Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FunctionID: Add AddSingleFunction.java Ghidra script #7235

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

gemesa
Copy link
Contributor

@gemesa gemesa commented Nov 29, 2024

Fixes #5212

Introduction

As described in the linked issue there is currently no way to add a single function to a FID DB which is something I have wanted for a long time as well. The Ghidra script AddSingleFunction.java now implements this functionality.

Overview of the script

Prerequisites:

  • A FID DB must be created and attached.
  • An address must be selected in the listing view.

The script checks if there is any available library in the FID DB. If a library exists the user can select it. If not the user will be prompted to create one. The user can then decide whether to preserve the namespaces of the selected function or save only the basename. Finally the function entry is saved.

Testing

Empty FID DB (create new library)

Select a function (rayon::main):

image

Run AddSingleFunction.java:

image

image

image

image

image

List the FID DB content with ListFunctions.java:

$ cat fid-list.txt
rust-rayon rust_rayon::main

Non-empty FID DB (already contains at least one library)

Select a function (crossbeam_deque::deque::Stealer<T>::steal):

image

Run AddSingleFunction.java:

image

image

image

List the FID DB content with ListFunctions.java:

$ cat fid-list.txt
rust-rayon crossbeam_deque::deque::Stealer<T>::steal
rust-rayon rust_rayon::main

Additional notes

I had to make FidServiceLibraryIngest and findTerminator() public because they are required to calculate hasTerminator which is passed to createNewFunction(). If this is not allowed let me know and I will duplicate findTerminator() instead.

@ryanmkurtz ryanmkurtz added Feature: FID Status: Internal This is being tracked internally by the Ghidra team labels Jan 5, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature: FID Status: Internal This is being tracked internally by the Ghidra team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add individual functions to a pre-existing FunctionID database files
3 participants