Skip to content

Let an analysis plugin provide the decompiler ##analysis - #26701

Closed
0verflowme wants to merge 1 commit into
radareorg:masterfrom
0verflowme:pr/anal-decompiler-provider
Closed

0verflowme wants to merge 1 commit into
radareorg:masterfrom
0verflowme:pr/anal-decompiler-provider

Conversation

@0verflowme

Copy link
Copy Markdown
Member

Lets an analysis plugin act as the decompiler provider, and adds the small set of things such a provider needs from radare2 rather than reimplementing them.

Provider API

  • RAnalPlugin.decompile: a callback that renders one RAnalFunction to an RCodeMeta. The best-scoring eligible plugin that has one is the provider (r_anal_decompiler_provider), and r_anal_decompile invokes it. Ties keep registration order.
  • pdd [name|addr] routes to the provider before the existing sdb fallback command, so pdc? and the fallback keep working when no provider is registered.

Facts the provider consumes

  • A dirty epoch on RAnalFunction and on the type database, bumped on the mutations that change typed metadata (variables, signatures, calling convention, bits, maxstack, type links, type loads). A provider uses it to know whether a cached result is stale.
  • r_anal_function_get_signature_current and r_anal_function_has_address_linked_signature_current: read-only signature queries that do not trigger type loading, for use while analysis holds the lock.
  • r_anal_cc_location_uses exported, case-insensitive on the register name, so a convention's roles can be matched against the registers a function touches.
  • stackalloc, redzone and retmech keys in the calling convention tables, and they are cleared with the rest of the layout on redefinition.
  • RBinBind.get_reloc_at and RBinBind.get_sym, so an analysis holding only the bind can ask what a relocated slot names.
  • RAnalPluginAnalysisDepth: aa, aaa and aaaa tell post-analysis hooks how much work is appropriate.

Alongside

  • afs prints the stored signature when one exists before formatting from variables.
  • afc <cc> goes through r_anal_function_set_callconv, which validates and bumps the epoch.
  • r_anal_function_delete refuses a function it does not own and honours R_ANAL_FUNCTION_DELETE_REFUSE from the delete callback.
  • aaa no longer re-imports DWARF when the bin layer declined for size; the size limit was being defeated on exactly the binaries it protects.
  • Plugin variable batches are validated before they touch the function and rolled back if a write fails.

Unit tests cover provider selection, the decompile wrapper and pdd routing (test_anal_decompiler), the epoch bumps (test_anal_function), and the DWARF integration test is registered in meson again.

Replaces #26646, which carried this together with the removal now in its own pull request.

An analysis plugin can now carry a decompile callback. The best-scoring
eligible plugin that has one is the decompiler provider; r_anal_decompile
hands it a function and returns the RCodeMeta it renders, and pdd routes
to it before the sdb fallback. The plugin receives the RAnalFunction
itself rather than a capture format shaped for one consumer.

Around that, the pieces such a provider needs from radare2 rather than
reimplementing them: a dirty epoch on functions and on the type database
so a provider can tell whether a cached result is stale; a read-only
signature query that does not trigger type loading, and a way to ask
whether a function has an address-linked prototype; r_anal_cc_location_uses
exported so a convention's register roles can be matched against what a
function touches; stackalloc, redzone and retmech keys in the calling
convention tables; RBin bind entries for the relocation at an address and
for the named binary symbols; and a post-analysis depth so aa, aaa and
aaaa can tell plugins how much work is appropriate.

Unit tests cover provider selection, the decompile wrapper and pdd routing.
@0verflowme
0verflowme force-pushed the pr/anal-decompiler-provider branch from 6d7be4f to b5f7922 Compare September 10, 2026 16:12
@trufae

trufae commented Sep 11, 2026

Copy link
Copy Markdown
Collaborator

Providing decompilers from anal is a design topic that it shouldnt be discused in a pr also this pr ships many more changes than just this thing

@0verflowme

Copy link
Copy Markdown
Member Author

Agreed on both counts, and withdrawn. r2sleigh does not register as a decompiler provider any more (it answers pd:s through a core plugin), so the provider API here has no user and does not need a design discussion on our side. The facts the plugin does read from libr/anal are now separate pull requests, one idea each: #26704 (cc table keys), #26705 (RBinBind lookups), #26706 (dirty epochs), #26707 (read-only signature query), #26708 (post-analysis depth). The hardening changes that rode along here are dropped.

@0verflowme 0verflowme closed this Sep 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants