All Classes and Interfaces
Class
Description
Splash screen window to display version information about the current release of
the Ghidra application.
Base class for DockingAction builders.
For use with the
AbstractActionBuilder.inWindow(When) method to specify which windows (main window
or secondary windows) a global tool bar or menu action will appear in.Base command class for adding memory blocks.
A base implementation of
Appender suitable for most cases.Defines a context-free grammar, usually for the purpose of parsing mnemonic assembly instructions
Defines a production in a context-free grammar, usually for parsing mnemonic assembly
The (often intermediate) result of assembly
Base for a node in an assembly prototype
Base class for generating prototype nodes ("states") from a parse tree node
Context to pass along as states are generated
The workhorse of semantic resolution for the assembler
A solver that handles expressions of the form
A [OP] BAn abstract p-code executor state piece for storing and retrieving bytes as arrays
Base class for many constraint editors, providing implementation for much of the interface.
A base implementation of
ColumnDisplay that knows how to figure out the column
type dynamically.A version of
ColumnDisplay to be used when the column value returned from
ColumnDisplay.getColumnValue(AddressableRowObject) is ComparableBase class for a variety of Complex data types of different sizes and types.
A base class to hold duplicate information for commands that create
structures.
Base dialog for choosing DomainFiles.
Base class for DataType classes.
Parent base class for types that represent things that refer to functions
Class for managing the visiting (processing) of a set of values where some values depend
on other values being process before them.
Abstract class that defines a panel for displaying name/value pairs with html-formatting.
A partial implementation of
Tool that serves as a place to share common functionalityBase class for creating a compact and efficient
DomainObjectListeners.An Table Column is an interface that should be implemented by each class that provides a field
(column) of an object based table (each row relates to a particular type of object).
This class is meant to be used by DynamicTableColumn implementations that do not care about
the DATA_SOURCE parameter of DynamicTableColumn.
ElfRelocationHandler provides the base class for processor specific
ELF relocation handlers.An abstract library of Linux system calls, suitable for use with any processor
An abstract file contained in an emulated file system
An abstract emulated file system, exported to an emulated user-space program
An abstract library of UNIX system calls, suitable for use with any processor
The errno values as defined by the OS simulator
A dialog that is meant to be extended for showing exceptions
Base implementation for expression matchers
The root type of an expression solver
Common base class for tasks that need to extract files from a GFileSystem location.
Default implementation of base file system functionality.
Only shows addresses to the code unit at the address for the current context.
Provides a definition of a Float within a program.
Base class for implementers of the FunctionComparisonModel.
A common base class for list and table renderer objects, unifying the Ghidra look and feel.
A convenience base class that combines the
GTableCellRenderer with the
GColumnRenderer interface.Base class for tests that provide some helper methods that are useful for tests that don't
require swing/gui support.
A convenience base class that combines the
GhidraTableCellRenderer with the
GColumnRenderer interfaceA job to transition vertices in a graph for location and visibility.
A job that provides an animator and callbacks for transitioning the visibility of
graph vertices.
A root for system tests that provides known system information.
Base class for tests that need swing support methods.
A base system action used for actions that show help information.
Base class for labels that render html using a custom rendering kit.
A base implementation of
LayoutProvider that stubs some default methods.An abstract base class for a LEB128 variable length integer data type.
A file system search path
An abstract executor state piece which internally uses
long to address contentsA map of address spaces to objects which store or cache state for that space
Use this when each S is possibly a cache to some other state (backing) object
Use this when each S contains the complete state for the address space
A base class for prompting users to enter a number into this dialog
Generates Offset fields
Classes that implement this interface can read various flavors of the OMF format
An abstract
Loader that provides support for programs that link to external libraries
with an ordinal mechanism.An abstract p-code formatter which can take a list of p-code ops or op templates and consistently
format them.
A result instructing the formatter whether or not to continue
An abstract implementation of
PcodeMachine suitable as a base for most implementationsAbstractPointerTypedefDataType provides an abstract BuiltIn datatype
implementation for a pointer-typedef datatype.A convenience base class for creating tests that use the default tool and open a program.
A convenience class that allows subclasses to signal that they implement
ProgramLocationTableColumn, but they do not want to be ExtensionPoints.An abstract
Loader that provides a convenience wrapper around
AbstractProgramLoader, minimizing the amount of work a subclass needs to do to load a
ProgramAn abstract
GhidraScriptProvider used to provide common functionality to different
types of Python script implementationsThis table field displays the bytes of the code unit at the ToAddress
for the reference or possible reference address pair
associated with a row in the table.
This table field displays the preview of the code unit at the ToAddress
for the reference or possible reference address pair
associated with a row in the table.
Allows the user to split a string using a regex as the delimiter.
An action used to trigger navigation callback on instances of
JTable.Base type for unsigned integer data types.
Table models should extends this model when they want sorting, potentially across multiple
columns, but do not want Threading or do not work on Program-related data (Address,
ProgramLocations, etc...).
An abstract file descriptor having no "offset," typically for stream-like files
Common base class for all Ghidra string
DataTypes.A base class to allow clients to buffer events.
An object that wraps a string and provides data that describes how to render
that string.
Abstract base class for reading theme values either in sections (theme property files) or no
sections (theme files)
A solver that handles expressions of the form
[OP]ABase type for unsigned integer data types.
Abstract base class for defined name/values in a
GValuesMap and whose values can be
edited in the ValuesMapDialog.An implementation of
VisualEdge that implements the base interface so subclasses
do not have to.A base layout that marries the Visual Graph and Jung layout interfaces.
A
VisualVertex implementation that implements most of the methods on the interfaceA base renderer class to define shared logic needed to render a vertex
Class to provide a map with weak values, backed by a given map
A weak value ref that also knows its key in the map.
Class to provide a navigable, e.g., tree-, map with weak values
A view of this same map that limits or changes the order of the keys
Base class that implements some methods of the WizardPanel, but not
all.
Class that uses a single thread to execute scheduled jobs.
A convenience interface of
GColumnRenderer for primitive-based/wrapper-based
renderers.Implements Accessible interfaces for individual fields in the field panel
Contains all the code for implementing the AccessibleFieldPanel which is an inner class in
the FieldPanel class.
There was an issue accessing the executor's state, i.e., memory or register values
The interface provides a mechanism for clients to pass around an object that is effectively
a 'results object', into which data can be placed as it is discovered.
A panel that displays inputs for key strokes and mouse bindings.
Builder for
DockingActionsDialog for displaying and invoking docking actions.
ActionContext is an interface used by
DockingActionIfs that contains tool and
plugin state information that allows an action to operate.An enum for specifying which actions should be displayed in the
ActionChooserDialog.This enum defines the actions category groups.
Model for the SearchList used by the
ActionChooserDialog.Note: this class overrides the
equals(Object) and relies upon the
equals method of the userData object.A class that exists primarily to provide access to action-related package-level methods of the
DockingWindowManager.Manages the global actions for the menu and toolbar.
Represents a way to trigger an action in the system.
Class to build an DependencyGraph base on a acyclic function call graph.
An implementation of
Emulator that wraps the newer PcodeEmulatorAn implementation of
MemoryState which wraps a newer PcodeExecutorState.Deprecated, for removal: This API element is subject to removal in a future version.
This class modifies the behavior of LongIntHashtable.
Action for adding all fields to the current format.
Command for adding Bit-mapped memory blocks.
Command for adding byte-mapped memory blocks
Dialog used to a label or to edit an existing label.
Command to update the name for an external program.
The action for adding a Field to the current format.
Command for adding a new memory block using bytes from an imported
FileBytes object.Command for assigning a tag to a function.
Command for adding a new memory block initialized with a specific byte.
Command to add a label.
Deprecated.
Command to add a memory variable to a function.
Command class to add a memory reference to the program.
AddMemRefsCmd adds a set of memory references from a
specified address and opIndex to all code units identified by a
set of addresses.Command class to add an offset memory reference to the program.
Deprecated.
function signatures should be modified in their entirety using
either
UpdateFunctionCommand or ApplyFunctionSignatureCmd.Deprecated.
function signatures should be modified in their entirety using
either
UpdateFunctionCommand or ApplyFunctionSignatureCmd.Command class to add a register reference to the program.
Command to add a register variable to a function.
An object that represents and add, remove or change operation for one row of a table
An address represents a location in a program.
This class provides a
ByteSequence view into an AddressableByteSource.Interface for reading bytes from a program.
An annotated string handler that allows handles annotations that begin with
AddressAnnotatedStringHandler.SUPPORTED_ANNOTATIONS.This table model of addresses is used when you already have an
Address array built.
Implementation of IndexMapper that uses an old and new AddressIndexMap to map indexes
when the AddressIndexMap changes.
AddressBasedLocation provides the ability to render and compare
addresses (e.g., location table column).Converts AddressBasedLocation Column objects to Address so that column gets Address type column
filters
Interface for an Address Change set.
Utilities for using addresses and ranges in streams
Interface representing the address mapping for any means of correlating addresses
between a source program and a destination program.
A simple object that holds an
AddressCorrelation address range and then name of the
correlation.sInterface for address correlation algorithms that can generate an address mapping from one
set of program addresses to another.
An auxilliary arithmetic that reports the union of all addresses read, typically during the
evaluation of an expression.
The
AddressEvaluator class provides a way to evaluate a string
that represents an address and resolve it to an address for a particular program.Simple interface for getting an address factory.
Generates Address Fields.
The
AddressFieldLocation class provides specific information
about a program location within the ADDRESS field.An option class that allows the user to edit a related group of options pertaining to
address field display.
An AddressFormatException is thrown when a string that is
supposed to be an address representation cannot be parsed.
Iterator of indexed fields that are addresses.
This class maps a set of address ranges into a contiguous set of indexes from 0 to the
total size of the address set.
Long iterator over indexed addresses.
Panel for user input of addresses.
