Entrpi
b33f4a5a1b
* docs(raw-binary): replace the STM32-style ARM example The headline raw example opened ecu.bin at 0x8000000, an STM32 flash address, while the arm lane decodes in ARM state. Map a 32-bit ARM-state image at 0x8000 instead, and state beside the example that Thumb-only images, including Cortex-M firmware, are not supported. * docs(ghidra): document an interim Cortex-M language override Ghidra imports little-endian ARM ELF files as ARM:LE:32:v8, which defaults to ARM state and marks Thumb code only from $t mapping symbols and odd function-symbol addresses. Unpinned arm ELF already admits REA_GHIDRA_LANGUAGE_ID, so document ARM:LE:32:Cortex (ARMv6-M, ARMv7-M, ARMv7E-M) and ARM:LE:32:v8-m (ARMv8-M) as an unverified interim. State the override's full effect while it is set: raw-binary, DOS, DOL, PSP and language-pinned lanes such as RISC-V refuse it, and REA asks Ghidra to import every other target in the ARM language, because it does not check the override's processor against the target.
8.4 KiB
Headerless raw-binary analysis with Ghidra
Headerless images are covered here. GameCube/Wii DOL images have a header and use their own format selection; see GameCube DOL analysis.
REA admits a headerless executable when the caller supplies the CPU family and
the address where file offset 0 should be mapped. That interpretation is not
inferred from a .bin suffix or from unrecognized bytes.
Open and inspect
rea inspect /absolute/path/to/kernel.img --target-format raw-binary --architecture arm --entry-point 0x8000 --provider ghidra --json
rea function /absolute/path/to/kernel.img 0x8000 --target-format raw-binary --architecture arm --entry-point 0x8000 --provider ghidra --json
rea inspect-native-load-image /absolute/path/to/kernel.img --target-format raw-binary --architecture arm --entry-point 0x8000 --provider ghidra --json
{
"name": "open_binary",
"arguments": {
"path": "/absolute/path/to/kernel.img",
"format": "raw-binary",
"architecture": "arm",
"entry_point": "0x8000",
"provider_id": "ghidra"
}
}
The example maps a 32-bit ARM-state image at 0x8000. For arm, decoding
starts at the entry in ARM (A32) state, so Thumb-only images, including Cortex-M
firmware, are not supported. See Limitations.
architecture is one of x86, x86_64, arm, arm64, 6502, or m68k. entry_point is a
hexadecimal address of the form 0x…. The complete file is mapped starting at
that address, and Ghidra seeds an entry function there before auto-analysis.
ARM and AArch64 entries must be 4-byte aligned; m68k entries must be 2-byte
aligned; x86 and 6502 entries may be byte-aligned.
For 6502, the entry and complete mapped file must fit within 0x0000..0xffff;
images that cross the 16-bit boundary are rejected before provider startup.
For m68k, the mapping must fit within 0x0..0xffffffff.
open_binary and an open binary_session return the canonical