Skip to content

Commit ff48af7

Browse files
committed
Additional updates to WhatsNew for 9.2
1 parent 1818b33 commit ff48af7

File tree

1 file changed

+35
-36
lines changed
  • Ghidra/Configurations/Public_Release/src/global/docs

1 file changed

+35
-36
lines changed

Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.html

Lines changed: 35 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ <H1>Ghidra: NSA Reverse Engineering Software</H2>
2626
Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with
2727
hundreds of other features. Ghidra supports a wide variety of processor instruction sets and
2828
executable formats and can be run in both user-interactive and automated modes. Users may also
29-
develop their own Ghidra plug-in component and scripts using the exposed API. In addition there are
29+
develop their own Ghidra plug-in components and/or scripts using the exposed API. In addition there are
3030
numerous ways to extend Ghidra such as new processors, loaders/exporters, automated analyzers,
3131
and new visualizations.
3232
</P>
@@ -38,7 +38,7 @@ <H1>Ghidra: NSA Reverse Engineering Software</H2>
3838
code and generating deep insights for NSA analysts who seek a better understanding of potential
3939
vulnerabilities in networks and systems.
4040
</P>
41-
41+
4242
<BR />
4343
<H1> What's New in Ghidra 9.2</H1>
4444

@@ -68,21 +68,21 @@ <H2> <a id="finePrint92"/>The not-so-fine print: Please Read!</H2>
6868
been regenerated, and new ones for VS 2017/2019 have been added.</P>
6969

7070
<P>Minor Note: SLA Files: Ghidra-compiled .sla files are not always backwards compatible due to changes in the underlying .sla
71-
specification. In the pre-built ghidra, all .sla files are re-built from scratch. However if you have local processor modules,
72-
or are building ghidra from scratch, you may need to do a clean build. Any processor modules with changes are normally recompiled
71+
specification. In the prebuilt Ghidra, all .sla files are rebuilt from scratch. However if you have local processor modules,
72+
or are building Ghidra from scratch, you may need to do a clean build. Any processor modules with changes are normally recompiled
7373
at Ghidra startup so this situation is rare.</P>
7474

7575
<P>Minor Note: AARCH64 Long: The size of a <b>long</b> on the AARCH64 has been changed from 4-bytes to 8-bytes in the data organization within the
7676
compiler specification. This change could have ramifications in existing AARCH64 programs using a <b>long</b> within data structures or
7777
custom storage of function parameters (dynamic storage should not be an issue). An included script <i><b>FixupCompositeDataTypesScript</b></i>
7878
can be run on programs, only with <i>exclusive checkout</i> in Multi-User, where the datatype sizes for <b>long</b> has changed. This general script can be used
79-
whenever a program's base datatypes have changed in the compiler specification, which should be rare occurence.</P>
79+
whenever a program's base datatypes have changed in the compiler specification, which should be rare occurrence.</P>
8080

8181

8282
<H2>Open Source Based Graphing</H2>
8383
<P>Ghidra has been integrated with an open source graph visualization package, called JUNGGRAPHT, to display interactive
84-
block graphs, call graphs, AST control flow graphs, as well as a general API to create graphs within plugins and scripts.
85-
Prior to initial public release, graphing had been provided by a legacy graphing package which was un-releasable publicly due to
84+
block graphs, call graphs, AST control flow graphs, as well as a general API to create graphs within plug-ins and scripts.
85+
Prior to initial public release, graphing had been provided by a legacy graphing package which was unreleasable publicly due to
8686
licensing issues.</P>
8787

8888
<P>Graphs are displayed in a new tabbed graph window. Current location and selection of vertices are kept in sync with other
@@ -96,20 +96,20 @@ <H2>Open Source Based Graphing</H2>
9696
the creator of the graph before display. As in everything, the Ghidra team is interested in any feedback you might provide
9797
on this new capability.</P>
9898