AddressIterator is used to iterate over some set of addresses.
Converts an AddressKeyIterator or an addressKeyAddressIterator into an AddressIterator
Iterator of primary keys that are addresses.
Returns a RecordIterator over records that are address keyed.
AddressLabelInfo is a utility class for storing
an Address together with a corresponding language-defined
label or alias that is within the global namespace which is
established with a SourceType of IMPORTED within a program.Container for holding an address and label.
Address map interface add methods need by the program database implementation to manage its address map.
Class used to map addresses to longs and longs to addresses.
AddressMapImpl provides a stand-alone AddressMap.AddressObjectMap maintains a mapping between addresses in the program
and Objects that have been discovered.An AddressOutOfBoundsException indicates that the Address is
being used to address Memory which does not exist.
An AddressOverflowException occurs when an attempt to
add or subtract a displacement would result in a value which
is outside the address space.
Table model that shows a location, label, and a preview column to
show a preview of the code unit.
Stores information about an address in a program.
The AddressRange interface is used by any object
that represents a contiguous inclusive range of
addresses from a minimum address to a maximum
address.
A class to break a range of addresses into 'chunks' of a give size.
A class for selecting whether to use the min address or the max address of an
AddressRange for address range table columnsImplementation of an AddressRange.
AddressRangeIterator is used to iterate over some set of addresses.
AddressRangeMapDB provides a generic value range map backed by a database table.Associates objects with address ranges.
AddressRangeIterator that takes a single address range and breaks it down into smaller
address ranges of a specified maximum size.Compares an address against an AddressRange.
Static methods to delete records from a table.
Class for storing sets of addresses.
This interface represents a collection of AddressSets (actually AddressSetViews).
ComparisonData for a generic set of addresses.
Interface for being notified whenever the set of visible addresses change in the listing.
Class that provides random access to
Addresses in an AddressSet, based on the index of the address in the set, not the address offset value.Defines methods to mark ranges in a property map.
AddressSetPropertyMap that uses a RangeMapDB to maintain a set of addresses.
Defines a read-only interface for an address set.
This class wraps an address set and provides read-only access to that set.
Provides information about the source of a byte value at an address including the file it
came from, the offset into that file, and the original value of that byte.
The AddressSpace class is used to represent a unique context for addresses.
This table field displays Address associated with a row in the table.
This table column displays Data for the address table associated with a row in the table.
This table field displays size of the address table associated with a row in the table.
Exception thrown when an attempt is made to translate an address
from one program into an equivalent address in another program.
Value class for
Address types.Utility class for the myriad ways of marshaling/unmarshaling an address and an optional size,
to/from XML for the various configuration files.
Command class to add a shifted memory reference to the program.
Action for adding SpacerFields to a FieldModel
Deprecated.
function signatures should be modified in their entirety using
either
UpdateFunctionCommand or ApplyFunctionSignatureCmd.Command class for adding stack references to a program.
Command to add a stack variable to a function.
The AddToProgramDialog is essentially the same as the ImporterDialog with a few exceptions.
Command for adding uninitialized memory blocks
Deprecated.
The need for this class is now unnecessary since duplicate labels are permitted
Indicates that the tagged method should be executed after the structure has been created
and its data read into its structure mapped fields.
AIFF / AIFC header format:
AlignedStructureInspector provides a simple instance of a structure
member container used to perform alignment operations without forcing modification
of the actual structure.AlignedStructurePacker provides support for performing aligned packing
of Structure components.StructurePackResult provides access to aligned
packing resultsSearch filter that can test a search result and determine if that result is at an address
whose offset matches the given alignment (i.e.
AlignmentType specifies the type of alignment which applies to a composite data type.ByteSearch post search rule when a pattern is found.
Hash function hashing all the bytes of an individual Instruction
ThemeEvent for when a new theme is set or the current theme is reset to its original
values.Class to specify priority within the Automated Analysis pipeline.
Launcher entry point for running headless Ghidra.
Interface to perform automatic analysis.
AnalyzerType defines various types of analyzers that Ghidra provides.
A representation of a help location, which can be a file or a file with an anchor inside of
that file.
Form a new expression by ANDing two PatternExpressions
Solves expressions of the form
A & BLogically AND multiple QualifierFilters together into a single filter.
Combines two queries such that this query is the logical "AND" of the two queries.
AndroidElfRelocationTableDataType provides an implementation of
an Android APS2 packed ELF relocation table.An interface used with
AnimationUtils to allow clients to use the timing
framework while performing their own painting.A class that does basic setup work for creating an
Animator.A syscall library wherein Java methods are exported via a special annotated
An annotation to export a method as a system call in the library.
An interface for handling mouse clicks on
AnnotatedTextFieldElements.A userop library wherein Java methods are exported via a special annotation
A wrapped, annotated Java method, exported as a userop definition
An annotated userop with a fixed number of arguments
An annotation to receive the executor itself into a parameter
An annotation to receive the complete library into a parameter
An annotation to receive the output varnode into a parameter
An annotation to receive the executor's state into a parameter
An annotation to export a Java method as a userop in the library.
An annotated userop with a variable number of arguments
A handler to process
AnnotatedTextFieldElement clicks.NOTE: ALL AnnotatedStringHandler CLASSES MUST END IN "StringHandler".
A subclass of
FieldElement that allows for mouse handling callbacks via the
AnnotatedTextFieldElement.handleMouseClicked(Navigatable, ServiceProvider) method.Exception thrown by the annotations classes.
NOTE: ALL AnnotationHandler CLASSES MUST END IN "AnnotationHandler".
Some utilities for reflection using annotations
A matcher which accept any expression of the required type
A table that allow users to provide a list of data objects whose method can be used
to create columns.
Basic FunctionComparisonModel where a set of functions can be compared with each other
Interactive utility to discover and delete artifacts that Ghidra lays down on the filesystem
Command to append a specific type of comment on a code unit.
Class with static methods to maintain application info, e.g., a handle to the
tool that is the Ghidra Project Window, the user's name, etc.
The Application class provides a variety of static convenience methods for accessing Application
elements that can be used once the
Application.initializeApplication(utility.application.ApplicationLayout, ghidra.framework.ApplicationConfiguration) call has been made.Class to represent an application's unique identifier.
ApplicationKeyManagerFactory provides application keystore management
functionality and the ability to generate X509KeyManager's for use with an SSLContext
or other PKI related operations.ApplicationKeyManagerUtils provides public methods for utilizing
the application PKI key management, including access to trusted issuers
(i.e., CA certificates), token signing and validation, and the ability to
generate keystores for testing or when a self-signed certificate will
suffice.The Application Layout base class defines the customizable elements of the application's
directory structure.
Marker interface to indicate this plugin is application-level tools only (see
ApplicationLevelPlugin).Marker that signals the implementing plugin can be added to the system at the application level.
The application properties.
ApplicationSSLSocketFactory provides a replacement for the default
SSLSocketFactory which utilizes the default SSLContext established
by SSLContextInitializer.Provides theme default values, such as those loaded from
*.theme.property files.This is the fully functional
ThemeManager that manages themes in a application.ApplicationTrustManagerFactory provides the ability to establish
acceptable certificate authorities to be used with SSL connections and PKI
authentication.Utility class for default application things.
Class to represent an application's version information.
Apply all function signature data types in a data type manager to
any user defined label that has the same name as the function
signature.
Command to create apply a function signature at an address.
An interface to be implemented by any class that can return a list of Archives.
Command object for performing Arm/Thumb disassembly
Array interface
Base interface for Defining methods for managing a "virtual" array of some data type.
Basic implementation of the Array interface.
ArrayStringable identifies those data types which when formed into
an array can be interpreted as a string (e.g., character array).The down arrow should move the selection down one row.
The down arrow should move the selection down one row.
The up arrow should move the selection up one row.
The up arrow should move the selection up one row.
An edge shape that renders as a series of straight lines between articulation points.
An implementation of exporter that creates
an Ascii representation of the program.
Utilities for the Assembler
The primary interface for performing assembly in Ghidra.
An interface to build an assembler for a given language
The primary class for obtaining an
Assembler for a Ghidra-supported language.A convenience for accumulating bytes output by an
AssemblerDescribes a SLEIGH constructor semantic
The state corresponding to a sub-table operand
The generator of
AssemblyConstructState from AssemblyParseBranchA graph of possible context changes via the application of various constructors
A transition in a context transition graph
A vertex in a context transition graph
A class that computes the default context for a language, and acts as a pseudo context
A terminal that accepts the end of input
An exception for programmer errors regarding an assembler
A checked exception used for input errors regarding the assembler
Defines an "extended" grammar
The type of non-terminal for an "extended grammar"
Defines a production of an "extended" grammar
A class to compute the first and follow of every non-terminal in a grammar
A terminal that accepts only a particular numeric value
A tree of generated assembly node states, paired with the resulting patterns
Defines a context free grammar, used to parse mnemonic assembly instructions
An exception to identify errors associated with grammar construction
The generator of
AssemblyConstructState for a hidden sub-table operandThe type of non-terminal for an assembly grammar
The generator of
AssemblyOperandState for a hidden value operandA terminal that accepts only a particular set of numeric values, mapping each to another value
A context to hold various symbols offered to the assembler, usable where numbers are expected.
A terminal that accepts any numeric value or program symbol (label, equate)
The state corresponding to a non-sub-table operand
The generator of
AssemblyOperandState from AssemblyParseNumericTokenA successful result from parsing
The Action/Goto table for a LALR(1) parser
An ACCEPT (acc) entry
An action in the Action/Goto table
A GOTO (Gn) entry
A REDUCE (Rn) entry
A SHIFT (Sn) entry
A branch in a parse tree, corresponding to the application of a production
An unsuccessful result from parsing
A class that implements the LALR(1) parsing algorithm
A token having a numeric value
A class to encapsulate LALR(1) parsing for a given grammar
A map key used to identify merges for Step 4 in Stephen Jackson's rant
The map value keyed by
AssemblyParser.MergeKeyA result of parsing a sentence
A state in an LR(0) parsing machine
An item in the state of an LR(0) parser
A string token
The transition table defining an LR(0) parsing machine
A node in a parse tree
The analog of
PatternBlock, designed for use by the assemblerDefines a production for parsing mnemonic assembly
A set of possible assembly resolutions for a single SLEIGH constructor
Thrown when a programmer selects an improper instruction during assembly
Provides a mechanism for pruning and selecting binary assembled instructions from the results of
parsing textual assembly instructions.
