positivetechnologies/ghidra_nodejs

GHIDRA plugin to parse, disassemble and decompile NodeJS Bytenode (JSC) binaries

ghidra_nodejs

Description

GHIDRA plugin to parse, disassemble and decompile NodeJS Bytenode (JSC) binaries.

Supported NodeJS versions:

• v8.16.0 (x64) (V8 version: 6.2.414.77)
• v8.16.0 (x86) (V8 version: 6.2.414.77)

Build instructions

1. Clone the repo
2. Import the repo into Eclipse with GhidraDev plugin installed
3. Link Ghidra to your Ghidra's installation (option in the project's context menu)
4. Export & build plugin using the project's context menu. Eclipse will generate a resulting .zip archive with the plugin.
5. In Ghidra: File->Install Extensions...->Press green (Plus/+) button, then select previously generated .zip archive to install it. Press OK, then Restart Ghidra.
6. Drag-n-drop jsc files.

ghidra_nodejs's Issues

How can I debug in eclipse with this plugin?

I have done as follows:

1. Clone the repo
2. Import the repo into Eclipse with GhidraDev plugin installed
3. Link Ghidra to your Ghidra's installation (option in the project's context menu)
   Then I click "Run" in eclipse. Ghidra started then I drag "samples/ndoejs_x86/raw_x86.jsc" in it.
   However, it can't automatically distinguish language so I select v8 bytecode_x32, then console's output is

ERROR Language V8:LE:32:default does not specify a valid pcodeInjectLibraryClass (BasicCompilerSpec)  
ERROR Error Importing File: Error importing file: raw_x86.jsc (ImporterUtilities) java.lang.RuntimeException: Failed to instantiate v8_bytecode.V8_PcodeInjectLibrary for language V8:LE:32:default

Struggling to build

Not too familiar with eclipse any chance you can upload a built version to the repo? as I am struggling to build

Incompatible extension version

I've encountered an error that say 'extension version is incompatible with ghidra', is this due to me going wrong with the installation somewhere or what? I'd appreciate any assistance!

Other node versions support

First of all, amazing work on this add-on.

This is more a question then a issue, i wanted to know if you guys are planning on adding other versions of node JS and i was curious on how similar is the V8 bytecode from on version of node to the other.

I tried other versions of node that are not supported and as expected it did not work.

Thanks

V8 Snapshot Data Blobs

i tried to open v8::ScriptCompiler or V8 Snapshot Data Blobs using this ghidra node js plugin but failed. Do you know how to debug this v8 snapshot data?

Error fetching constant poolrecord

Hi! I get this error when decompiling. I installed the extension from the Releases tab. Maybe my v8 version is incompatible?

Low-level Error: Error fetching constant poolrecord: 
Cannot invoke "ghidra.program.model.util.ObjectPropertyMap.getObject(ghidra.program.model.address.Address)" 
because "map" is null

Why is bytecode different in x86 and x64 architectures

Bytecode should be platform-independent. Do you know why bytecode generation is different in different architectures? （This problem has nothing to do with this repo, it's just a technical consultation）:)

Language

When I try to dragndrop the file into ghidra I must specify a language, but what language do I need to provide?
You maybe got a way to get in contact with you?

Bug No Function

It didn't work for me, i tried this jsc and i get no Function

index.zip