[feat] API for per-function decompilation in Ghidra

[k4lizen]

The usecase is to decompile arbitrary regions of memory which do not correspond to a binary loaded in Ghidra. The usecase is decompiling relevant functions from many shared libraries, or kernel functions, which are not fesible to load in Ghidra.

It is definitely possible. There are three projects that do this that I know of:

• https://github.com/ant4g0nist/decompiler
• https://github.com/radareorg/r2ghidra
• https://github.com/rizinorg/rz-ghidra

[k4lizen]

Huh!

[mahaloz]

I agree it's possible. Here is how it should be done, should a person (or an AI) go to implement it:

Requirements

Most of the changes will be done inside of libbs.

Libbs Side

1. Add a new static decompile_blob API in the DecompilerInterface.

The function prototype should look like:

@staticmethod
def decompile_blob(self, blob: bytes, decompiler: str = "ghidra", **kwargs) -> Optional[Decompilation]:

This is static because we cannot initialize a decompiler normally using the DecompilerInterface for large or extreme binaries. As such, we implement this generic static method, and each subclassed implements how it will work.

2. For each subclass decompiler (ida, binja, ghidra, angr), implement the decompile_blob api that allows to load only a blob as the entire binary and then decompile that single function. A blob is just bytes. See angr use for a better description of how to load blobs.

3. Make a testcase in libbs that tests each version, verifying that non-empty decompilation

d2d Side

Implement the decompile_blob api in d2d, that takes a start addr and stop addr.