https://github.com/boricj/ghidra-delinker-extension Skip to content Navigation Menu Toggle navigation Sign in * Product + Actions Automate any workflow + Packages Host and manage packages + Security Find and fix vulnerabilities + Codespaces Instant dev environments + GitHub Copilot Write better code with AI + Code review Manage code changes + Issues Plan and track work + Discussions Collaborate outside of code Explore + All features + Documentation + GitHub Skills + Blog * Solutions By size + Enterprise + Teams + Startups By industry + Healthcare + Financial services + Manufacturing By use case + CI/CD & Automation + DevOps + DevSecOps * Resources Topics + AI + DevOps + Security + Software Development + View all Explore + Learning Pathways + White papers, Ebooks, Webinars + Customer Stories + Partners * Open Source + GitHub Sponsors Fund open source developers + The ReadME Project GitHub community articles Repositories + Topics + Trending + Collections * Enterprise + Enterprise platform AI-powered developer platform Available add-ons + Advanced Security Enterprise-grade security features + GitHub Copilot Enterprise-grade AI features + Premium Support Enterprise-grade 24/7 support * Pricing Search or jump to... Search code, repositories, users, issues, pull requests... Search [ ] Clear Search syntax tips Provide feedback We read every piece of feedback, and take your input very seriously. [ ] [ ] Include my email address so I can be contacted Cancel Submit feedback Saved searches Use saved searches to filter your results more quickly Name [ ] Query [ ] To see all available qualifiers, see our documentation. Cancel Create saved search Sign in Sign up Reseting focus You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert {{ message }} boricj / ghidra-delinker-extension Public * Notifications You must be signed in to change notification settings * Fork 4 * Star 143 Ghidra extension for exporting relocatable object files License Apache-2.0 license 143 stars 4 forks Branches Tags Activity Star Notifications You must be signed in to change notification settings * Code * Issues 4 * Pull requests 0 * Discussions * Actions * Projects 0 * Security * Insights Additional navigation options * Code * Issues * Pull requests * Discussions * Actions * Projects * Security * Insights boricj/ghidra-delinker-extension This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. master BranchesTags Go to file Code Folders and files Name Name Last commit Last commit message date Latest commit History 119 Commits .github/workflows .github/workflows .vscode .vscode data data developer_scripts developer_scripts ghidra_scripts ghidra_scripts src src .editorconfig .editorconfig .gitignore .gitignore LICENSE LICENSE Module.manifest Module.manifest README.md README.md build.gradle build.gradle extension.properties extension.properties settings.gradle settings.gradle View all files Repository files navigation * README * Apache-2.0 license Object file exporter extension for Ghidra This Ghidra extension enables exporting parts of a program as object files. These object files have valid metadata (symbols, relocation tables...) and as such can be reused directly by a toolchain for further processing. Use-cases include: * Advanced binary patching, by leveraging the linker to mend both original and modified parts together instead of doing this work by hand ; * Software ports, by isolating system-independent code from a program and replacing the rest ; * Converting programs or object files from one file format to another ; * Creating libraries, by extracting parts of a program and reusing them in another context ; * Decompilation projects, by splitting a program into multiple object files and reimplementing these Ship of Theseus-style ; * ... Matrix of supported instruction set architectures and object files: x86 MIPS COFF ELF Building (CLI) * Clone this repository ; * Define the GHIDRA_INSTALL_DIR environment variable to point to your Ghidra installation directory ; * Run gradle buildExtension. The Ghidra extension archive will be created inside the dist/ directory. Installation * Download the extension from the releases page or build it locally ; * Install the extension in your Ghidra instance with File > Install Extensions... ; * Enable the RelocationTableSynthesizedPlugin plugin with File > Configure inside a CodeBrowser window. Usage 1. Select a set of addresses in the Listing view ; 2. Run the Relocation table synthesizer analyzer (available in one-shot mode) ; 3. Invoke a relocatable object file exporter with File > Export Program... The reconstructed relocations can be viewed with Window > Relocation table (synthesized). * [?][?] The relocation table synthesizer analyzer relies on a fully populated Ghidra database (with correctly declared symbols, data types and references) in order to work. Incorrect or missing information may lead to broken or undiscovered relocations during the analysis. * [?][?] The object file exporters rely on the results of the relocation table synthesizer analyzer in order to work. When in doubt, run this analyzer right before exporting an object file to make sure the relocation table contents are up-to-date with the current state of the program. How does it work? Object files are made of three parts: * Relocatable section bytes ; * A symbol table ; * A relocation table. When a linker is invoked to generate an executable from a bunch of object files, it will: * Lay out their sections in memory ; * Compute the addresses of the symbols in the virtual address space ; * Apply the relocations based on the final addresses of the symbols onto the section bytes. Normally the relocation table is discarded after this process, as well as the symbol table if debugging symbols aren't kept, leaving only the un-relocatable section bytes. However, through careful analysis this data can be recreated, which allows us to then effectively delink the program back into object files. About Ghidra extension for exporting relocatable object files Topics reverse-engineering ghidra ghidra-extension delinking Resources Readme License Apache-2.0 license Activity Stars 143 stars Watchers 6 watching Forks 4 forks Report repository Releases 8 v0.5.0 Latest Aug 17, 2024 + 7 releases Contributors 2 * @boricj boricj Jean-Baptiste Boric * @jchv jchv Languages * Java 60.4% * Assembly 30.6% * Shell 6.9% * C 1.1% * Other 1.0% Footer (c) 2024 GitHub, Inc. Footer navigation * Terms * Privacy * Security * Status * Docs * Contact * Manage cookies * Do not share my personal information You can't perform that action at this time.