Yet Another Ghidra Integration for IDA

Related tags

Miscellaneous Yagi
Overview

Yagi

Yet Another Ghidra Integration for IDA

Overview

Yagi intends to include the wonderful Ghidra decompiler into both IDA pro and IDA Free.

Example of Yagi

📦 You can download installers for Windows and Linux versions here, then press F7 and enjoy! 📦

Here is the list of architectures that Yagi can decompile at the moment:

Arch Names Yagi
x86 ✔️
x86_64 ✔️
arm ✔️
aarch64(armv8) ✔️
powerpc ✔️
mips ✔️
sparc ✔️
cp1600 ❌
cr16 ❌
avr8 ❌
dalvik ❌
jvm ❌
tricore ❌
riscv ❌
z80 ❌
System Z ❌
xCore ❌

It's easy to add one if it's supported by Ghidra. Just open an issue, and we will do our best!

It allows you to edit the following items:

  • Global Symbol like function prototype, global variable, etc.
  • Local stack variables name and type
  • Local registry variables name and type
Key Interact
Decompile 🖱️ Place cursor on function ⌨️ F7
Edit Type ⌨️ Y
Edit Name ⌨️ N
Cross References ⌨️ X
Navigate 🖱️ Double Click on keyword

💾 Changes are save into IDA database 💾

Build

As Yagi is built using git submodules to handle Ghidra dependencies, you will first need to do a recursive clone:

git clone https://github.com/airbus-cert/Yagi --recursive

For Windows

Install Dependencies

As Ghidra uses bison and flex to parse the sleigh grammar, we need first to install build dependencies from here

You also need the IDA SDK associated with your version of IDA.

Cmake

Yagi's build system is based on cmake; you can find an MSI package here.

You need at least a Visual Studio compiler with C++ toolchain.

Production

To generate a Wix installer, you need to install WiX before.

Then, let the cmake magic happen:

git clone https://github.com/airbus-cert/Yagi --recursive
mkdir build_yagi
cd build_yagi
cmake ..\Yagi -DIDA_SDK_SOURCE_DIR=[PATH_TO_IDA_SDK_ROOT_FOLDER]
cmake --build . --target package --config release

A new yagi-1.0.0-win64.msi will be generated. It will contain all the necessary dependencies to install the plugin.

Development

To create a dev environment you need to generate the Visual Studio solution:

git clone https://github.com/airbus-cert/Yagi --recursive
mkdir build_yagi
cd build_yagi
cmake ..\Yagi -DIDA_SDK_SOURCE_DIR=[PATH_TO_IDA_SDK_ROOT_FOLDER] -DBUILD_TESTS=ON

PATH_TO_IDA_SDK_ROOT_FOLDER represents the root path of the decompressed archive provided by Hex-Rays.

To launch unit tests, just use ctest installed with cmake:

cd tests
ctest -VV

For Linux

Install Dependencies

As Ghidra uses bison and flex to parse the sleigh grammar and Yagi is built using Cmake and C++, you will need the following:

apt install cmake c++ git flex bison yacc

Production

To generate an installer script:

git clone https://github.com/airbus-cert/Yagi --recursive
mkdir build_yagi
cd build_yagi
cmake ..\Yagi -DIDA_SDK_SOURCE_DIR=[PATH_TO_IDA_SDK_ROOT_FOLDER]
cmake --build . --target package --config release

This will produce a yagi-1.0.0-Linux.sh script. Then you just have to launch it:

./yagi-1.0.0-Linux.sh --prefix=[PATH_TO_IDA_INSTALL_FOLDER]
y
n

Enjoy!

Development

To generate a dev environment you need to generate the Makefile:

git clone https://github.com/airbus-cert/Yagi --recursive
mkdir build_yagi
cd build_yagi
cmake ..\Yagi -DIDA_SDK_SOURCE_DIR=[PATH_TO_IDA_SDK_ROOT_FOLDER] -DBUILD_TESTS=ON -DCMAKE_BUILD_TYPE=Debug
make

To launch unit tests, just use ctest installed with cmake:

cd tests
ctest -VV

TODO

  • Handle enum types
  • Add rules to handle CFG on Windows
  • Add rules to handle T9 for MIPS
  • Add rules to handle end function computation on AARCH64

Credits and references

Thanks Ghidra development team to open sources this master piece of software.

Thanks Hex-Ray teams to built a very extensible software.

