Show HN: A Ghidra extension for exporting parts of a program as object files

304 points

2 years ago

This Ghidra extension unrelocates machine code through analysis and then synthesizes a working object file from a listing selection. It effectively turns computer programs into Lego bricks, to be torn down into pieces and reused into something new.

It supports the COFF and ELF object file formats, for the x86 and MIPS architectures. It has been successfully used on Linux, Windows and PlayStation executables. One user report is on a commercial video game from 2009 with a ~7 MiB Windows executable written in C++: it was delinked without its C runtime library and then relinked into a new executable at a different base address, with no visible change in functionality, as a prelude to a decompilation project.

Use-cases I've demonstrated on my blog include modding, making software ports, converting executable file formats, creating libraries... I've originally built this as part of a video game decompilation project ; I've been working on this over the past 2.5 years and recently it has started gaining some users besides me.

36 comments