Ghidra: Ablity to load external libraries after loading a project

[redragonx]

Is your feature request related to a problem? Please describe.
I'm not sure if it's currently possible to load external libraries after importing a file. When importing a file, you are able to load external libraries as shown below.

But what happens if you decided to analyze a library the code is calling, after the fact? E.G. Winsock

I don't see an option to analyze libraries in the codebrowser.

Describe the solution you'd like
Perhaps consider a menu entry in the analysis menu.

Additional context
Not sure if I'm missing something obvious?

[redragonx]

Apparently you could also just import the libraries and link them afterwards.

[Ristovski]

@redragonx Could you elaborate on the 'import and link afterwards'?
Is that a feature that Ghidra has (and if so, how does one "link" the library?), or is that just an idea of how it could be implemented?

[pedrib]

I'd like to add to this with some examples.

I have imported a binary into a Ghidra project and analysed it. After a while, I realised that winsock functions were not being recognised (shown as below):

I then added wsock32.dll as an external library and made Ghidra analyse it.

Now when you click the WSOCK function handle in the first image, it goes into this:

And then if you click on the red function name it goes into the correct function in wsock32.dll:

However, the function names in the binary listing (as shown in the first image) have not been updated.

[nemanjan00]

Hi, not sure if my problem is the same as this one.

I have batch imported full fs of device I am analyzing and all of the necessary libs are inside project.

But, when I analyze binary, all import are in EXTERNAL instead of appropriate lib and I can not see function code.

[mumbel]

@nemanjan00 once you have set all the shared libraries you care about to their external binary, you can run the FixupELFExternalSymbolsScript plugin

[nemanjan00]

@mumbel, thanks! Worked!

[Wall-AF]

How can we do the same for 16-bit Windows NE files?

[sollyucko]

FWIW, what worked for me is dragging the symbols from <EXTERNAL> to the correct library (ctrl+click and shift+click work).

[pedrib]

So here's a step by step guide on how to do this.

First open the "External Programs" window. You'll see the various imported libraries there. Right click, then select "Set External Name Association" and link it to the library (which you must have previously imported into Ghidra).

Then finally go to "Script Manager", then choose the "Symbol" folder and run "FixupELFExternalSymbolsScript.java".

Done!

PS: no idea if this works for Windows binaries (probably not given the name of the Java file).

[nemanjan00]

I think java is language plugin is written in

[draeath]

They are pointing at ELF in the filename, which is a Linux binary (contrast with, say, PE)

[pedrib]

Speaking of which, is there an equivalent solution for PE?