Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Support for Struct Imports #36

Open
mahaloz opened this issue Jun 2, 2022 · 3 comments
Open

Add Support for Struct Imports #36

mahaloz opened this issue Jun 2, 2022 · 3 comments
Assignees
Labels
enhancement New feature or request

Comments

@mahaloz
Copy link
Owner

mahaloz commented Jun 2, 2022

For now, we will only support IDA since we have a clear-cut way to both get every struct and also know when they have been updated. This may also be possible in Binja, but out of question for future Ghidra support... that one will have to wait.

IDA Changes

In IDA we need to utilize finding all ordinal numbers, which represents each custom struct in IDA. After that, we can use idc.print_decls("1", 0) for each number to get a nice C representation of the struct. Now that we have a string that has the C-definition of the struct we need to do things in the core.

The changes all take place in the server. It's possible this may change the old API.

Client Changes

Assuming we now have a series of structs that are represented in C, we actually need to compile them into an object file and then add them with the classic add-symbol-file we use on the backend for other things. The trick though is adding this symbol file before we add the big one with all the global symbols here:

gdb.execute(f"add-symbol-file {fname} {text_base:#x}", to_string=True)

Since both symbol files will be loaded into the same place, there will be an overlapping main function. We either need to bake structs directly into the first file we create, or we need to make a new way to add native-struct through the symbol mapper.

@mahaloz mahaloz added the enhancement New feature or request label Jun 2, 2022
@mahaloz mahaloz self-assigned this Jun 2, 2022
@k4lizen
Copy link

k4lizen commented Oct 4, 2024

I've done this a few times manually and had some issues, for example with structs that aren't used anywhere in the code not being imported, or stuff not being loaded correctly if -s .data and/or -s .bss aren't supplied. Just giving a heads up if you ever encounter those issues.

@mahaloz
Copy link
Owner Author

mahaloz commented Oct 4, 2024

@k4lizen to clarify, you exported the struct from IDA, then put it in a C file and compiled it. Then you used the add-symbol-file stuff above and you ran into the following issues?

Good to know. I see this as the easiest path forward. However, there still exists the other path of crafting a DWARF (related to #54) with the struct information directly encoded in that. I'm not a huge fan of DWARF, but it could work more smoothly in more tools if done this way.

@k4lizen
Copy link

k4lizen commented Oct 4, 2024

I've just recently tried experimenting with importing symbols and structures into gdb so what I'm doing may very well not be the easiest way forward.

you exported the struct from IDA, then put it in a C file and compiled it. Then you used the add-symbol-file stuff above and you ran into the following issues?

I "exported" it by copy pasting it from IDA to a C file but yes. The file looks like this for example:

#include <stdint.h>

struct Mine // sizeof=0x18
{
    char label[5];
    // padding byte
    // padding byte
    // padding byte
    char *content;
    uint64_t size;
};

struct Mine p; // need it to be used somewhere

Compiled with something like gcc -c -g structs.c -o structs.o and added with add-symbol-file. A wacky issue is that the symbol p gets put in memory. So if you put it at address 0xABBA for example and if you ever print some object with gdb which has value 0xABBA in it, it will annotate that value with p.

You might not have this issue though, or it might not be as relevant since there most likely will be variables in the program which use these structures.

It's quite hacky.

It seems to work for this person without specifying .data and .bss https://gist.github.com/logc/c37ef4f5604430bfbf5625bf7546d4cd , I forget what issue I had when I didnt do that

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants