Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Provide "peek at bytes" ability in sleigh #7196

Open
wootpthomas opened this issue Nov 15, 2024 · 0 comments
Open

Provide "peek at bytes" ability in sleigh #7196

wootpthomas opened this issue Nov 15, 2024 · 0 comments
Assignees
Labels
Feature: Sleigh Status: Triage Information is being gathered Type: Enhancement New feature or request

Comments

@wootpthomas
Copy link

I started off trying to implement a processor module an an architecture which uses "instruction bundles". This arch requires to look at some instruction metadata in order to determine the number and size of instructions located in the "instruction bundle". Trouble is that the metadata for the instructions is located at the end of the bundle.

Due to how ghidra consumes bytes relating to instructions, the current implementation requires me to use a token to look at an instruction bundle. If I decode a single instruction, ghidra consumes the bytes referred to in the token and I then skip over the remaining instructions.

Describe the solution you'd like
What I would like is some ability in SLEIGH to look at bytes without consuming them. This would allow me to "peek" at the bytes in the metadata and then decode one instruction.

Describe alternatives you've considered
I've currently written rules in SLEIGH to essentially do recursive parsing on the instruction bundle. Trouble is that this is very tedious to write and then Ghidra displays all of the decoded instructions on a single line. Ghidra will consume an entire "instruction bundle" and consider it 1 instruction.

Furthermore, I do not expect this to work well when branching to an address within the middle of an instruction bundle.

If SLEIGH provided some token-like ability to look at a block of bytes starting at the current instruction, but not consuming them as the token does, that would be really helpful and greatly simplify my current SLEIGH rules.

@ryanmkurtz ryanmkurtz added Type: Enhancement New feature or request Feature: Sleigh Status: Triage Information is being gathered labels Nov 18, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature: Sleigh Status: Triage Information is being gathered Type: Enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

3 participants