Issues
  • Crashes

    Crashes "ida.exe"

    Tried running Yagi for IDA 7.6. 64 bit runs fine, but the 32bit target "ida.exe" will crash almost instantly, and without any sort of dialog/warning box.

    Consider wrapping your IDA "run" in an a C or C++ exception handler. It's what I do, great for development. With a msg() in the handler it will tell me my plugin crashed instead of crashing IDA (most of the time anyhow, could cause IDA to crash outside of our plugin space et al).

    opened by BigJim 6
  • Yagi not supported for IDA interactive debugging

    Yagi not supported for IDA interactive debugging

    Hi there,

    IDA allow users to analyze between static & debugging. however, Yagi use F7 as hotkey, it will let users cannot do single-step in dynamic mode. besides, Yagi is not stable and easy to crash in dynamic mode :(

    opened by aaaddress1 2
  • Fix to allow installing Yagi in user .idapro/plugins folder

    Fix to allow installing Yagi in user .idapro/plugins folder

    Hi !

    Currently Yagi can only be installed in Ida installation path, this fix allows installing Yagi in user $IDAUSR/plugins folder. The function get_ida_subdirs() searches in $IDAUSR/ and $IDADIR folders and can be used to detect where Yagi is installed.

    I only tested it on Linux but it should work on Windows too (if someone can test it before merging the PR ?)

    opened by jbcayrou 1
  • IDA Pro 7.3 Support

    IDA Pro 7.3 Support

    Hello there, Thank you for this awesome plugin. I have tried this plugin on Linux IDA Pro 7.3 and got the error below:

    dlopen(/<path>/idapro-7.3/plugins/yagi.so): /<path>/idapro-7.3/plugins/yagi.so: undefined symbol: get_struc_name
    /<path>/idapro-7.3/plugins/yagi.so: can't load file
    

    I hope you will add support to IDA Pro 7.3. Thank you very much

    opened by 0xFF1E071F 1
  • avr8 decompiler

    avr8 decompiler

    I saw you guys mentioned it might not be that hard to add another decompiler. Ghidra does have support for AVR8 (in particular I'm interested in the Xmega stuff). Is this somewhere in your pipeline? Thanks!

    opened by lukaskuzmiak 1
  • plugin for x64dbg?

    plugin for x64dbg?

    hi there, thanks for the nice job! is there any possible to support Yagi for x64dbg? it's useful. although x64dbg embedded a decompiler Snowman, however it's totally not working :(

    image

    opened by aaaddress1 1
  • [Yagi] ERROR :  No sleigh specification for PowerPC:BE:16:default

    [Yagi] ERROR : No sleigh specification for PowerPC:BE:16:default

    This happens when Yagi is attempted to be used with a xex file from Xbox 360:

    [Yagi] INFO :  load compiler with sleigh id : PowerPC:BE:16:default
    [Yagi] ERROR :  No sleigh specification for PowerPC:BE:16:default
    

    The file is loaded into IDA using this loader: https://github.com/emoose/idaxex

    Would appreciate a fix since PowerPC is declared to be supported, so it's probably something simple, thanks in advance

    EDIT:

    Full output:

    WARNING: Python 3 is not configured (Python3TargetDLL value is not set). Please run idapyswitch to select a Python 3 install.
    
      bytes   pages size description
    --------- ----- ---- --------------------------------------------
    112492544 13732 8192 allocating memory for b-tree...
    103317504 12612 8192 allocating memory for virtual array...
       262144    32 8192 allocating memory for name pointers...
    -----------------------------------------------------------------
    216072192            total memory allocated
    
    Loading processor module C:\Program Files\IDA Pro 7.6\procs\ppc64.dll for PPC...Initializing processor module PPC...OK
    Loading type libraries...
    Autoanalysis subsystem has been initialized.
    Database for file 'output.xex' has been loaded.
    [Yagi] INFO :  load compiler with sleigh id : PowerPC:BE:16:default
    [Yagi] ERROR :  No sleigh specification for PowerPC:BE:16:default
    ---------------------------------------------------------------------------------------------
    Python 3.10.1 (tags/v3.10.1:2cd268a, Dec  6 2021, 19:10:37) [MSC v.1929 64 bit (AMD64)] 
    IDAPython 64-bit v7.4.0 final (serial 0) (c) The IDAPython Team <[email protected]>
    ---------------------------------------------------------------------------------------------
    

    IDA version: v7.6

    Additional info from IDA View:

