ghidra icon indicating copy to clipboard operation
ghidra copied to clipboard

Using custom calling conventions when creating function definitions via data type manager

Open 0xBEEEF opened this issue 3 years ago • 1 comments

Is your feature request related to a problem? Please describe. During my analysis I have defined my own calling conventions. I can also select these when I edit functions and assign them to them. They are also used in the decompiler itself.

But now I have the problem that I have indirect function calls in the code, which are based on defined methods within a structure, in which these are contained as a member. Therefore I tried to go the way over the creation of function definitions with the help of the data type manager.

But there is a problem there now. When defining function definitions, I can only choose from a fixed list of calling conventions. See the comparison of the selection menu.

Do I have to do anything else to also be able to fall back on these calling conventions when creating function definitions? Am currently at a loss at this point, and don't know what to do.

Describe the solution you'd like It would be great for the analysis if you could not only fall back on the few fixed calling conventions, but also specially created ones. Therefore, the above menus should display the identical calling conventions.

Describe alternatives you've considered There are no alternatives because indirect calls with their own calling conventions cannot be taken into account.

Additional context Already attached everything above.

0xBEEEF avatar Aug 19 '22 14:08 0xBEEEF

The ability to do what you ask is work-in-progress. The change will permit a specific language/compiler-spec to be associated with an archive allowing any generic or cspec-defined calling convention to used. Initially optional cpsec extensions as supported by the program will not be supported by an archive but can be leveraged within a program. In addition, any convention used while in a program will be preserved when moved to/from an archive.

ghidra1 avatar Aug 19 '22 16:08 ghidra1

For example, modify the /Ghidra/Processors/x86/data/languages/x86-64-gcc.cspec. Add RAX as the first param of the fuction for go x64 calling convertion.

<input>
  <pentry minsize="1" maxsize="8">
      <register name="RAX"/>
  </pentry>

gorgiaxx avatar Dec 02 '22 14:12 gorgiaxx

Change has been added which allows both a program architecture to be assigned to an archive as well as assigning calling conventions to FunctionDefinitions based upon string name instead of being limited to GenericCallingConvention. Some restrictions are in place to reduce the likelyhood of typos creeping into assigned calling conventions . This is done by limiting there use to where they have been defined by a cspec prototype model. Archives also will preserve the use of such string names.

ghidra1 avatar Apr 20 '23 20:04 ghidra1