[Feature Request] Syscall support (or only arguments)
Opened this issue · 2 comments
-
By "only arguments" I mean the feature of being able to at least have
syscall
calls in the decompiler show arguments. Ghidra doesn't let you re-define thatsyscall
function (I assume it's a special kind of func defined somewhere), I'm not sure how to go about it from the GUI. But I assume that the extension is able to, somehow?
I'd be useful to re-define it assyscall(void *arg1, void *arg2, void *arg3)
etc to at least aid with capturing arguments passed into it. -
By "syscall support" I mean the more fully-fledged feature of having a hardcoded list of the syscalls in the extension (ID -> syscall proto), and on each
syscall
instruction the right one recognized from the value loaded inv1
and communicated with the decompiler to show it as the correct function (name + signature).
Note:
I'm aware there's already pattern matching for the syscalls, but
- That's only for the wrappers, it does not apply to stray syscalls that aren't in these specific wrappers
- There are no syscall function signatures, just the names
I think this should be possible by making the syscall instruction a call and then utilizing call fixup. I know there is a script in the ghidra repo to do this for linux syscalls.