    .rdata:82000600 Imports from xam.xex v2.0.21256.0 (minimum v2.0.16537.0)
    .rdata:82000600
    .rdata:82000600
    .rdata:82000600 # Processor       : PPC
    .rdata:82000600 # Target assembler: GNU Assembler
    .rdata:82000600 # Byte sex        : Big endian
    .rdata:82000600 # SIMD Instructions: VMX128
    .rdata:82000600 # Processor Profile: Server
    .rdata:82000600 # ABI              : sysv-hard_float
    .rdata:82000600
    .rdata:82000600 #include "ppc-asm.h"
    .rdata:82000600 .set r1, 1; .set r2, 2
    .rdata:82000600 .set lt, 0; .set gt, 1; .set eq, 2; .set so, 3
    
    opened by p0358 1
  • Incorrect judgment of program architecture

    Incorrect judgment of program architecture

    ida_idp.info.is_32bit()
    Out[14]: True
    
    ida_idp.info.is_64bit()
    Out[15]: True
    

    For 64-bit programs, ida's two judgments both return true, so Yagi will judge the 64-bit program as 32-bit, which does not meet expectations。

    auto mode = yagi::Compiler::Mode::M24;
    if (inf_is_64bit())
    {
        mode = yagi::Compiler::Mode::M64;
    }
    if (inf_is_16bit())
    {
        mode = yagi::Compiler::Mode::M16;
    }
    if (inf_is_32bit_exactly())
    {
        mode = yagi::Compiler::Mode::M32;
    }
    
    opened by YmColdQiu 0
  • On Linux, Yagi fails to load processor definitions if the `Ghidra` folder is a symbolic link

    On Linux, Yagi fails to load processor definitions if the `Ghidra` folder is a symbolic link

    With release 1.3.0, on Linux 64 bit, Yagi outputs [Yagi] ERROR : No sleigh specification for sparc:BE:32:default when the path ~/.idapro/plugins/Ghidra is a symbolic link to the real folder.

    Things work correctly when Ghidra is copied to ~/.iidapro/plugins. This is confirmed by the following traces obtained with strace -f -e file ida file.idb:

    Not working:

    $ grep Ghidra test
    193726 stat("/home/raph/.idapro/plugins/Ghidra", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
    193726 stat("/home/raph/bin/ida76/plugins/Ghidra", 0x7ffd6fe45150) = -1 ENOENT (Aucun fichier ou dossier de ce type)
    

    Working:

    193522 stat("/home/raph/.idapro/plugins/Ghidra", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
    193522 stat("/home/raph/bin/ida76/plugins/Ghidra", 0x7ffe7fcb41c0) = -1 ENOENT (Aucun fichier ou dossier de ce type)
    193522 openat(AT_FDCWD, "/home/raph/.idapro/plugins/Ghidra/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 16
    193522 openat(AT_FDCWD, "/home/raph/.idapro/plugins/Ghidra/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 16
    193522 openat(AT_FDCWD, "/home/raph/.idapro/plugins/Ghidra/Processors/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 16
    
    opened by trou 0
  • Mac Builds

    Mac Builds

    Hey!

    Congrats on the awesome plugin and the hex-rays plugin contest entry!

    It'd be awesome if we could get some prebuilt mac builds/mac support, assuming the plugin would support that :-)

    opened by agnosticlines 2
  • one question related to the development of the ida plugin

    one question related to the development of the ida plugin

    In my plugin, I want to do something imediately after the completion of IDA initialization analysis. So I found a function which named hook_to_notification_point, but it won't work. Is there any other ways?

    opened by fjqisba 0
Releases(v1.4.0)
Owner
Airbus CERT
Airbus CERT
Yet another alarm (control) panel for Home Assistant.

HASS-YAAP Yet another alarm (control) panel for Home Assistant. Change alarm system mode (away, home, night, disarmed) Welcome people arriving by thei

Paul-Vincent Roll 48 Dec 4, 2021
Yet another abstraction layer - a general purpose C++ library.

