Skip to content

Ghidra plugin for automatic struct definition extraction from executables.

Notifications You must be signed in to change notification settings

brocbyte/brocstruct

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

3 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

brocstruct

Brocstruct is a work-in-progress Ghidra script for automatic struct definition extraction from executables.

It is based on Ghidra's P-Code analysis and "theoretically" can work for all architectures supported by Ghidra itself.

The main idea is to track all LOAD/STORE accesses of the form *(arg + offset). For now it works inside functions only (no interprocedural analysis).

There are already more mature plugins/scripts to do the same:

About

Ghidra plugin for automatic struct definition extraction from executables.

Topics

Resources

Stars

Watchers

Forks