Support for Unix-style "ar" archives

[gtackett]

Ghidra has the package ghidra.app.util.bin.format.coff.archive implementing a class with methods which are, I take it, for working with libraries of coff object modules.

It might be useful if Ghidra also had something comparable that would make it easy to work with unix-/linux-style ar archives consisting of elf or coff files.

arpy 1.1.2 already does a lot of the necessary work. It even works in Jython. But it doesn't implement any semantics specific for these two file formats. (Later versions of arpy exist that will work with Python 3.x.)

---

My suggestion is motivated by my work with Microchip's xc16 libraries, which they provide as ar archives. They give you two copies of each library, one containing coff objects, the other containing elf objects. For example, their math library is delivered as both libm-coff.a and libm-elf.a.

For my immediate purpose, which just requires getting a list of modules in an ar library, I can get by with arpy.

N.B.–I've only had a quick look at the Ghidra API for coff archives. Apart from that I don't know anything about coff file format, or about whatever kind of archive format the Ghidra API supports. I also don't really know much about the elf file format, but at least I have a smattering of knowledge and know of links to more.

[ryanmkurtz]

I was able to open both libc-coff.a and libc-elf.a as Ghidra FileSystems. Did you want a different kind of support?

[gtackett]

I could have been more specific. I haven't forgotten that you and I were importing these libraries using the Ghidra Program Manager. 😄

I'd like to have scripting access for them available through the Ghidra API.

I found the Ghidra package that I mentioned earlier that can handle coff archives (in some coff-native format, I guess), but nothing that corresponds to that for archives created by ar.

arpy gets me everything I need for now. I'm working on a script that will automatically/recursively find this kind of archive and generate headless scripts to import the individual libraries using the function ID prescript and postscript, specifying the base addresses for loading program and data memory.

Eventually I may also have the import script do essentially what your linking script does, but fine tuned using some of what I've learned about the way Microchip puts the xc16 libraries together. (It's a real mess.)

[dev747368]

FileSystemService is what you would use to open an ar (or other container format) and gain access to the files inside. Using this from a GhidraScript should not be an issue.

However, the headless analyzer does not currently support automatically iterating container files. Maybe that is what you are referring to?

[gtackett]

I'm scripting in Jython, and found arpy which I'm using to do the ar-specific dirty work for me,

But I've never looked in to FileSystemService, and now I'm interested in figuring that out as another possible approach. Thanks for mentioning it here!