rizinorg / rz-ghidra

Deep ghidra decompiler and sleigh disassembler integration for rizin

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Tailjmps to reloc targets are decompiled until infinity

dmknght opened this issue · comments

Linux Kernel Modules has no ret in functions. Rizin is able to detect them. However, the decompiler failed to parse data of each function, causing very long function in decompiler widget which is totally wrong, or causing decompile time out
Step to reprocedure (with cutter)

  1. Open kernel module (soundcore.ko in this very case)
  2. Show the function sym.register_sound_dsp
  3. See the wrong output in decompiler widget

Screenshots

  1. List of functions
    image
  2. Function in Graph widget
    image
  3. Function in Decompiler widget
    image

The function sym.register_sound_special is even worse
image
image

Click on the .text.unlikely makes Decompiler shows totally wrong function from function name
image

The output is the same in rizin -> the problem is the plugin ghidra
image

And other issue relates to #229. sym.register_sound_dsp showed function __fentry__ is called. However, Decompiler widget failed to show function name.
image
image

Tested binary
issue312_ghidra_failed_to_detect_functions.zip

Function names from reloc targets work now.

The __x86_return_thunk is handled in ghidra because it applies a flow override to the respective jmp instructions:
Bildschirm­foto 2023-01-20 um 13 50 49

There are ways to address this in rizin/rz-ghidra too, but currently none that is trivial or straightforward. As a quick and dirty workaround for this bin, you can do e io.cache=1; wa ret @ reloc.target.__x86_return_thunk

Hello! This method worked for me. Hope it will be fixed by default soon.