A resolved selection from the results given to
AssemblySelector.select(AssemblyResolutionResults, AssemblyPatternBlock)Thrown when all resolutions of an assembly instruction result in semantic errors.
A "string" of symbols
The token consumed by a whitespace terminal when it anticipates the end of input
The token consumed by a whitespace terminal
A terminal that accepts only a particular set of strings, mapping each to a numeric value
A terminal that accepts only a particular string
A symbol in a context-free grammar
Thrown when all parses of an assembly instruction result in syntax errors.
The type of terminal for an assembly grammar
AssertException is used in situations that the programmer believes can't happen.An action that assigns an Address to a function prototype parameter
A request for the address of either return storage or an input parameter is made
through the assignAddress() method, which is given full information about the function prototype.
Generates Variable Assignment Fields (point of first-use).
Represents a Swift AssociatedTypeDescriptor structure
Represents a Swift AssociatedTypeRecord structure
Command class for associating a reference with a specific label
Column Constraint where acceptable column values are greater than or equal to some specified
value of the column type.
Column Constraint where acceptable column values are greater than or equal to some specified
value of the column type.
Column Constraint where acceptable column values are less than or equal to some specified
value of the column type.
Column Constraint where acceptable column values are greater than or equal to some specified
value of the column type
Base class for attributes -- int, double, or String values -- which can
be assigned to the members of a KeyIndexableSet, e.g.
Generic directed graph edge implementation
Basic graph implementation for a directed graph whose vertices and edges support attributes.
Interface for exporting AttributedGraphs
An object that wraps a string and provides data that describes how to render
that string.
Graph vertex with attributes
An annotation for a data element being transferred to/from a stream
This class parallels the XML concept of an attribute on an element.
Class which creates and keeps track of attributes defined
for a single KeyIndexableSet.
An editor that provides suggestions of values that, according to
StringColumnConstraint, match a user-supplied
pattern.
This is a default list cell renderer for the
TextFieldAutocompleter suitable for
extension if a user wishes to customize it.An event related to autocompletion, usually a completion being activated by the user.
A listener for autocompletion events.
A model to generate the suggested completions, given a viable prefix.
A marker interface to signal that the implementing action is temporary and gets built
automatically by the tool
Utility methods to do
Program imports automatically (without requiring user interaction)A class that holds the logic and state for finding matching rows in a widget when a user types
in the widget.
The
AutomaticCommentFieldLocation class contains specific location information
within the automatic comment of an EOL comment field of a CodeUnitLocation object.AutoParameterType defines the various
types of auto-parameters.Helper class for autoscrolling on a component.
An auxiliary emulator parts factory for stand-alone emulation
A stand-alone emulator whose parts are manufactured by a
AuxEmulatorPartsFactoryThe default thread for
AuxPcodeEmulatorAbstract command that will be run in a thread (in the background) other than the AWT(GUI)
thread.
Provides an implementation of a data type that is not valid (bad) as it is used in
the program.
BadLinkException occurs when a link-file expected linked content type does not
match the actual content type of the linked file.A class to represent the
IMAGE_BASE_RELOCATION
data structure defined in winnt.h.Points to the base relocation information.
Fetches DWARF sections from a normal program using simple Ghidra memory blocks.
This BlockModel implements the Basic block model.
BasicCompilerSpec implements the CompilerSpec interface based on static information
from a particular .cspec file.
A class to override the default edge label placement.
A group of
LoadSpecs (possibly from different user added sources)
that have a common BatchSegregatingCriteria.This is the main state of a batch import task, containing the segregated groupings of
applications.
Set of identifying pieces of info that allow us to segregate files that we are
importing into groups.
Helper class to convert a byte array to Java primitives and primitives to a
byte array in Big endian.
An IEEE 754 floating point class.
DialogComponentProvider that provides information to create a modal dialog
to prompt for a number larger than an
int or long to be input by the user.NOTE: ALL BinaryAnalysisCommand CLASSES MUST END IN "BinaryAnalysisCommand".
Allows various non-database supported data types to be
encoded within a BinaryField which may be stored within the
database.
An
Exporter that can export memory blocks as raw bytesBase class for binary operators that combine PatternExpressions
A matcher for a binary expression
A matcher for binary expression allowing commutativity
BinaryField provides a wrapper for variable length binary data which is read or
written to a Record.A class for reading data from a
generic byte provider in either big-endian or little-endian.
Reads and returns an object from the current position in the specified input stream.
Reads and returns an object from the current position in the specified BinaryReader.
A Mach-O binding table
A piece of binding information from a
BindingTableBind opcodes
BitFieldDataType provides a means of defining a minimally sized bit-field
for use within data structures.Class used to organize long values into sets of values with overlapping bits.
Definition of a Bitmap Resource Data Structure defined within the
resources section of a windows executable.
The BitTree class maintains a set of ordered keys between the values of
0 and N.
This class holds basic-block information for matching algorithms.
Block representing and '&&' or '||' control flow path within a conditional expression
possible multiple incoming edges
2 outgoing edges, one for true control flow, one for false control flow
one "initial" condition block, with 2 outgoing edges
one "secondary" condition block, with 2 outgoing edges, exactly 1 incoming edge from "initial"
Placeholder for a basic block (BlockBasic) within a structured
control-flow graph.
Do-while block:
possible multiple incoming edges
1 (implied) edge outgoing back to itself
1 edge outgoing (the loop exit)
1 block representing the body of the loop
A "plain" goto block
possible multiple incoming edges
no outgoing edges
1 (implied) outgoing edge representing the unstructured goto
A block (with in edges and out edges) that contains other blocks
A standard if/else control flow block
possible multiple incoming edges
1 outgoing edge - going to the common out block rejoining the 2 control flows
1 "condition" block with exactly 2 outputs
1 "true" block representing the control flow if the condition is true
1 "false" block representing the control flow if the condition is false
Block representing an if () goto control flow
possible multiple incoming edges
1 output edge if the condition is false
1 (implied) output edge representing the unstructured control flow if the condition is true
1 block evaluating the condition
Block representing an infinite loop
possible multiple incoming edges
no outgoing edges
1 (implied) outgoing edge representing loop to the top control flow
1 interior block representing the body of the loop
Block representing a sequence of other blocks
possible multiple incoming edges
1 outgoing edge
1 or more interior blocks that are executed in sequence
Service for providing block models.
Listener interface for BlockModelService.
A block representing a 2-or-more control flow branchpoint
possible multiple incoming edges
1 or more outgoing edges (as in switch control flow)
2 or more (implied) outgoing edges representing unstructured branch destinations (switch case with goto statement)
1 interior block representing the decision block of the switch
A block containing condition control flow
possible multiple incoming edges
1 outgoing edge representing rejoined control flow
2 interior blocks
one "condition" block representing the decision point on whether to take the conditional flow
one "body" block representing the conditional flow that may be followed or may be skipped
A feature rooted in a basic block.
BlockStartLocation provides information about the location
(within a program) of an object that represents the start of a memory block.BlockStream provides a BufferFile block stream.A block representing a switch construction
possible multiple incoming edges
1 outgoing edge representing all the interior control flow cases coming back together
1 interior block representing the decision point with outgoing edges to the different cases (or the exit block)
multiple interior blocks for each "case" of the switch
cases must exactly 1 outgoing edge to the common exit block or have no outgoing edges
Block representing a while-do (exit from the top) loop construction
possible multiple incoming edges
1 outgoing exit edge
1 (implied) loop edge
1 interior block representing the top of the loop and the decision point for staying in the loop
1 interior block representing the body of the loop, which always exits back to the top of the loop
Interface for bookmarks.
Provides an ordering for bookmarks.
Interface for managing bookmarks.
Interface for bookmark types.
Provides an ordering for bookmark types.
Data structure to set bits to indicate in use.
A constraint editor for Boolean-type constraints, offering a choice of boolean values.
Provides a definition of an Ascii byte in a program.
An editor for Boolean properties.
BooleanField provides a wrapper for boolean data which is read or
written to a Record.Column Constraint for boolean values where the column values must match the constraint value
of either true of false.
Provides boolean related column constraints.
A Java property value for keys that use boolean values.
The inteface for SettingsDefinitions that have boolean values.
Value class for
Boolean types.InputStream wrapper that limits itself to a portion of the wrapped stream.Bounded range factory for formatters with a min and max allowed value.
Points to an array of IMAGE_BOUND_IMPORT_DESCRIPTORs.
A class to represent the
IMAGE_BOUND_IMPORT_DESCRIPTOR
data structure defined in winnt.h.A class to represent the
IMAGE_BOUND_FORWARDER_REF
data structure defined in winnt.h.Implements an iterator over all GTreeNodes in some gTree (or subtree).
A button meant to be used to show a chooser dialog.
BrowserCodeUnitFormat provides a code unit format based upon
a common set of viewer Options for specific Tool.BrowserLoader opens a web browser and displays the given url.
Buffer provides a general purpose storage buffer interface
providing various data access methods.A class that run the client's runnable on the Swing thread.