99-
<H2>JAVA based Univeral PDB Reader/Analzyer/Loader</H2>
99+
<H2>JAVA based Universal PDB Reader/Analzyer/Loader</H2>
100100
<P>Added a new platform-independent PDB Reader/Analyzer/Loader that has the ability to process
101101
raw PDB files and apply extracted information to a program. Written in Java, PDBs can be utilized on any supported
102102
platform, not just on Windows as in prior Ghidra versions. PDBs can be applied during analysis
103103
or by loading and applying the PDB before analysis. Information from PDBs can be force-loaded into a program
104-
with a mismatched PDB signature, which is very useful for extracting data types to be used with the
104+
with a mismatched PDB signature, which is very useful for extracting datatypes to be used with the
105105
program from a PDB related to that program. Loading the PDB utilizes a new underlying Universal
106106
Reader API.</P>
107107
<P>The PDB Reader and Analyzer capabilities are an evolutionary development and are expected to be
108108
expanded in future releases. We expect to improve this feature over time, adding to its capabilities
109109
and fixing bugs. If the new PDB Analyzer causes issues, you can turn it off and use the original PDB Analyzer.</P>
110110

111111
<H2>Dynamic Modules: OSGI model for scripting</H2>
112-
<P>A change to scripting brings a powerful form of dynamic extensibilty to Ghidra scripting, where Java source code is (re)compiled, loaded, and
112+
<P>A change to scripting brings a powerful form of dynamic extensibility to Ghidra scripting, where Java source code is (re)compiled, loaded, and
113113
run without exiting Ghidra. When a script grows large or requires external dependencies, it might be worth the effort to split
114114
up code into modules. To support modularity while preserving the dynamic nature of scripts, Ghidra uses OSGi. The new feature
115115
provides better script change detection, external jar dependencies, script lifecycle management, and modularity.</P>
@@ -129,9 +129,9 @@ <H2>Decompiler</H2>
129129
</P>
130130
</ul>
131131
<P>The decompiler GUI as also been enhanced with the addition of multiple highlights of varying color, called secondary highlights. In addition,
132-
the Decompiler's Auto Create/Fill Structure commands incorporate data-type information from function prototypes
133-
and will override undefined or more general data-types with discovered data-types that are more specific.</P>
134-
<P>There is re-writen more comprehensive Decompiler documentation too!</P>
132+
the Decompiler's Auto Create/Fill Structure commands incorporate datatype information from function prototypes
133+
and will override undefined or more general datatypes with discovered datatypes that are more specific.</P>
134+
<P>There is rewritten more comprehensive Decompiler documentation too!</P>
135135

136136
<H2>Performance Improvements</H2>
137137
<P>There have been major performance improvements in both analysis and the display or filtering of information within GUI components.
@@ -140,12 +140,12 @@ <H2>Performance Improvements</H2>
140140
or binaries that take a large amount of time to process. If you can find an example binary that is easily obtainable that reproduces
141141
the issue, the root cause can be identified and hopefully improved. There are some continued sore performance areas we are still working
142142
such as the non-returning function analyzer. We hope you will find the binary analysis speed and interactivity much improved.</P>
143-
<P>Some specific areas of improvement are binaries with rich data type information, RTTI information, exception records, large number
143+
<P>Some specific areas of improvement are binaries with rich datatype information, RTTI information, exception records, large number
144144
of bytes, large number of defined symbols, and many symbols at a single address.</P>
145145

146146
<H2>Function Identification Improvements</H2>
147147

148-
<P>Function Identification databases have been re-created from scratch, including new information for Visual Studio 2017 and 2019 libraries.
148+
<P>Function Identification databases have been recreated from scratch, including new information for Visual Studio 2017 and 2019 libraries.
149149
The databases have been cleaned and should overall result in more matches with fewer mis-matched or multiple matches for identified functions.
150150
In addition the FID libraries had to be rebuilt from scratch due to errors or differences in instruction set decode (especially in the 64-bit X86)
151151
with prior versions of Ghidra. The FID is sensitive to the actual instruction bytes, the mnemonic, register, and number of operands.</P>
@@ -155,7 +155,7 @@ <H2>Function Identification Improvements</H2>
155155
For normal clean non-heavily optimized, non-malware or obfuscated binaries, these options should cause few issues.</P>
156156

157157
<H2>Symbol Demangling</H2>
158-
<P>Both GNU and Microsoft symbol de-mangling has been greatly improved resulting in fewer unmangled symbols with better function signature recovery.</P>
158+
<P>Both GNU and Microsoft symbol demangling has been greatly improved resulting in fewer unmangled symbols with better function signature recovery.</P>
159159