Yet Another Abstraction Layer What yaal is a cross platform, general purpose C++ library. This library provides unified, high level, C++ interfaces an

Marcin Konarski 15 Jun 30, 2022
Yet another Hi-C scaffolding tool

YaHS: yet another Hi-C scaffolding tool Overview YaHS is scaffolding tool using Hi-C data. It relies on a new algothrim for contig joining detection w

null 29 Jun 22, 2022
YARP - Yet Another Robot Platform

YARP __ __ ___ ____ ____ \ \/ // || _ \ | _ \ \ // /| || |/ / | |/ / / // ___ || _ \ | _/ /_//_/ |_||_| \_\|_| ===================

Robotology 425 Jun 20, 2022
YACHT: Yet Another C++ Helper Template

YACHT: Yet Another C++ Helper Template A template for C++ projects. Welcome to your YACHT! Because why build a boat from scratch, when you can enjoy a

Dimitri Belopopsky 11 Apr 2, 2022
Yet another matrix client. Click packaging for locally running on Ubuntu Touch

Cinny Click Packaging Cinny is a Matrix client focusing primarily on simple, elegant and secure interface. License Cinny source package licensed under

Nitan Alexandru Marcel 5 Jun 24, 2022
IDA Pro key checker tool

IDA Key Checker IDA Pro (6.x-7.x) key checker tool Usage A list of available options can be retrieved using: ida_key_checker --help Arguments: Option

null 53 Jun 20, 2022
IDA StrikeOut: A Hex-Rays decompiler plugin to patch the Ctree

StrikeOut is an plugin for the Hex-Rays Decompiler. It allows you to delete (hide) statements from the AST, thus simplifying the pseudocode output. This is a useful scenario when you are dealing with lots of junk code or code that don't necessarily increase your understanding of the pseudocode.

Elias Bachaalany 79 Jun 20, 2022
IDA Debugger Module to Dynamically Synchronize Memory and Registers with third-party Backends (Tenet, Unicorn, GDB, etc.)

IDA Debug Bridge IDA Debugger Module to Dynamically Synchronize Memory and Registers with third-party Backends (Tenet, Unicorn, GDB, etc.) By synchron

null 7 Jun 30, 2022
GreenLambert macOS IDA plugin to deobfuscate strings

Delambert An IDA plugin to deobfuscate strings from The Lamberts macOS malware sample af7c395426649c57e44eac0bb6c6a109ac649763065ff5b2b23db71839bac655

fG! 9 Mar 14, 2022
A FREE Windows C development course where we will learn the Win32API and reverse engineer each step utilizing IDA Free in both an x86 and x64 environment.

FREE Reverse Engineering Self-Study Course HERE Hacking Windows The book and code repo for the FREE Hacking Windows book by Kevin Thomas. FREE Book Do

Kevin Thomas 984 Jun 17, 2022
A perfect blend of C, Java, and Python tailored for those who desire a simple yet powerful programming language.

Fastcode A perfect blend of C, Java, and Python tailored for those who desire a simple yet powerful programming language. FastCode is a procedural/str

null 27 May 31, 2022
RISC-V has a 128-bit ISA that is fairly developed, but not standardized fully yet.

128-bit RISC-V assembler RISC-V has a 128-bit ISA that is fairly developed, but not standardized fully yet. I am maintaining a RISC-V userspace emulat

Alf-André Walla 36 May 18, 2022
The pico can be used to program other devices. Raspberry pi made such an effort. However there is no board yet, that is open-source and can be used with OpenOCD as a general-purpose programmer

pico-probe-programmer The pico can be used to program other devices. Raspberry pi made such an effort. However there is no board yet, that is open-sou

martijn 20 Jan 27, 2022
Implementation of the (not yet written) std::experimental::rational proposal.

Rational Implementation of the (not yet written) std::experimental::rational proposal. Getting started Copy include/std/experimental/rational.hpp to y

Ali Can Demiralp 9 Feb 6, 2022
"the French term for a watch movement that is not completely assembled yet."

Chablon "the French term for a watch movement that is not completely assembled yet." Today it's a program to draw rectangles on the display of a PineT

Daniel Barlow 3 Jan 3, 2022
SomeSmile - a free, open source and not yet cross-platform

SomeSmile - a free, open source and not yet cross-platform Table Of Contents For What? Structure Start Usage Guide How To Build Screenshots End For Wh

SonicTheHedgehog 3 Jan 23, 2022
Another version of EVA using anti-debugging techs && using Syscalls

EVA2 Another version of EVA using anti-debugging techs && using Syscalls First thing: Dont Upload to virus total. this note is for you and not for me.

null 252 Jun 23, 2022
Another try to re-create Project Astoria , or some bridge between A and W...

Bridge 1.0.10.0 Forked from: https://github.com/DroidOnUWP/Bridge Abstract Another "Project Astoria" remake (UWP) Original status: Forgotten (?) My ac

Media Explorer 4 Jun 12, 2022