BufferFile facilitates read/write access to buffer oriented file.BufferFileAdapter provides a BufferFile implementation which
wraps a BufferFileHandle.BufferFileBlock is used to hold BufferFile blocks
for use during block streaming operations.BufferFileHandle facilitates access to a BufferFileBufferFileManager provides an interface for a
BufferFile manager who understands the storage for the various
versions of BufferFiles associated with a single database.BufferMgr provides low-level buffer management and caching.A
SearchLocation that expects the external debug files to be named using the hexadecimal
value of the hash of the file, and to be arranged in a bucketed directory hierarchy using the
first 2 hexdigits of the hash.Represents a build_version_command structure
NOTE: ALL DATATYPE CLASSES MUST END IN "DataType".
NOTE: ALL DATATYPE CLASSES MUST END IN "DataType".
An exclusion filter to use when searching for classes that implement
BuiltInDataTypeData type manager for built in types that do not live anywhere except
in memory.
Database adapter for managing built-in data types.
Represents a Swift BuiltinTypeDescriptor structure
Exception thrown if an operation cannot be done because the tool has background tasks
running.
Listener that is notified when a mouse button is pressed.
Defines one "state" for a
MultiStateButton.Array of bytes that grows as needed.
Array of byte[] that grows as needed.
An interface to convert from a object to a
byte array.
An implementation of
ByteProvider where the underlying bytes are supplied by a
byte array.Base class that can copy bytes into a Transferable object, and paste
bytes into a program.
Provides a definition of a Byte within a program.
ByteField provides a wrapper for single signed byte data
which is read or written to a Record.An object that can ingest bytes from a stream in preparation for decoding
ByteMappingScheme facilitate byte mapping/decimation scheme for a mapped sub-block to
an underlying source memory region.ByteMatcher is the base class for an object that be used to scan bytes looking for sequences
that match some criteria.
Record class to contain a match specification.
Simple byte buffer implementation of the memBuffer.
An interface for a generic random-access byte provider.
An
InputStream that reads from a ByteProvider.An
InputStream that reads from a ByteProvider, and DOES
close() the underlying ByteProvider when
closed itself.Wraps a
ByteProvider and presents it as an InputStream.A
ByteProvider constrained to a sub-section of an existing ByteProvider.A concrete in-memory bytes store for simulated file contents
A concrete in-memory file system simulator suitable for UNIX programs
A concrete in-memory file suitable for UNIX programs
An interface for accessing bytes from a byte source.
Generates Bytes Fields.
Provides specific information about the bytes field within a program location.
LazyImageIcon that is created from a byte arrayA p-code arithmetic that operates on concrete byte array values
A state composing a single
BytesPcodeExecutorStatePieceA plain concrete state piece without any backing objects
A p-code executor state space for storing and retrieving bytes as arrays
A simple p-code thread that operates on concrete bytes
This table field displays the bytes for the code unit beginning at the address
associated with a row in the table.
ByteStreamCharMatcher are state machines used to look for char sequences within a stream of bytes.
ByteTrie is a byte-based trie specifically designed to implement the Aho-Corasick
string search algorithm.
Class to represent a (possibly non-terminal!) node within the ByteTrie.
An Encoder that holds its bytes in memory (where they can possibly be edited) and
can then finally write them all to an OutputStream via a call to writeTo()
Caches passwords used to unlock a file.
A thread-safe pool that knows how to create instances as needed.
Class for managing the creation of some slow loading object that may be used by multiple threads,
including the Swing thread.
A generic functional interface that is more semantically sound than
Runnable.An implementation of
Accumulator that allows clients to easily process items as
they arrive.Given a function in a program or the start of a function, record information
about the change to a stack pointer from a subroutine call.
A p-code userop invocation expression
An object that describes a component to be 'called-out'.
An
Iterator wrapper that allows clients to use a task monitor to cancel iterationCancelledException indicates that the user cancelled
the current operation.A monitor that is designed for sub-tasks, where the outer task handles reporting messages and
progress.
Represents a Swift CaptureDescriptor structure
Capture all selected function signature data types from the current program and put them
in the data type manager.
Listener that is notified when the CaptureFunctionDataTypesCmd completes.
Represents a Swift CaptureTypeRecord structure
Combines two drop targets and sends events to them in priority order.
CaseInsensitiveByteTrie is a byte-based trie specifically designed to implement the Aho-Corasick
string search algorithm, matching alphabetic characters ignoring case.
Class to represent a (possibly non-terminal!) node within the CaseInsensitiveByteTrie.
Comparator for sorting Strings in a case insensitive way except that case insensitive duplicates
are then sub-sorted by reverse case so that lower case is before upper case.
Each data type resides in a given a category.
A category path is the full path to a particular data type
Built-in GTheme that uses the Motif
LookAndFeel and the standard (light)
application defaults.An icon that will update it's x,y offset to be centered over another, presumably larger
icon.
Values for type CFragLocatorKind.
Values for type CFragUsage
If the fragment is an application, appStackSize indicates
the application stack size.
DBBuffer provides storage for large data objects utilizing a common
buffer management system.Dialog to prompt user to save files before adding files to source control
or checking in files.
Updates the name or comment field for a given function tag
ProgramEventerface to define event types and the method to generate an
event within Program.
Empty implementation for a ChangeManager.
ChangeMap facilitates the decoding of change-data
to determine if a specific buffer was modified by the
corresponding buffer file version.ChangeMapFile tracks which buffers within a LocalBufferFile
have been modified between an older and newer version.Generic marker to denote changes made to some object.
A class for bidirectional iteration over a string.
Provides the ability to split a string using a single character as the
delimiter, interpreted as a regex.
Provides a definition of an primitive char in a program.
Additional information about
java.nio.charset.Charset's that
Ghidra needs to be able to create Ghidra string datatype instances.SettingsDefinition for setting the charset of a string instance.CheckinHandler facilitates application callbacks during
the check-in of a DomainFile.Task to perform a check on a list of DomainFiles.
Dialog for viewing all the current checkouts for a single domain file.
Panel that shows check out information for a domain file.
ChecoutType identifies the type of checkoutThis algorithm is an implementation of the Cooper, Harvey, Kennedy algorithm.
This is
ChkDominanceAlgorithm with reverse graph traversal, which allows the
algorithm to calculate post dominance.Abstract class for a GUI panel that allows the user to select choices for
resolving conflicts.
Value class for selecting from a restricted set of
Strings.Panel that displays an animation of the Ghidra dragon eating bits.
A chunk represents the basic unit of text that is displayed in the
FVTable.A class that simplifies some the concurrent datastructure setup required for decompiling
functions.
Stores all chunks read-in by the
ChunkReader.This class handles reading data from the input file, in the form of
Chunk objects.A Common Information Entry (CIE) holds information that is shared among many
Frame Description Entries (FDEs).
Provides GCC exception handling model classes the means to obtain a Common Information Entry
(CIE) object for a given address.
CircularDependencyException is thrown in cases where
an action would cause the program's module structure to have a
"cycle", that is to have two module which are both ancestors and
descendants of each other.A line break in source code plus the indenting for the following line.
A token representing a switch "case" label, or other constant not directly linked to data-flow.
A token in source code representing (part of) a comment.
A source code token representing a structure field.
A source code token representing a function name.
A grouping of source code tokens representing a function prototype
A grouping of source code tokens representing an entire function
Class to handle highlights for a decompiled function.
Interface for a decompiler highlight change listener.
A source code token representing a control-flow label.
Control the GUI layout for displaying tokenized C code
A line of C code.
A collection of source code text elements, with associated attributes, grouped in
a tree structure.
A token representing a source code "operation".
A grouping of source code tokens representing the "return type" of a function,
as at the beginning of a function prototype.
A source code statement (as typically terminated by ';' in C)
A statement must have a p-code operation associated with it.
A source code token which is not an operation, variable, function name, or type.
Class representing a source code language token.
A sequence of tokens that form a meaningful group in source code.
A source code token representing a data-type.
A grouping of source code tokens representing a variable declaration.
Token representing a C variable
Information about a class file on disk
A predicate used to filter modules using the classpath.
This class is a collection of static methods used to discover classes that implement a
particular interface or extend a particular base class.
Symbols that represent "classes"
ClassTranslator provides a way to map an old Ghidra class to
a current Ghidra class.Command to remove an external program name from the reference manager.
Command to clear a fallthrough.
A label that displays an icon that, when clicked, will clear the contents of the
associated filter.
A abstract CLI stream type for convenience.
Generic Metadata table.
Generic Metadata table row.
Describes a blob in the #Blob heap.
ClientUtil allows a user to connect to a Repository Server and obtain its handle.The Metadata directory pointed found in
ImageCor20Header.The header of a
CliMetadataDirectory.Determines what types of transfer data can be placed on the clipboard, as well as if
cut, copy, and paste operations are supported
Defines a "type" for items in the Clipboard
Field for showing multiple strings, each with its own attributes in a field,
on a single line, clipping as needed to fit within the field's width.
Describes the methods necessary to get a long and short representation, with or without an metadata stream.
The Blob stream contains ???.
The GUID stream points to a sequence of 128-bit GUIDs.
A structure used by a
CliMetadataRoot describe a CliAbstractStream.The Metadata stream is giant and complicated.
The Strings stream contains null-terminated UTF8 strings.
The User Strings stream contains blobs of 16-bit Unicode strings.
Describes the Assembly table.
Describes the AssemblyOS table.
Describes the AssemblyProcessor table.
Describes the AssemblyRef table.
Describes the AssemblyRefOS table.
Describes the AssemblyRefProcessor table.
Describes the ClassLayout table.
Describes the Constant table.
Describes the CustomAttribute table.
Describes the DeclSecurity table.
Describes the Event table.
Describes the EventMap table.
Describes the ExportedType table.
Describes the Field table.
Describes the FieldLayout table.
Describes the FieldMarshall table.
Describes the FieldRVA table.
Describes the File table.
Describes the GenericParam table.
Describes the GenericParamConstraint table.
Describes the ImplMap table.
Describes the InterfaceImpl table.
Describes the ManifestResources table.
Describes the MemberRef/MethodRef table.
Describes the MethodDef table.
Describes the MethodImpl table.
Describes the MethodSemantics table.
Describes the MethodSpec table.
Describes the Module Table, which contains information about the current assembly.
Describes the ModuleRef table.
Describes the NestedClass table.
Describes the Param table.
Describes the Property table.
Describes the PropertyMap class.
Describes the StandAloneSig table.
Describes the TypeDef table.
Describes the TypeRef table.
Describes the TypeSpec table.
Possible Metadata table types.
ClosedException indicates that the underlying resource has been
closed and read/write operations have failed.Icon for a close button
Event for telling a tool to close a program
A
PasswordProvider that supplies passwords to decrypt files via the java jvm invocation.The
ThreadedTableModel does not correctly function with data that can change outside of
the table.CodeBlock represents some group of Instructions/Data.
A simple edge type for representing a link between two
CodeBlock vertices.CodeBlockImpl is an implementation of a CodeBlock.
An iterator interface over CodeBlocks.
An implementation of a CodeBlockModel will produce CodeBlocks
based on some algorithm.
A CodeBlockReference represents the flow from one CodeBlock to another.
CodeBlockReferenceImpl implements a CodeBlockReference.
An iterator interface over CodeBlockReferences.
A class for representing a code block within a graph.
The CodeComparisonPanel class should be extended by any class that is to be
discovered by the
FunctionComparisonPanel class and included as a
form of comparing two sections of code within the same or different programsAction context for a CodeComparisonPanel.
Service provided by a plugin that gives access to a manager for the field formats used by a
listing.
Class to manage database tables for data and instructions.
Represents a CS_BlobIndex structure
Class to parse Code Signature blobs
Represents a CS_BlobIndex structure
Represents a LC_CODE_SIGNATURE command.
Code Signature constants
Represents a CS_GenericBlob structure
Represents a CS_SuperBlob structure
Symbols that represent "labels"
Symbol data usage:
EXTERNAL:
String stringData - external memory address/label
Interface common to both instructions and data.
This is a class with static methods for obtaining information about a code unit and its
references.
Search filter that can test a search result and determine if that result starts at or inside
a code unit that matches one of the selected types.
ShowBlockName defines the valid options for
controlling the display of block names on labels.ShowNamespace defines the valid options for
controlling the display of name-spaces on labels.Container object to keep a relative index, label, and comments.
Undoable edit for pasting code unit information at a location.
Defines data that is available for drag/drop and clipboard transfers.
Exception thrown when a code unit cannot be created.
Interface to define an iterator over over some set of code units.
Converts an AddressKeyIterator into a CodeUnitIterator
CodeUnitLocation provides information about the location
in a program within a CodeUnit.Change record generated when a property on a code unit changes.
Stores information about a code unit in a program.
A class that knows how to render
CodeUnits in 1 or more linesRenderer for
CodeUnitTableCellDatasTable column to display
CodeUnitsService provided by a plugin that shows the listing from a Program, i.e., a
Code Viewer.
A class that represents a COFF archive file (ie.
The Machine field has one of the following values that specifies its CPU type.
CoffRelocationContext provide COFF relocation context data to be used by
CoffRelocationHandler during processing of relocations.An abstract class used to perform COFF relocations.
A class that gets the appropriate COFF relocation handler for a specific COFF.
A 0x28 byte COFF section header
A collection of utility methods that prevent you from having to do unsafe casts of
Collection classes due to runtime type erasure.A container class to hold a color and a style value.
ThemeEvent for when a color changes for exactly one color id.Color editor that is a bit unusual in that its custom component is a button that when pushed,
pops up a dialog for editing the color.
Property Editor for Colors.
Functional interface to allow us to map a token to a color.
Class for sorting colors by rgb values.
Blender of colors
A class for storing
Color values that have a String id (e.g.Editor for Theme colors
A row in a grid.
A
TableFilter that filters based on column valuesColumnConstraints are objects used to filter table rows based on values from a particular column.
Defines the contract for building user-interface elements for manipulating
constraint configuration.
Extension point for introducing ColumnConstraints to the system.
This class maintains a collection of
ColumnConstraint that are applied to a specific table column
for filtering purposes.Interface for providing column data and a table's DataSource to a constraint editor.
An interface that allows users to add columns to the
TableChooserDialog.Dialog for loading saved ColumnFilters.
This class provides all known
ColumnConstraints for a given table column.Dialog for creating and editing column table filters.
This class is for constructing and editing
ColumnBasedTableFilter.A class that manages column filters for a table.
Loads and Save a list of ColumnTableFilters for a specific table to the tool
This layout arranges components in columns, putting as many components as possible in a
column and using as many columns as necessary.
A special version of the backup comparator that uses the column's rendered value for
the backup sort, rather the just
toString, which is what the default parent
table model will do.Not meant to be created by users.
ColumnConstraintTypeMappers allows columns of one type be filterable using an existing
ColumnConstraint
for a different type by defining a mapping from the column type to the desired
filter type.Table loader that performs a search and then combines the new results with existing results.
Combines multiple Table Filters into a single TableFilter that can be applied.
A pattern that has both an instruction part and non-instruction part
An enum of search results "combiners".
This value has been renamed to IMAGE_DIRECTORY_ENTRY_COMHEADER.
Interface to define a change made to a domain object.
Change record for comment changes
The
CommentFieldLocation class contains specific location information
within the COMMENTS field of a CodeUnitLocation object.A handler to process
CommentFieldLocation clicks.Container class for information about changes to a comment.
Filters the given address iterator to only return addresses that have a comment of the given type
Filters the given codeUnit iterator to only return codeUnits that have a comment of the given type
Class with a convenience method to get an array of the CodeUnit
comment types.
ComparisonData is an abstract of items that can be compared in a
CodeComparisonPanel.Interface for requesting specific information about the compiler used to
build a Program being analyzed.
Labels for PrototypeModels that are used by default for various analysis/evaluation
use-cases, when the true model isn't known.
Represents an opinion's compiler (gcc, borlandcpp, etc).
Exception class used when the named compiler spec cannot be found.
A complex number a + bi
This doesn't support any actual operations, nor does it implement
Comparable.Provides a definition of a
complex built-in data type consisting of two 64-bit floating point
numbers in the IEEE 754 double precision format.Provides a definition of a
complex built-in data type consisting of two 128-bit floating point
numbers in the IEEE 754 double precision format.Provides a definition of a
complex built-in data type consisting of two 32-bit floating point
numbers in the IEEE 754 double precision format.This command will organize a program tree into levels from the bottom up.
An interface to signal that the implementing action works with an individual Java
Component.Maintains a weak set of components associated with a given font id.
Diagnostic dialog for display information about the components in a window and related focus
information.
Plugin to display information about components in the application
A listener interface to know when a component has been
made
displayableClass to hold information about a dockable component with respect to its position within the
windowing system.
Abstract base class for creating dockable GUI components within a tool.
An interface that enables callback when a
ComponentProvider becomes activated or
deactivated.Extends the
ComponentProvider to fit into the Plugin architecture by taking in a
PluginTool which extends Tool.A p-code userop library composed of other libraries
Interface for common methods in Structure and Union
An AttributedString that is composed of other AttributedStrings.
Common implementation methods for structure and union
A FieldElement that is composed of other FieldElements.
What: A cell renderer that will attempt to use any registered cell renderer and will otherwise
default to the parent rendering implementation.
Used by the CParser to handle fields added to structures(composites).
Interface for common methods in Structure and Union
ComponentComparator provides ability to compare two DataTypeComponent objects
based upon their ordinal.OffsetComparator provides ability to compare an Integer offset with a
DataTypeComponent object.OrdinalComparator provides ability to compare an Integer ordinal with a
DataTypeComponent object.A
TextField that takes in other TextFields.Compound command to handle multiple background commands.
Implementation for multiple commands that are done as a unit.
Combines multiple Tasks into a single task.
A wrapper around another DWARFSectionProvider, this provider
fetches DWARF section data that has been compressed and stored in sections in the underlying
DWARFSectionProvider.The emulator or a client attempted to concretize an abstract value
A listener set that is weakly consistent.
A queue for easily scheduling tasks to be run in parallel (or sequentially)
via a thread pool.
A helper class to build up the potentially complicated
ConcurrentQ.A class which handles exceptions that occur off of the main test thread.
A model that provides access to table columns that are "configurable," whether by way of
Settings object, or by the implementations and how they were written (like supplying
custom renderers and such).Panel that shows the current conflict number and the total number of
conflicts.
ConflictInfoPanel appears above the 4 listings in the ListingMergeWindow.Abstract class that should be implemented by the conflict panel that appears
below the 4 listings in the merge window.
ConflictUtility provides some constants and static methods
used by the Listing Merge portion of the multi-user merge.Listener that is called when a string should be written to the console.
Generic console interface allowing any plugin to print
messages to console window.
Handles monitor output to console
A generic text pane that is used as a console to which text can be written.
Class for manipulating "deferred" constant systems like the java virtual machine constant pool
Constants used in the data structures of the PE.
A constant value associated with an alwaysTrue pattern
A matcher for a given constant value
"Solves" constant expressions
Constraints are used to make decisions to traverse a decision tree where each node in the
tree has a constraint that is used to decide if that node is part of the successful decision path.
Convenience class that converts XML attributes into typed property values.
Panel for display a single constraint entry within a column.
The primary sleigh concept representing a semantic action
taking operands (semantic values) as input
producing a semantic value as output
matching a particular pattern
printing in a certain way
An interface for visiting constructors in a SLEIGH language
Structure for collecting cached information about an instruction
A constructor template, representing the semantic action of a SLEIGH constructor, without
its final context.
A placeholder for what will resolve to a field of a Varnode
(an AddressSpace or integer offset or integer size)
given a particular InstructionContext
Consume a parameter from a specific resource list
Normally the resource list is determined by the parameter data-type, but this
action specifies an overriding resource list.
