ghidra VS live-interface

[1] https://github.com/boricj/ghidra/tree/feature/elfrelocatebleobjectexporter

I've been working on a specific reverse-engineering technique called _unlinking_ [1] on-and-off for the past 16 months or so. I'm on my third prototype (first a set of Ghidra scripts written in Jython [2], then a fork of Ghidra [3] and now a Ghidra extension [4]) and I've started a blog in order to document it [5], which side-tracked into writing a whole series of articles on reverse-engineering to introduce the topic.

What for, you may ask? Basically I'm trying to decompile a PlayStation 1 video game and I've quickly decided that dealing alone with multiple +500 KiB executables of complete utter spaghetti code wasn't going to work. Instead, I've decided that I'd rather divide-and-conquer the problem, so I've been tooling up to split executables into relocatable object files, in order to decompile those one at a time and _Ship of Theseus_-style my way to success.

Ironically, all of that stuff is so not done that I don't even know what meaningful feedback there could be. My prototypes do work, but only for 32 bit little endian statically-linked MIPS executables. The articles on my blog are draft-quality. As for the decompilation project itself that started all of this, it hasn't seen much progress due to all of those side-quests. The overall topic is so esoteric that so far I've only managed to hear about one group of two persons that tried to do anything remotely similar and one another anecdotal account [6] that this particular skill is very uncommon among reverse engineers.

Personally, I'm starting to think that maybe I could've actually reverse-engineered and decompiled the game in the time I took to get here. I've also tried to engage with Ghidra to upstream the foundations of my modifications in my fork, but after some back-and-forth it became clear that my prototype-grade stuff wasn't industrial-grade and couldn't be merged in its current state, which is why I'm currently reworking the code in my fork as a Ghidra extension.

To those that want to provide feedback after reading all of this: beware, I've had a lot of fun going down that rabbit hole, but this is one hell of a time sink _and_ a particularly tricky mind-bender.

[1] I don't actually _know_ what's the actual name for this technique, given that there are so few resources on it out there. I do know I didn't invent it.

[2] https://github.com/boricj/ghidra-unlinker-scripts

[3] https://github.com/boricj/ghidra/tree/feature/elfrelocateble...

[4] https://github.com/boricj/ghidra-unlinker-extension

[5] https://news.ycombinator.com/item?id=36575081#36590078

[6] https://news.ycombinator.com/item?id=35729232&p=3#35740761

- The relocation synthesizer for MIPS: https://github.com/boricj/ghidra/blob/feature/elfrelocateble...

  - The Ghidra analyzer that leverages this synthesizer: https://github.com/boricj/ghidra/blob/feature/elfrelocatebleobjectexporter/Ghidra/Features/Delinker/src/main/java/ghidra/app/analyzers/RelocationTableSynthesizerAnalyzer.java

If you've got some nodejs, Ruby or Python projects and you want to keep them around for posterity then I recommend thinking how you can package them up so they can be safely archived. You could use docker or a virtual machine image.

In my editor project ( screncast https://github.com/samsquire/live-interface/blob/master/scre... )

In components written in Nodejs, Ruby and Python and they're all in disrepair because I failed to pin dependencies.

Also recommend taking lots of screenshots.

I created a text editor that was meant to be programmable like a spreadsheet but interactive like a IPython notebook.

There's screenshots here:

https://github.com/samsquire/liveinterface

The code is Angular 1 legacy codebase.

https://github.com/samsquire/live-interface

There's a screencast here https://github.com/samsquire/live-interface/blob/master/scre...

It's not buildable at this time due to dependencies...

At one point I tried creating what is Notion/Obsidian style system in 2013. I called it "living documents".

here's one of the last surviving screenshots of living documents version 1.

https://github.com/samsquire/interface-experiments/blob/mast...

The system accepted RDF N3 triples and it queried Jena Fuseki database to render graphs with d3. You could introduce facts into the system with the three boxes at the top. if you changed them, they would autocomplete and change the graph view. You could insert references or links into the document by typing them.

I have the code trapped in a JSBIN SQLite file. It's somewhere in here https://github.com/samsquire/jsbin It uses KnockoutJS.

Living documents v2 has a screen cast of it here https://github.com/samsquire/live-interface/blob/master/scre...