160160
<H2>Processor Models</H2>
161161
<P>Several new processor specifications have been added, from very old processors to more recent: CP1600, M6809, M8C, RISC-V, V850.</P>
@@ -178,16 +178,16 @@ <H2>Processor Specification</H2>
178178
you use with the Ghidra runtime, from the one you are using with the entire Ghidra source code base imported.
179179
To find out more read the <i>GhidraSleighEditor_README.html</i>.</P>
180180

181-
<P>The External Disassembler is a plugin useful when developing or trouble-shooting sleigh processor specifications. It is part of
182-
the Xtra SleighDevTools project. The plugin integrates with an external disassembler such as binutils, and provides a code browser
181+
<P>The External Disassembler is a plug-in useful when developing or trouble-shooting sleigh processor specifications. It is part of
182+
the Xtra SleighDevTools project. The plug-in integrates with an external disassembler such as binutils, and provides a code browser
183183
field that displays the disassembly from an external disassembler, such as bintutils, at each instruction or undefined byte in the listing.
184184
The only external disassembler integration provided is binutils, however it is possible to add support for additional external disassemblers.
185185
Previously the External Disassembler had trouble with instruction sets which have an alternate mode set of instruction
186186
such as Thumb or MicroMips. The working aide field has new configuration files to feed different options to the external disassembler
187187
to choose the correct alternate encoding set. This also works well with several scripts that also aide in processor development such as
188188
the <i>CompareSleighExternal</i> script.</P>
189189

190-
<P>A new pCode operation POPCOUNT is supported in sleigh processor specifications. POPCOUNT was mainly added to deal with instructions
190+
<P>A new p-code operation POPCOUNT is supported in sleigh processor specifications. POPCOUNT was mainly added to deal with instructions
191191
that needed to compute the parity of an operation.
192192
In addition, the Sleigh compiler error messages have been reworked to be more comprehensible, consistent in format layout, and to provide
193193
correct line numbers as close to the error as possible. In addition, several cases have been caught during compilation that previously would
@@ -199,35 +199,34 @@ <H2>Dynamic Analysis Framework - Debugger</H2>
199199

200200
<H2>Bug Fixes and Enhancements</H2>
201201
<P> Numerous other bug fixes and improvements are fully listed in the <a href="ChangeHistory.html">ChangeHistory</a> file.</P>
202-
203-
<BR />
202+
204203
<BR />
205204
<H1> What's New in Ghidra 9.1</H1>
206205

207206
<H2> <a id="finePrint91"/>The not so fine print: Please Read!</H2>
208207

209208
<P>Minor Note: Ghidra compiled .sla files are not backwards compatible due to the newly added OTHER space for syscalls
210-
support. In the pre-built ghidra all .sla files are re-built from scratch. However if you have local processor modules,
211-
or are building ghidra from scratch, you may need to do a clean build. You will get an error if an old .sla file is loaded
209+
support. In the prebuilt Ghidra all .sla files are rebuilt from scratch. However if you have local processor modules,
210+
or are building Ghidra from scratch, you may need to do a clean build. You will get an error if an old .sla file is loaded
212211
without recompilation of the .slaspec file. Any processor modules with changes are normally recompiled at Ghidra startup
213212
so this situation is rare.</P>
214213

215214
<H2>Data Improvements</H2>
216215

217-
<P>Bitfields within structures are now supported as a Ghidra data type. Bitfield definitions
216+
<P>Bitfields within structures are now supported as a Ghidra datatype. Bitfield definitions
218217
can come from PDB, DWARF, parsed header files, and can also be created within the structure
219-
editor. All Data type archives delivered with Ghidra have been re-parsed to capture bitfield
218+
editor. All Datatype archives delivered with Ghidra have been reparsed to capture bitfield
220219
information. In addition, compiler bitfield allocation schemes have been carefully implemented.
221220
Full support for bitfield references within the decompiler is planned for a future
222221
release.</P>
223222

224223
<P>In support of creating bitfields within structures, a new bitfield editor within the
225224
structure editor has been added. The Bitfield Editor includes a visual depiction of the
226-
data type byte layout and the associated bits. The BitField Editor simplifies the creation
225+
datatype byte layout and the associated bits. The BitField Editor simplifies the creation
227226
of bitfields within a structure.</P>
228227