Consume additional registers from an alternate resource list
This action is a side-effect and doesn't assign an address for the current parameter.
See Apple's -- PEFBinaryFormat.h
A filter that will pass text when it contains the filter text.
NOTE: ALL ContentHandler implementations MUST END IN "ContentHandler".
A blocking/modal Ghidra URL content type discovery task
ContextChangeException indicates that an illegal change to
program context has been attempted.Swift ContextDescriptorKind values
ContextEvaluator provides a callback mechanism for the SymbolicPropogator as code is evaluated.
Default behavior implementation of ContextEvaluator passed to SymbolicPropogator
Override methods to inspect context.
Contiguous bits in the non-instruction part of the context interpreted
as an integer value
Indicates that the tagged field should be initialized with the value of the appropriate
context object, either
DataTypeMapper or StructureContext.Solves expressions of a context register field
An operation on the context (bit-packed form) of an instruction
Pattern which depends only on the non-instruction stream bits
of the context
Class for context configuration information as
part of the compiler configuration (CompilerSpec)
This class is used simplify DockingAction logic for actions that work with
specific
ActionContext.A ValueSymbol that gets its semantic value from contiguous bits
in a VarnodeSymbol.
ControlFlowGuard is a platform security feature that was created to combat memory
corruption vulnerabilities.
Helper methods for converting between
number data types without negative
promotion.
ConvertedRecordIterator provides a RecordIterator wrapper
for performing record conversion frequently required when using older
data.Action converting the parameter's data-type to a pointer, and assigning storage for the pointer.
A feature representing 1 or more "stand-alone" copies in a basic block.
A dynamic data type that changes the number of elements it contains based on a count found in
header data type.
Simple class used to avoid immutable objects and autoboxing when storing changing integer
primitives in a collection.
Latch that has a count that can be incremented and decremented.
Token literal values and constants.
Token Manager.
Command to create an array.
Command to create an array inside of a structure.
This command will create a data of type dataType throughout an addressSet.
This command will create a data of type dataType at the given address.
Background command to create data across a selection inside of a structure.
Command to Create data inside of a structure.
Command to create a root in the program; the root module has
fragments named the same as the memory blocks.
Command to create a folder in a program tree.
Command to create a Fragment.
Command for Creating a function at an address.
Command for creating a function definition data type based on the
function signature for a function at an address.
Command for assigning a tag to a function
Command for Creating multiple functions from a selection.
This class attempts to create a namespace for each token in the provided
string.
Command to create a String and optionally label it.
Command to create a structure.
Command to create a structure inside of another structure.
Command for creating a thunk function at an address.
Common interface for provider interfaces that provide crypto information.
Registry of
crypto providers and session creator.A stub implementation of CryptoSession that relies on a parent instance.
Provides the caller with the ability to perform crypto querying operations
for a group of related files.
The interface that clients must define to create a
DecompilerHighlighterA simple tracker of position in an object for that allows more specialized users to extend and
add functionality.
This class allows us to change the renderer of the favorites tree.
Container object for a DataType and a byte array that is the format for
the data type.
An
Address based table model that allows clients to load their data via
the TableModelLoader callback provided at construction time.Extends the
NimbusLookAndFeel (Nimbus) to intercept CustomNimbusLookAndFeel.getDefaults().A custom OptionComponent that controls it's own display using the editor component of the
given EditorState.
Marker interface to signal that the implementing PropertyEditor component desires to handle
display editing of an option or options.
A custom Table of Contents view that we specify in our JavaHelp xml documents.
Our custom factory that knows how to look for extra XML attributes and how to
create our custom tree items
A custom tree item that allows us to store and retrieve custom attributes that we parsed
from the TOC xml document.
Class to define a set of dataTypes that a single action can cycle through.
Class with a utility function to calculate the cyclomatic complexity of a function.
Interface for interacting with data at an address in a program.
Holds options for the commands for creating new data structures.
Database facilitates the creation of a DBHandle for accessing
a database.DatabaseItem corresponds to a private or versioned
database within a FileSystem.Base class for an cached object in the database.
Collection of static functions for upgrading various database tables.
DatabaseUtils provides a collection of database related utilities.Exception thrown if the database does not match the expected version of the program classes.
DataBuffer provides an accessible binary buffer
for use with a BufferMgr and BufferFile.DataBuffer provides an array like interface into a set of Data
at a specific index.
ComparisonData for a Data object
Stateless helper classes with static singleton instances that contain methods to convert
Java numeric types to and from their raw form in a byte array.
An abstract base class to represent the
IMAGE_DATA_DIRECTORY
data structure defined in winnt.h.DataDirectoryException is thrown when a folder item can not be
created because its associated data directory already exists.DataFileHandle provides a random-access handle to a file.DataFileItem corresponds to a private serialized
data file within a FileSystem.Converts a code unit iterator into a data iterator.
Represents a LC_DATA_IN_CODE command.
Represents a data_in_code_entry structure
Interface to define an iterator over over some set of Data.
Converts a DBLongIterator into a DataIterator
Abstract base class for constraint editors that load all the data in a column in order to
initialize themselves.
Context mix-in interface that ActionContexts can implement if they can provide a list of
Data object's ProgramLocation's.DataOrganization provides a single place for determining size and alignment information
for data types within an archive or a program.
Stores information about a data item in a program such that the data item can
be retrieved when needed.
Converts a record iterator into a DataIterator.
Class to define reference types for data.
Service for creating data
A class data structures can use to delegate error handling responsibilities to system-level
decision making.
DataStub can be extended for use by tests.
Table for managing rows and columns of data.
Tree that shows the folders and domain files in a Project
Manages Ghidra integration with the system clipboard when doing cut/copy/paste
operations on domainFiles and domainFolders in a data tree widget.
Dialog to open or save domain data items to a new location or name.
Types of ways to use a DataTreeDialog.
Interface for classes that will handle drop actions for
DataTrees.The interface that all datatypes must implement.
This interface represents the main entry point into an object which
stores all information relating to a single data type archive.
Interface to define event types and the method to generate an
event within Program.
Interface for a data type archive change set.
DataTypeArchiveContentHandler converts between DataTypeArchive instantiations
and FolderItem storage.Database implementation for Data Type Archive.
Top level object that manages each step of the merge/resolve conflicts
process.
Plugin that provides a merge component provider for data type archives.
A service that manages a set of data type archives, allowing re-use of already open
archives.
DataTypeArchiveTransformer changes (transforms) a new archive file so that it appears to be
an updated copy of a previously existing data type archive.
Interface for a Data Type Change set.
DataTypeCleaner provides a convenient way to clean composite definitions which may be
included within a complex datatype which was derived from an source unrelated to a target
DataTypeManager.Converts DataType Column objects to Strings so that column gets String type column
filters
DataTypeComparator provides the preferred named-based comparison of DataType
which utilizes the DataTypeNameComparator for a primary name
comparison followed by sub-ordering on DataTypeManager name and CategoryPath.DataTypeComponents are holders for the dataTypes that make up composite (Structures
and Unions) dataTypes.
Basic implementation of a DataTypeComponent
DataTypeConflictHandler provides the DataTypeManager with a handler that is
used to provide a disposition when a datatype conflict is detected during
DataTypeManager.resolve(DataType, DataTypeConflictHandler) processing.ConflictResolutionPolicy indicates the conflict resolution policy
which should be applied when any conflict is encounteredConflictResult indicates the resolution which should be
applied to a specific conflictA plugin to show tool tip text for hovering over data types in the decompiler.
DataTypeDependencyException corresponds to a datatype dependency failure.An interface that provides lines that are to be used in a diff and can also create
specialized placeholder lines upon request.
The data model for
DropDownSelectionTextField that allows the text field to work with
DataTypes.Exception thrown when a value cannot be encoded for a data type
A filter selecting a specific class of data-type.
Base implementation for dataTypes.
An instance of a DataType that is applicable for a given context.
Interface for Managing data types.
The listener interface for notification of changes to a DataTypeManager
Adapter for a Category change listener.
Default implementation for a
DataTypeManagerChangeListener that sends out the
events to its own list of listeners.Base class for DB-backed data type managers.
Service to provide list of cycle groups and data types identified as
"favorites." Favorites will show up on the popup menu for creating
data and defining function return types and parameters.
Information about
StructureMapping classes and their metadata.Context passed to StructureMapping logic when binding a structure's fields to a java class's
fields.
Check if the function signature has a specific data-type in a specific position.
Manager for merging category and data type changes
The settings definition for the numeric display format
DataTypeNameComparator provides the preferred named-based comparison of DataType
which handles both some degree of case-insensity as well as proper grouping and ordering of
conflict datatypes.DataTypeObjectComparator provides the preferred named-based comparison of data types
using the DataTypeNameComparator allowing a mix of DataType and/or String
names to be compared.Object to hold a category path and a datatype name.
Interface for objects that can provide new instances of dataTypes
Simplified datatype service interface to provide query capabilities
to a set of open datatype managers
A container class to hold information about a location that references a
DataType.An interface for extension points to implement.
A dialog that allows the user to choose from available data types or create new ones.
An editor that is used to show the
DropDownSelectionTextField for the entering of
data types by name and offers the user of a completion window.This manager is responsible for reading and writing datatypes in XML.
Defines data that is available for drag/drop and clipboard transfers.
A class to produce and parse URLs of the form:
A class used to convert data types into ANSI-C.
ClearDataMode specifies how conflicting data should be cleared
when creating/re-creating dataHolds options for controlling how validation is performed when determining whether or not to
create data structures at a particular location.
Provides Date related column constraints.
Converts Date Column objects to LocalDate objects so that column gets LocalDate type column
filters
Non-editable Editor for date and time; creates a text field for the string version of the date.
A constraint editor for specifying ranges of dates.
