Skip to content

Latest commit

 

History

History
12 lines (8 loc) · 654 Bytes

README.md

File metadata and controls

12 lines (8 loc) · 654 Bytes

brocstruct

Brocstruct is a work-in-progress Ghidra script for automatic struct definition extraction from executables.

It is based on Ghidra's P-Code analysis and "theoretically" can work for all architectures supported by Ghidra itself.

The main idea is to track all LOAD/STORE accesses of the form *(arg + offset). For now it works inside functions only (no interprocedural analysis).

There are already more mature plugins/scripts to do the same: