beardypig/ghidra-emotionengine

[Feature Request] Syscall support (or only arguments)

Opened this issue · 2 comments

  • By "only arguments" I mean the feature of being able to at least have syscall calls in the decompiler show arguments. Ghidra doesn't let you re-define that syscall function (I assume it's a special kind of func defined somewhere), I'm not sure how to go about it from the GUI. But I assume that the extension is able to, somehow?
    I'd be useful to re-define it as syscall(void *arg1, void *arg2, void *arg3) etc to at least aid with capturing arguments passed into it.

  • By "syscall support" I mean the more fully-fledged feature of having a hardcoded list of the syscalls in the extension (ID -> syscall proto), and on each syscall instruction the right one recognized from the value loaded in v1 and communicated with the decompiler to show it as the correct function (name + signature).

Note:
I'm aware there's already pattern matching for the syscalls, but

  • That's only for the wrappers, it does not apply to stray syscalls that aren't in these specific wrappers
  • There are no syscall function signatures, just the names

I think this should be possible by making the syscall instruction a call and then utilizing call fixup. I know there is a script in the ghidra repo to do this for linux syscalls.