New Features
-
- Exporter. Added new exporters that write programs imported with the PE and ELF loaders back to their original file layout. Any filed-backed bytes that were modified by the user in the program database will be reflected in the written file (except on relocations). Writing back a modified Memory Map is not supported. (GP-786, Issue #1501, #1505, #19)
+- Debugger. Introduced the Debugger, along with GDB and dbgeng.dll connectors for debugging user-mode applications on Linux and Windows, respectively. The UI includes threads, timeline, modules, memory, registers, watches, etc., for examining and controlling debug targets. See Help -> Contents -> What's New for more details. (GP-986)
+- Exporter. Added new exporters that write programs imported with the PE and ELF loaders back to their original file layout. Any file-backed bytes that were modified by the user in the program database will be reflected in the written file (except on relocations). Writing back a modified Memory Map is not supported. (GP-786, Issue #1501, #1505, #19)
- Graphing. Added Graph -> Data actions to the Code Browser, allowing visualization of specified pointer relationships in a graph. (GP-194)
- Scripting. Added prototype RecoverClassesFromRTTIScript and that uses RTTI information to enhance Ghidra's knowledge of class hierarchy, class member function types (constructors, destructors, deleting destructors, clones) and class member data. The script will label and put member functions into correct class namespace and apply new class structures created either using PDB information, if available, or Decompiler pcode information. (GP-339)
- Scripting. Created a script to allow users to search for image base offsets to the current cursor location in 32-bit and 64-bit programs. (GP-863)
@@ -54,7 +55,7 @@- Graphing. Updated Function Graph edge routing when applying the Use Condensed Layout option to reduce edges being clipped by vertices. (GP-768)
- Graphing. Added option to disable the lightening of edges in the Function Graph. (GP-769, Issue #1106)
- Graphing. Added a distinct visual edge highlight beyond just a different color for graph edge selection. (GP-793, Issue #2953)
-- Graphing. Added Display as Graph action to the Datatype Manager, allowing visualization of embedded and referenced types of the selected type(s) (GP-808)
+- Graphing. Added Display as Graph action to the Datatype Manager, allowing visualization of embedded and referenced types of the selected type(s). (GP-808)
- Graphing. Fixed function graph bug that prevented the satellite view from showing the primary view lens. Fixed a layout bug that allowed from some vertices to get clipped when condensing the graph. (GP-940)
- Graphing. Added Vertex and Edge attributes to GraphML export format. (GP-957, Issue #2958)
- GUI. Added new Copy Special actions: Python Byte String, Python List, and C Array. (GP-210, Issue #744)
@@ -66,6 +67,8 @@- GUI. Fixed/Improved the behavior of global menu items and toolbar items with respect to which windows they appear in. These actions can now easily be configured to be either 1) only in menu bar and tool bar of the main window, 2) in the menu bar and tool bar of all windows, or 3) only the windows that have components that generate the type of context that the action consumes. Added methods to the ActionBuilder class to support these three options. Also, updated numerous actions to make sure they appear in the appropriate windows. (GP-759)
- GUI. Improved overall UI responsiveness when performing analysis with the Symbol Table open. (GP-788)
- GUI. Updated the Function Tags table column so that it may be used in most Ghidra tables. (GP-816, Issue #2873)
+- GUI. Updated the Defined Strings view to reload less frequently during auto-analysis. (GP-835, Issue #2889)
+- GUI. Updated function hovering in the Decompiler to find the correct function tooltip when multiple functions exist with the same name. (GP-959, Issue #2604)
- Importer:ELF. Added markup to ELF import for
.note.gnu.build-idand.gnu_debuglinksections. (GP-468)- Importer:ELF. Added ELF import support for SHN_MIPS_TEXT and SHN_MIPS_DATA symbol section index values and provided ability for other processor-specific ELF extensions to resolve ELF symbol memory addresses. (GP-664)
- Importer:Mach-O. Improved support for Mach-O object files. (GP-700)
@@ -109,12 +112,13 @@- Decompiler. The Decompiler no longer emits comments in the middle of conditional expressions. (GP-621, Issue #1670)
- Decompiler. Fixed
Redefinition of structure ...exceptions in the Decompiler caused by a PNG Image and other opaque datatypes. (GP-820, Issue #2734)- Decompiler. Fixed infinite loop in the Decompiler when analyzing return values. (GP-821, Issue #2851)
-- Decompiler. Fixed bug in the Decompiler's handling of enumerated data-types causing
+Shared type idexceptions. (GP-895, Issue #2909)- Decompiler. Fixed bug in the Decompiler's handling of enumerated data types causing
Shared type idexceptions. (GP-895, Issue #2909)- DWARF. Fixed and consolidated DEX and DWARF implementations of LEB128. (GP-444, Issue #2512)
- DWARF. Fixed unnecessary ELF header parsing when DWARF analyzer checks if it needs to run. Improved DWARF analyzer's run-once logic. (GP-695)
- DWARF. Fixed issue with DWARF data type importing that could omit the definition of a structure. (GP-929)
- Eclipse Integration. Fixed a GhidraDev bug that prevented Ghidra projects from recognizing extensions installed in the user's ~/.ghidra/.ghidra_<version>/Extensions directory. (GP-873)
- Extensions. Changed classpath configuration to not contain paths of removed extension libraries. (GP-522, Issue #2637)
+- FileSystems. Fixed several issues with extracting and importing DYLIB files contained within a DYLD file system. (GP-719, Issue #2934, #682)
- FileSystems. Fixed SevenZipFileSystem to correctly fail when opening password-protected archives. (GP-730)
- FileSystems. Fixed Ext4 file system to correctly handle sparse files. (GP-871)
- Graphing. Fixed IllegalArgumentException when showing a graph popup window after the source component was hidden. (GP-756, Issue #1643)
@@ -136,6 +140,7 @@- Installation. Renamed database
db.Recordclass todb.DBRecordto avoid naming conflict withjava.lang.Recordclass and potential import issues. (GP-193)- Jython. Fixed pasting multi-line strings into the Python interpreter panel. (GP-487, Issue #2456)
- Listing. Fixed #US table processing to correctly interpret the string as UTF-16LE for CIL binaries. (GP-318)
+- Listing. Fixed a sporadic listing operand hover stacktrace bug. (GP-987)
- PDB. Escaped more character strings in MSDIA pdb.exe XML output. (GP-578, Issue #1690)
- Processors. Fixed various issues pertaining to x86 instruction prefixes. (GP-220, Issue #2286, #2297)
- Processors. Refactored PPC interrupt returns to include return pcode statement. (GP-703)