Ghidra: Display function parameter in disassembly

Created on 27 Mar 2019  路  5Comments  路  Source: NationalSecurityAgency/ghidra

When disassembling code that call a known function with proper prototype, parameter and return value, it would be nice if Ghidra display when assigning a value to a register or pushing into the stack that they correspond to this or this parameter of the function called.

I probably have missed something, but can't find any option to enable that type of auto annotation.

If it does not exist that would be really nice to have. That can be done by hand, but still be tedious and easy to make a mistake.

Enhancement

Most helpful comment

There is an analyzer "WindowsPE x86 Propagate External Parameters" that will do this in a hard-coded manner for windows stack based programs. You need to enable it.

This doesn't do it on the fly, but it does work well. There have been discussions and possibly a prototype of doing this type of display generically.

All 5 comments

Do you mean naming of the arguments ?

If you choose the Edit Function , from the right click menu, you can edit the names assigned to the arguments.
Ghidra then uses those names whenever the registers associated with those args are used (assuming the registers have not then been reused)

No not naming arguments, or while I'm in the function itself, but in the area where the function is called. It would be nice if there were possibility to get hint on function parameters when pushed on the stack for example.

There is an analyzer "WindowsPE x86 Propagate External Parameters" that will do this in a hard-coded manner for windows stack based programs. You need to enable it.

This doesn't do it on the fly, but it does work well. There have been discussions and possibly a prototype of doing this type of display generically.

Would be nice :)

I was about to post a question regarding extending the "WindowsPE x86 Propagate External Parameters" option to x64, but it sounds like this enhancement covers it. If I'm not interpreting this correctly, please let me know.

Was this page helpful?
0 / 5 - 0 ratings

Related issues

chibicitiberiu picture chibicitiberiu  路  3Comments

Merculous picture Merculous  路  3Comments

awsaba picture awsaba  路  3Comments

huettenhain picture huettenhain  路  3Comments

tambry picture tambry  路  3Comments