ghidra icon indicating copy to clipboard operation
ghidra copied to clipboard

Support the System V AMD64 ABI

Open edevil opened this issue 5 years ago • 1 comments

Is your feature request related to a problem? Please describe. Ghidra supports and detects several calling conventions, but not the System V AMD64 ABI.

Describe the solution you'd like It would be useful to support the System V AMD64 ABI as well out of the box.

edevil avatar Apr 23 '19 08:04 edevil

I also need this too. I'm analyze a PS4 binary, which use System V AMD64 ABI.

ultimaweapon avatar Oct 16 '22 14:10 ultimaweapon

Some contributor (eg @caheckman @dragonmacher @ryanmkurtz) that could give us a clue about where to start looking to fix this?

dgutson avatar Aug 22 '23 15:08 dgutson

Looking at the specification, it appears to be equivalent to the x86:LE:64:default:gcc processor specification provided in Ghidra.

The _stdcall in the description in the compiler specification file states:

Derived from "System V Application Binary Interface AMD64 Architecture Processor Supplement" April 2016

So when you import your binary, you should select the language:

x86 default 64 little gcc

emteere avatar Aug 23 '23 19:08 emteere

I'm a coworker of @dgutson

The solution suggested by @emteere worked for the function, so the issue is not that the calling convention is unsupported.

Unfortunately, the solution does not work for our case as the binary (EFI) has mixed ABI, and we can not change the default ABI.

If I edit the function and change only the calling convention, nothing happens. If I also edit the signature, the function variables are created using the incorrect ABI (e.g. param_1 is RCX, as expected in __fastcall, instead of RDI, as expected in __stdcall) Is there a way to re-analyze the function but using an ABI different than the default for the binary?

Oren-i avatar Aug 24 '23 12:08 Oren-i