229228
<H2>System Calls</H2>
230-
<P>Ghidra now supports overriding indirect calls, CALLOTHER pcode ops, and conditional jumps via new overriding references.
229+
<P>Ghidra now supports overriding indirect calls, CALLOTHER p-code ops, and conditional jumps via new overriding references.
231230
These references can be used to achieve correct decompilation of syscall-like instructions. A new script,
232231
ResolveX86orX64LinuxSyscallsScript, has been provided as part of this initial implementation.
233232
Future releases will automatically identify and apply system calls for other operating systems and versions.</P>
@@ -240,11 +239,11 @@ <H2>System Calls</H2>
240239
<H2>Processor Specification</H2>
241240

242241
<P>A new set of tools designed to make processor specifications easier to create, modify, and validate
243-
have been added. The tools consist of a context sensitive Sleigh file editor, a pcode validation
242+
have been added. The tools consist of a context sensitive Sleigh file editor, a p-code validation
244243
framework, an external disassembler field, and several scripts to make development easier.
245-
The Sleigh editor is a plugin for Eclipse and provides modern editor features such as syntax coloring,
244+
The Sleigh editor is a plug-in for Eclipse and provides modern editor features such as syntax coloring,
246245
hover, navigation, code formatting, validation, reference finding, and error
247-
navigation. The test suite emulates the pcode to automatically
246+
navigation. The test suite emulates the p-code to automatically
248247
validate the instructions most commonly used by the compiler for that processor.</P>
249248

250249
<H2>iOS DYLD and Macho Format</H2>
@@ -262,7 +261,7 @@ <H2>Ghidra Server</H2>
262261
connect to a 9.1 server.</P>
263262

264263
<P>The Ghidra server has two additional authentication methods, Active Directory using
265-
Kerberos and Plugable Authentication Modules (PAM) using JAAS. To utilize these new
264+
Kerberos and Pluggable Authentication Modules (PAM) using JAAS. To utilize these new
266265
methods you must configure the server.conf file and use either -a1 for windows authentication
267266
or -a4 along with -jaas. The JAAS mode will require setup of an additional configuration file (jaas.conf).</P>
268267

@@ -292,17 +291,17 @@ <H2>Decompiler</H2>
292291
primarily affects functions using floating point Neon instructions.</P>
293292

294293
<P>Renaming a parameter in the decompiler will no longer commit the
295-
data types of all parameters, allowing data
296-
types to continue to "float" without getting locked into a potentially
297-
incorrect initial data type. In addition, the cumbersome warning dialog
294+
datatypes of all parameters, allowing datatypes
295+
to continue to "float" without getting locked into a potentially
296+
incorrect initial datatype. In addition, the cumbersome warning dialog
298297
for renaming and retyping has been removed, improving your RE workflow.</P>
299298

300299
<H2>Languages</H2>
301300
<P>There are many new processor specifications including SuperH4, MCS-96,
302301
HCS12X/XGATE, HCS08, and user-contributed specifications for MCS-48,
303302
SuperH1/2a, and Tricore.</P>
304303

305-
<P>The 16-bit x86 processor specification has been re-worked to include
304+
<P>The 16-bit x86 processor specification has been reworked to include
306305
protected mode addressing, which the NE loader now uses by default. Handling of
307306
segmented or paged memory has been updated to use a newer scheme, hiding its
308307
complications from decompilation results. The implementation handles the HCS12X paging scheme as well.</P>
@@ -323,7 +322,7 @@ <H2>Ghidra Released to the Public!</H2>
323322
<P>In case you missed it, in March 2019, a public version of Ghidra was released for the first time. Soon after,
324323
the full buildable source was made available as an open source project on the NSA GitHub page. The response from the Ghidra
325324
Open Source community has been overwhelmingly positive. We welcome contributions from GitHub including bug fixes,
326-
requests, scripts, processor modules, and plugins. </P>
325+
requests, scripts, processor modules, and plug-ins. </P>
327326

328327
<H2> Bug Fixes and Enhancements</H2>
329328
<P> Bug fixes and improvements for 9.0.x are listed in the

0 commit comments

Comments
 (0)