me <i>source-level debug capabilities</i> in GDB on binaries without the original source code, by lining up the decompiled source code with the generated DWARF debug info. It works practically like magic: you get the ability to inspect variables (including complex structure types!), see arguments to functions, get fully symbolicated backtraces, see source code as you step, use line-level breakpoints, and more.
评论 #44113784 未加载
评论 #44118551 未加载
boricj8 天前
Exporting DWARF symbols is a feature I&#x27;m craving for inside my own Ghidra extension for exporting relocatable object files, in order to improve the debugging experience for executables containing them. Unfortunately, I&#x27;ve always chickened out on this, partly because resynthesizing debugging data is tricky and partly because I recoil in horror at the sight of the DWARF specification (because I write my own ELF&#x2F;COFF serializer).<p>That blog post gave me pause. I don&#x27;t know yet if this particular implementation will be a good fit, but I need to stop kicking this can down the road.
评论 #44115820 未加载
xvilka8 天前
Importing IDB is possible via python-idb[1] but it needs some work to support recent versions of IDA Pro.<p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;williballenthin&#x2F;python-idb">https:&#x2F;&#x2F;github.com&#x2F;williballenthin&#x2F;python-idb</a>
barosl8 天前
Off topic, but it is good to see an article about the LIEF library on Hacker News. I recently had a need to modify the header of an ELF file and LIEF was a lifesaver. Thanks to all the authors and contributors!
PennRobotics8 天前
I&#x27;ve been chipping away at recreating source for a dumped FreeRTOS binary for about a year using Ghidra and Trace32. (Disclosure: I work on Trace32.)<p>I wanted to implement something like <a href="https:&#x2F;&#x2F;github.com&#x2F;neuviemeporte&#x2F;mzretools">https:&#x2F;&#x2F;github.com&#x2F;neuviemeporte&#x2F;mzretools</a> (the tool for reversing F15SE, a DOS game) but I would need to port all of that tooling to an Arm cross-compiler and accept it will never produce a 1:1 binary in my case. (There&#x27;s evidence the original was built with IAR which I will not be buying solely for a hobby project.)<p>Ghidra (especially after using BSim to load all of the NXP demos and some TI library code for adjacent ICs) is extremely useful at getting the entire structure: library functions, data types, tasks, queues, I2C&#x2F;USB comm, pin setup, data locations, etc. You can re-code the flash part easily, but SRAM&#x2F;stack is all zeros. The code that fills SRAM uses pointer math and some loops and is generally unreadable on its own. I tried the Ghidra simulator, but it didn&#x27;t work out of the box on Arm microcontroller code.<p>Trace32 makes it easy to load the raw binary into an Arm simulator and step through all the way to the IDLE task, but there&#x27;s no high-level listing. You just have to detect if you&#x27;re in a loop and look at the loop address in Ghidra to see what holds you back. Without a simulation model (which I do not have---at least not outside of work) you have to manually jump past a few spots where the board waits for an acceptable status flag from a clock source, etc., and then manually call SysTick_Handler once, but the SRAM is eventually filled with appropriate data. Once you have a stack, you can start picking out which FreeRTOS macro parameters were set and figuring out the size and type of vendor-created structures which then streamlines further Ghidra analysis. Beyond that, you can&#x27;t use RTOS awareness without symbols, so unless you write a script to import these from Ghidra, a more insightful view of the binary remains out of reach.<p>The analysis has been a LOT of looking back and forth between the simulator (which shows a hex address and machine code) and the Ghidra decompilation listing; it is a bit like getting Don Quixote verbally read to you, one letter at a time. Anytime there&#x27;s a I2C_Master_Transmit(), you need to comb through datasheets for DSP settings and the various I2C-linked chip registers. It&#x27;s a USB product (with multiple endpoints) so I use Wireshark and Python to check the decompiled USB application code and identify valid packet data that are never sent by the vendor software.<p>DWARF can be imported and exported in Trace32, so exporting symbols created in Ghidra as DWARF would vastly simplify my workflow (as would having a real model of the NXP chip and&#x2F;or dumping the bootloader binary and secrets from a production device).<p>I&#x27;ll definitely check out this project, as well as ghidra2dwarf linked by nneonneo.
评论 #44115667 未加载
cryptonector8 天前
DWARF is fantastic. I&#x27;ve used it to generate C headers for SPIs based on APIs.
saagarjha8 天前
I just use binsync tbh
评论 #44116190 未加载