Creates a component for editing Dates using a formated textfield and a Jspinner.
A constraint editor for specifying comparison with a single Date value.
DBBuffer facilitates synchronized access to a ChainedBuffer.DBChangeSet facilitates the reading and writing of application
level change data associated with BufferFile.DBContentHandler provides an abstract ContentHandler for
domain object content which is stored within a database file.Interface to get a field adapter where the Field is the primary
key in the table.
DBFieldIterator provides the ability to iterate over
Field values within a table.DBFileListener facilitates listener notification
when new database versions are created.An opinion service for processing Microsoft DBG files.
A debugging, timing, and diagnostic tool
A context for idiomatic use of the
DbgTimer in a try-with-resources blockA (rather slow) output stream that indents every line of its output
DBHandle provides access to an open database.Adapter to get an iterator over keys in a table.
Database Listener.
DBLongIterator provides the ability to iterate over
long values within a table.Generic cache implementation for objects that extend DatabaseObject.
Manages generic address keyed properties.
Record provides a portable container for data
associated with a fixed schema.Interface to get a record iterator.
DBStringMapAdapter provides a simple string-to-string map backed by a named database table.DBContentHandler provides an abstract ContentHandler for
domain object content which is stored within a database file.The default plugin package provider that uses the
PluginsConfiguration to supply packagesA class to represent the code view debug information.
Constants defined in Code View Debug information.
A class to represent the Object Module Format (OMF)
code view symbol table.
A class to represent the COFF Line number data structure.
A class to represent the COFF symbol data structure.
A class to represent the COFF Auxiliary Symbol data structure.
A class to represent the COFF Symbols Header.
A class to represent the COFF Symbol Table.
Points to an array of IMAGE_DEBUG_DIRECTORY structures.
A class to represent the Debug Directory data structure.
A helper class to parsing different types of
debug information from a debug directory
A possible implementation of the FIXUP debug directory.
A possible implementation of the FIXUP debug directory elements.
Parses the exception handling structures within a '.debug_frame' memory section, which
contains call frame debugging information.
A DWARF Debug Info Entry is a collection of
attributes
in a hierarchical structure (see DebugInfoEntry.getParent(), DebugInfoEntry.getChildren()).A class to represent the
IMAGE_DEBUG_MISC struct
as defined in winnt.h.A feature extracted from a function, with an additional description of what information is
incorporated into the feature.
A base class for Object Module Format (OMF) symbols.
Result object from getting values that match the constraints for given test object.
A node in a decision tree.
A node in the decision tree for resolving a Constructor in
a SubtableSymbol based on the InstructionContext
The result object returned from a scan of a decision tree looking for property values that
match the constrains for some test object.
A decisionTree is used to find property values that are determined by traversing a tree
of constraints.
Container for information about a Declaration that is accumulated during parsing.
An interface for reading structured data from a stream
All data is loosely structured as with an XML document.
Exception thrown for errors decoding decompiler objects from stream
Routines that the decompiler invokes to gather info during decompilation of a
function.
Data returned for a query about strings
A callback interface that will be given a newly created
DecompInterface to
configure.A container for collecting communication between the decompiler and the Ghidra database,
as serviced through DecompileCallback during decompilation of a function.
A class to hold pieces of a decompiled function.
An exception from (or that has passed through) the decompiler process
Configuration options for the decompiler
This stores the options and can create an XML
string to be sent to the decompiler process
Class for communicating with a single decompiler process.
Factory that returns a DecompileProcess.
An implementation of
QCallback that performs the management of the
DecompInterface instances using a Pool.A class to perform some of the boilerplate setup of the
ConcurrentQ that is shared
amongst clients that perform decompilation in parallel.Coordinates the interactions between the DecompilerProvider, DecompilerPanel, and the
DecompilerManager
Class for getting at the various structures returned
by the decompiler.
The highlighter interface passed to clients of the
DecompilerHighlightService.A service that allows clients to create highlights in the form of background colors for
ClangTokens in the Decompiler UI.Sources languages that can be output by the decompiler
Manages the threading involved with dealing with the decompiler.
A provider of a margin Swing component
A service that allows clients to add custom margins in the Decompiler UI.
Class to handle the display of a decompiled function
Listener of
Program events for decompiler panels.This is a self-contained interface to a single decompile
process, suitable for an open-ended number of function
decompilations for a single program.
The default implementation of ActionContext
Keeps track of all the Address spaces in the program and provides
methods for parsing address strings.
A
AssemblyResolution indicating the need to solve an expression in the futureA
AssemblyResolution indicating the occurrence of a (usually semantic) errorA
AssemblyResolution indicating successful application of a constructorDefaultCheckinHandler provides a simple
check-in handler for use with
DomainFile.checkin(CheckinHandler, ghidra.util.task.TaskMonitor)A color provider that returns a specific color.
A column comparator that is used when columns do not supply their own comparator.
Provides an implementation of a byte that has not been defined yet as a
particular type of data in the program.
The default implementation of
Emulator.A file descriptor associated with a file on a simulated UNIX file system
Uses Java's default focus manager to provide the focus owner.
DefaultGhidraProtocolConnector provides support for the
Ghidra URL protocol without extension for accessing the legacy Ghidra Server
over an RMI interface.DefaultGhidraProtocolHandler provides the default protocol
handler which corresponds to the original RMI-based Ghidra Server
and local file-based Ghidra projects.Empty implementation of GraphDiaplayOptions.
Property manager that deals with properties that are of
int type.
Default Language service used gather up all the languages that were found
during the class search (search was for language providers)
DefaultLaunchMode provides an Options value which indicates how a default tool
launch should be performed.DefaultLocalGhidraProtocolConnector provides support for the
Ghidra URL protocol which specifies a local Ghidra project without extension.All storage/state for a pcode emulator machine
Every piece of information in a pcode emulator machine is representable as a triple
(AddressSpace,offset,size).
A p-code executor state formed from a piece whose address and value types are the same
The default implementation of
PcodeThread suitable for most applicationsA userop library exporting some methods for emulated thread control
An executor for the p-code thread
The default plugin installer that uses a tool to install plugins
A configuration that includes all plugins on the classpath.
Implementation for a Project.
Helper class to manage files within a project.
Implementation for a ProjectManager; creates, opens,
and deletes Projects.
PropertyMap is used to store values for a fixed property at
address locations given as longs.
A location used to represent a an edge case where not suitable location can be found and the
client does not wish to return null.
Default implementation of the
SearchListModel.A set of built-in
SolverHintsA renderer for clients that wish to display a
Date as a timestamp with the
date and time.A default
VisualGraph that implements basic setup for things like event processing.Iterator that visits each defined data instance in the initialized memory of a Program or in the footprint of
a specified data element.
A
Loader for processing Microsoft DEF files.Points to the delayload information.
A class to represent the
ImgDelayDescr
data structure defined in DELAYIMP.H.Command that runs in the background to delete a memory block, as
the delete may be a time consuming operation.
Listener that is notified when the DeleteBlockCmd completes.
Exception thrown when program object being accessed has been deleted.
Command for clearing a function at an address.
Command for deleting a tag from the system
Command to delete a label
Task for recursively deleting project files from a Ghidra project
An action to delete data from a table.
An action to delete from the cursor position to the end of the current word.
An action to delete from the cursor position to the beginning of the current word, backwards.
Delete a tree in the program.
Command for deleting a variable in a function.
A unifying top-level interface for all
DemangledObjects and DemangledTypesA class to represent a demangled data type.
A class to handle exceptions that occur demangling.
A class to represent a demangled function.
A class to represent a demangled function indirect.
A class to represent a demangled function pointer
A class to represent a demangled function reference
A class to represent a
DemangledObject that should get represented as a Ghidra labelRepresents a demangled lambda function
Represents a plain namespace node that is not a type or method
A class to represent a demangled object.
A class to represent a demangled function parameter.
A class to represent a demangled structure
A field of a
DemangledStructureRepresents a demangled string.
An interface to represent an unknown entity that we are demangling.
An interface to represent a demangled global variable.
NOTE: ALL DEMANGLER CLASSES MUST END IN "Demangler".
A simple class to contain the various settings for demangling
Implements an iterator over all GTreeNodes in some gTree (or subtree).
Deprecated.
Processes the given graph depth first and records that order of the vertices.
A context utility allowing stack management via a try-with-resources block
Dependency Graph that uses
TreeMaps and ListOrderedSets to provide
determinism in pulling (AbstractDependencyGraph.pop()) from the graph.Base class used for creating dialogs in Ghidra.
This class represents an "or'able" condition in the DialogFilterConditionSet
This class represents the set of "or-able" filter conditions for a single column.
This class represents a major "and-able" row in the dialog's filter panel.
Helper class to manage actions for saving and exporting the tool
ProjectDataCollapseAction configured to work in the frontend.ProjectDataExpandAction configured to work in the frontend.ProjectDataNewFolderAction configured to work in the frontend.Context specific to the DataTreeDialog.
Instances of this type are used to add a checkBox to a Dialog so that the dialog results
can be saved and reused in future uses of that dialog (e.g., "Apply to all",
"Remember my decision").
Toolbar buttons for Dialogs.
DIEAggregate groups related
DebugInfoEntry records together in a single interface
for querying attribute values.A class that holds lines that will be used to generate diffs.
The
DiffUtility class provides static methods for getting and
creating an object in one program based on an object from another program.Dijkstra's shortest-path algorithm
Deprecated.
A factory to create JLayer instances to provide the L&F and functionality of a
disabled panel -- the component assumes a disabled color, and selection via mouse and
keyboard is prevented.
LazyImageIcon that creates a disabled version of an iconDeprecated, for removal: This API element is subject to removal in a future version.
This class has been replaced by
DisabledImageIcon since it
extends ImageIconWrapper which has also been deprecated.Action for disabling a field.
Attempt to disambiguate similar n-grams by hashing over all the bytes in their constituent instructions.
