GhidraEmu

This project was initially started as a part of Digital Security's Research Centre internship "Summer of Hack 2021".

Plugin allows you to easily dealing with native pcode emulator. No scripts anymore, just use it from Ghidra.

What can it do

• Work with all architectures that Ghidra supports, so you can add exotic processors and emulate them
• CPU context, stack and heap emualtion
• Applying patched bytes from Ghidra
• Breakpoints to control emualtion process
• Hook some libc functions (but it is still poor)

What it can't

• Step in external library functions (emuHelper restrictions)
• Syscall emulation

All plugin windows in one set

Before you start

Don't forget to analyze your program in Ghidra, emulator depends on it.

Features

Menu window

Contains all plugin's windows - Stack view, Registers, Breakpoints view and main window.

Popup window

Contains hotkeys for setting start and end addresses of emulation, breakpoints and applying changed bytes to emulator.

Register view

Change registers as you want. Setting as link register (green arrow) will help emulator let it know which register contatins return address. Plugin knows how it goes via stack, lr register, AARCH64 and mips registers. If you have an exotic one, select link register and press the button.

Stack view

When you open your program in Сode browser GhidraEmu will mmap stack space automaticaly. Stack pointer will be set at middle of stack space. It was done to allow you set values at top or bottom stack frames. Set your values as you want. Scroll it if you got some freezes on updating or reseting.

Breakpoints view

Apply patched bytes

If you changed something, let emulator know about changed bytes.

Console

Here plugin prints output information.

Future work

EmuHelper restrictions doesn't allow to use on program space in another. So your external shared library, for example, will never know about program memory space and vice versa. So you can't emulate it as one process with one memory space. Let me know if I'm missing something here.

Installation

• Download Release version of extension and install it in Ghidra File → Install Extensions...
• Use gradle to build extension: GHIDRA_INSTALL_DIR=${GHIDRA_HOME} gradle and use Ghidra to install it: File → Install Extensions...
• In CodeBrowser go to File → Configure → Experimental and select checkbox.