Decompiler Plugin API

[aviciano]

Now, decompilers are implemented as core plugins, each with it's own commands. What about defining a decompiler plugin API and unify decompilation commands.

Something like:

Define API

typedef struct r_decompiler_t {
	// ...
} RDecompiler;

typedef struct r_decompiler_session_t {
   struct r_decompiler_t *rdecompiler;
   struct r_decompiler_plugin_t *plugin;
   void *data;
} RDecompilerPluginSession;

typedef void (*RDecompilerInit)(RDecompilerPluginSession *s);
typedef void (*RDecompilerFini)(RDecompilerPluginSession *s);

typededf struct r_decompiler_plugin_t {
	RPluginMeta meta;
	RDecompilerInit init;
	RDecompilerFini fini;
	// ...
} RDecompilerPlugin;

Group settings under decompiler.*

[0x00000000]> e??decompiler.*
              decompiler.plugin: set the plugin name to use when decompiling
           decompiler.r2dec.asm: if true, shows pseudo next to the assembly.
        decompiler.r2dec.blocks: if true, shows only scopes blocks.
         decompiler.r2dec.casts: if false, hides all casts in the pseudo code.
         decompiler.r2dec.debug: do not catch exceptions in r2dec.
     decompiler.r2dec.highlight: highlights the current address.
         decompiler.r2dec.paddr: if true, all xrefs uses physical addresses compare.
          decompiler.r2dec.slow: load all the data before to avoid multirequests to r2.
         decompiler.r2dec.xrefs: if true, shows all xrefs in the pseudo code.
      decompiler.r2ghidra.casts: Show type casts where needed
    decompiler.r2ghidra.cmt.cpp: C++ comment style
 decompiler.r2ghidra.cmt.indent: Comment indent
     decompiler.r2ghidra.indent: Indent increment
       decompiler.r2ghidra.lang: Custom Sleigh ID to override auto-detection (e.g. x86:LE:32:default)
    decompiler.r2ghidra.linelen: Max line length
 decompiler.r2ghidra.maximplref: Maximum number of references to an expression before showing an explicit variable.
     decompiler.r2ghidra.rawptr: Show unknown globals as raw addresses instead of variables
     decompiler.r2ghidra.roprop: Propagate read-only constants (0,1,2,3,4)
 decompiler.r2ghidra.sleighhome: SLEIGHHOME
    decompiler.r2ghidra.timeout: Run decompilation in a separate process and kill it after a specific time
       decompiler.r2ghidra.vars: Honor local variable / argument analysis from r2 (may cause segfaults if enabled)
    decompiler.r2ghidra.verbose: Show verbose warning messages while decompiling
...

Unify commands

[0x00000000]> s main
[0x00004dc0]> e decompiler.plugin = ?
pseudo
r2ghidra
r2dec
...
[0x00004dc0]> e decompiler.plugin = pseudo
[0x00004dc0]> pdc
[0x00004dc0]> e decompiler.plugin = r2ghidra
[0x00004dc0]> pdc
[0x00004dc0]> e decompiler.plugin = r2dec
[0x00004dc0]> pdc
[0x00004dc0]> pdco
[0x00004dc0]> pdca
[0x00004dc0]> pdcj

Port currently supported decompilers

• PseudoDecompiler
• decai
• r2dec
• r2ghidra
• r2jadx -> java/dalvik decompilation
• ctags -> use source ctags to show the source from disasm
• retdec -> available as a plugin and uses the pde
• pickledec -> decompiler for Python pickle blobs
• radeco -> experimental and abandoned esil based decompiler written in Rust
• r2snow -> snowman's decompiler only for intel architectures
• pdq -> r2papi-based decompiler on top of esil and the r2js runtime

Add new decompilers

• rev.ng

[trufae]

I though about the same many years ago. But didnt moved forward because of lack of time to priorize this. Maybe those plugins should be loaded from core? Or maybe we must have a separate module named r_deco to provide all those primitives? Imho “deco” looks better than the long name

one inconvient i find here is that we lose the ability to run multiple decompilers in one line without changing config vars. Not sure how well that will play if we run them in paralel either. So maybe pdc will require subcommands to hold them or maybe we need another root command handler for them or just keep the current approach for some time for backward compat. Pdc can run a different decompiler with cmd.pdc env var