Yagi
Yet Another Ghidra Integration for IDA
Overview
Yagi intends to include the wonderful Ghidra decompiler into both IDA pro and IDA Free.
Here is the list of architectures that Yagi can decompile at the moment:
| Arch Names | Yagi |
|---|---|
| x86 |
|
| x86_64 |
|
| arm |
|
| aarch64(armv8) |
|
| powerpc |
|
| mips |
|
| sparc |
|
| cp1600 |
|
| cr16 |
|
| avr8 |
|
| dalvik |
|
| jvm |
|
| tricore |
|
| riscv |
|
| z80 |
|
| System Z |
|
| xCore |
|
It's easy to add one if it's supported by Ghidra. Just open an issue, and we will do our best!
It allows you to edit the following items:
- Global Symbol like function prototype, global variable, etc.
- Local stack variables name and type
- Local registry variables name and type
| Key | Interact |
|---|---|
| Decompile |
|
| Edit Type |
|
| Edit Name |
|
| Cross References |
|
| Navigate |
|
Build
As Yagi is built using git submodules to handle Ghidra dependencies, you will first need to do a recursive clone:
git clone https://github.com/airbus-cert/Yagi --recursive
For Windows
Install Dependencies
As Ghidra uses bison and flex to parse the sleigh grammar, we need first to install build dependencies from here
You also need the IDA SDK associated with your version of IDA.
Cmake
Yagi's build system is based on cmake; you can find an MSI package here.
You need at least a Visual Studio compiler with C++ toolchain.
Production
To generate a Wix installer, you need to install WiX before.
Then, let the cmake magic happen:
git clone https://github.com/airbus-cert/Yagi --recursive
mkdir build_yagi
cd build_yagi
cmake ..\Yagi -DIDA_SDK_SOURCE_DIR=[PATH_TO_IDA_SDK_ROOT_FOLDER]
cmake --build . --target package --config release
A new yagi-1.0.0-win64.msi will be generated. It will contain all the necessary dependencies to install the plugin.
Development
To create a dev environment you need to generate the Visual Studio solution:
git clone https://github.com/airbus-cert/Yagi --recursive
mkdir build_yagi
cd build_yagi
cmake ..\Yagi -DIDA_SDK_SOURCE_DIR=[PATH_TO_IDA_SDK_ROOT_FOLDER] -DBUILD_TESTS=ON
PATH_TO_IDA_SDK_ROOT_FOLDER represents the root path of the decompressed archive provided by Hex-Rays.
To launch unit tests, just use ctest installed with cmake:
cd tests
ctest -VV
For Linux
Install Dependencies
As Ghidra uses bison and flex to parse the sleigh grammar and Yagi is built using Cmake and C++, you will need the following:
apt install cmake c++ git flex bison yacc
Production
To generate an installer script:
git clone https://github.com/airbus-cert/Yagi --recursive
mkdir build_yagi
cd build_yagi
cmake ..\Yagi -DIDA_SDK_SOURCE_DIR=[PATH_TO_IDA_SDK_ROOT_FOLDER]
cmake --build . --target package --config release
This will produce a yagi-1.0.0-Linux.sh script. Then you just have to launch it:
./yagi-1.0.0-Linux.sh --prefix=[PATH_TO_IDA_INSTALL_FOLDER]
y
n
Enjoy!
Development
To generate a dev environment you need to generate the Makefile:
git clone https://github.com/airbus-cert/Yagi --recursive
mkdir build_yagi
cd build_yagi
cmake ..\Yagi -DIDA_SDK_SOURCE_DIR=[PATH_TO_IDA_SDK_ROOT_FOLDER] -DBUILD_TESTS=ON -DCMAKE_BUILD_TYPE=Debug
make
To launch unit tests, just use ctest installed with cmake:
cd tests
ctest -VV
TODO
- Handle enum types
- Add rules to handle CFG on Windows
- Add rules to handle T9 for MIPS
- Add rules to handle end function computation on AARCH64
Credits and references
Thanks Ghidra development team to open sources this master piece of software.
Thanks Hex-Ray teams to built a very extensible software.
![[Yagi] ERROR : No sleigh specification for PowerPC:BE:16:default](https://avatars.githubusercontent.com/u/5182588?v=4)
48 Dec 4, 2021
14 Jul 27, 2022
55 Dec 19, 2022
445 Dec 18, 2022
11 Apr 2, 2022
6 Nov 15, 2022
58 Dec 26, 2022
82 Dec 6, 2022
9 Sep 5, 2022
9 Mar 14, 2022
1.1k Dec 27, 2022
28 Aug 19, 2022
39 Nov 20, 2022
22 Oct 15, 2022
9 Nov 18, 2022
3 Jan 3, 2022
3 Aug 3, 2022
273 Dec 26, 2022
6 Nov 15, 2022