Attempt to disambiguate similar n-grams by looking at the children of blocks containing the n-grams
Attempt to disambiguate similar n-grams by looking at the parents of blocks containing the n-grams
Attempt to disambiguate similar n-grams by looking at the parents, AND siblings, of blocks containing the n-grams.
Command object for performing disassembly
Class to perform disassembly.
Maintains processor state information during disassembly and analysis.
Interface for reporting disassembly messages
AddressCorrelators that want to be discovered by version tracking should implement this interface.
Abstract base class for built-in
GThemes.A pattern with no ORs in it
An interface used by classes to indicate that they can produce a String representation that
is meant to be seen by the user in the UI.
A pattern of bits/mask to match to a stream of bytes.
Form new expression by dividing one PatternExpression by another
Solves expressions of the form
A / BDividerLocation provides information about the location
(within a program) of an object that represents some kind of a separation.Wrapper class for user components.
Component for providing component titles and toolbar.
DockingAction defines a user action associated with a toolbar icon and/or
menu item.The base interface for clients that wish to create commands to be registered with a tool.
A simple listener interface to notify clients of changes to key strokes and mouse bindings.
A simple class to handle executing the given action.
Deprecated, for removal: This API element is subject to removal in a future version.
use
ToolOverrides the painting behavior of the BasicCheckBoxMenuItemUI
A listener to be notified when the tool's context changes.
Base frame used by the root window and detached windows
An extension of the
GHelpBroker that allows Docking classes to be installed.An extension of the
GHelpSet that allows Docking classes to be installed.A class that can be used as an interface for using actions associated with keybindings.
This class exists to make menu items display content with proper alignment whether or not
they are displaying an icon.
A class for using actions associated with mouse bindings.
A widget that can be used to render an icon, title and close button for JTabbedPane.
Represents the collection of actions registered with the tool, along with method for adding
and removing actions.
An interface to house constants used by the
ToolNotes about how to use HTML safely:
A callback to operate on a component
Specifies the order of component traversal
Controls traversal and communicates cause for termination
A
VisualVertex implementation that provides a component with a docking header that
is clickable.Manages the "Docking" arrangement of a set of components and actions.
This class mainly serves as a conduit through which testing code can access some of the
non-public internals of
DockingWindowManager, without opening up its interface to the
public and without using reflective magic.Debug Plugin to show domain object change events.
DomainFile provides a storage interface for project files.Extends DataTypeManager to provide methods specific to a data type manager stored as a domain file.
A context that provides information to actions about domain files that are selected in the tool
Interface to indicate whether a domain file should be included in a list or
set of domain files.
Class to represent a node in the Data tree.
Implements the DomainFile interface for DomainObjects that are not currently
associated with any real DomainFile.
DomainFolder provides a storage interface for project folders.Methods for notifications when changes are made to a domain folder or
a domain file.
Adapter for the domain folder change listener.
Class to represent a node in the Data tree.
An
Option used to specify a DomainFolderDomainObject is the interface that must be supported by
data objects that are persistent.An abstract class that provides default behavior for DomainObject(s), specifically it handles
listeners and change status; the derived class must provide the getDescription() method.
Database version of the DomainObjectAdapter.
An event indicating a DomainObject has changed.
Information about a change that was made to a domain object.
Interface for a domain object change set.
An interface that allows for a callback when a
DomainObject is closed.DomainObjectDBChangeSet extends DBChangeSet
providing methods which facilitate transaction synchronization with the domain object's DBHandle.Basic event types for all Domain Objects.
Class for providing unique, compact ids for domain object event types.
DomainObjectException provides a general RuntimeException
when a catastrophic error occurs which may affect the integrity of a
domain object such as an IOException.Listener for when the
DomainFile associated with a DomainObject changes, such
as when a 'Save As' action occurs.The interface an object must support to be registered with a Domain Object
and thus be informed of changes to the object.
Builder for creating a compact and efficient
DomainObjectListener for
DomainObjectChangedEventsThrown when a method fails due to a locked domain object.
An interface to allow merging of domain objects.
Simple interface for getting a DomainObject.
this code will apply the Dominance algorithm to a module or fragment in
a program tree.
DominantPair is a pair where the key is responsible for equality and hashCode (and the value of
the pair doesn't matter at all).
Deprecated, for removal: This API element is subject to removal in a future version.
Editor for constraints that don't have a value that needs editing.
This class represents the
IMAGE_DOS_HEADER struct
as defined in winnt.h.Array of doubles that grows as needed.
Array of double[] that grows as needed.
This class provides a storage mechanism for double-valued information about
the elements of a KeyIndexableSet, e.g.
Provides a definition of a
complex built-in data type consisting of two double point
numbers in the IEEE 754 double precision format.Provides a definition of a Double within a program.
A constraint editor for specifying ranges of floating-point numbers (Float and Double)
Value class for
Double types.A constraint editor for specifying comparison with a single floating-point value (Float and Double).
Interface used by the DragDropTree to know how to handle the
drag and drop operations.
Defines a node that is in the DragDropTree.
A listener for tables that support drag and drop operations.
Defines data that is available for drag/drop and clipboard transfers.
Interface to define a drag source.
This class receives notification when the user initiates a drag and drop operation; it is
responsible for getting the
Transferable and telling the DragSource to
start the drag.Adapter class that receives notifications in order to provide drag over effects.
Icon for a drop down menu button (triangle pointing down)
Listener called when the user makes a selection on the
DropDownMultiSelectionTextField.Extension of the
DropDownSelectionTextField that allows multiple items to be selected.A listener that is called when the user makes a selection from the
DropDownSelectionTextField (e.g., they click an item or press enter on a selected
item and the matching window is closed).A text field that handles comparing text typed by the user to the list of objects
and then presenting potential matches in a drop down window.
A text field that handles comparing text typed by the user to the list of objects and then
presenting potential matches in a drop down window.
This interface represents all methods needed by the
DropDownSelectionTextField in order
to search, show, manipulate and select objects.Methods called by the DropTargetAdapter that implements the DropTargetListener interface
A factory for installing drop handlers onto components.
A basic interface for holding onto drop handlers
Class to handle notifications of drag and drop operations that occur on the DropTarget
object.
Fetches DWARF section data for a MachO program with co-located .dSYM folder.
DumbMemBufferImpl extends MemoryBufferImpl
with an internal cache buffer size of 16-bytes but will use the underlying memory
if needed.A utility class to help create dummy stub functional interfaces
The dummy application layout defines the customizable elements of a dummy application's
directory structure.
A
TaskMonitorAdapter that is cancellable.An editor that is always invalid.
Generates Dummy Fields.
Dummy action attached to a match sequence.
Class for holding two objects of the same type.
DuplicateFileException is thrown whenever a file or folder can't
be created because one with that name already exists at the same location.DuplicateGroupException is thrown when a fragment or child
is added to a module and that fragment or module is already a child.Exception thrown whenever a method tries give something a name and that name is already used.
This class represents the 'schema' for a DWARF DIE record.
DWARF accessibility consts from www.dwarfstd.org/doc/DWARF4.pdf
Header at the beginning of a address list table
Defines the names and numeric ids of known DWARF attributes.
Represents how a specific DWARF attribute is stored in a DIE record.
Categories that a DWARF attribute value may belong to.
Information about a single DWARF attribute, as specified in a
abbreviation.Base class for all DWARF attribute value implementations.
DWARF attribute with binary bytes.
DWARF boolean attribute.
An opcode parser for operands of a call frame instruction.
DWARF child determination consts from www.dwarfstd.org/doc/DWARF4.pdf.
A DWARF CompilationUnit is a contiguous block of
DIE records found
in a .debug_info section of an program.Logic to test if a Data instance is replaceable with a data type.
This
conflict handler attempts to match
conflicting composite data types (structure or union) when
they have compatible data layouts.Creates Ghidra
DataTypes using information from DWARF debug entries.Manages mappings between DWARF DIEs and Ghidra DataTypes.
Organizational class to record vital data used by a DwarfEHDecoder.
Generate instances of DwarfEHDecoder suitable for various pointer-encodings.
DWARF string attribute, where getting the value from the string table is deferred
until requested for the first time.
An application mode for encoded exception handling data.
Exception handling data decoding formats.
Decodes a sequence of program bytes to Ghidra addressing types.
DWARF attribute encoding consts from www.dwarfstd.org/doc/DWARF4.pdf
A data type whose value is a particular Dwarf decoder.
DWARF Endianity consts from www.dwarfstd.org/doc/DWARF4.pdf
A
DWARFExpression is an immutable list of operations and some factory methods to read
an expression from its binary representation.Evaluates a subset of DWARF expression opcodes.
A exception that is thrown when dealing with
DWARF expressions
or when they are evaluated.DWARF expression opcode consts from www.dwarfstd.org/doc/DWARF4.pdf
Enumeration that represents the different type of operands that a
opcode can take.The result of executing a
DWARFExpression with a DWARFExpressionEvaluator.DWARFFile is used to store file or directory entries in the DWARFLine.
DWARF attribute encodings.
Context given to the
DWARFForm.readValue(DWARFFormContext) method to enable it to
create DWARFAttributeValues.Represents a function that was read from DWARF information.
Interface for add-in logic to fix/modify/tweak DWARF functions before they are written
to the Ghidra program.
Iterates through all DIEAs in a
DWARFProgram and creates Ghidra functions
and variables.DWARF identifier case consts from www.dwarfstd.org/doc/DWARF4.pdf
Performs a DWARF datatype import and a DWARF function import, under the control of the
DWARFImportOptions.Import options exposed by the
DWARFAnalyzerInformation about what actions were performed during a DWARF import.
DWARF numeric attribute value that is an index into a lookup table
Handles a grouping of
DWARFIndirectTableHeaders that specify how to look up a
certain type of item (per CU).Common base functionality of indirect table headers (DWARFAddressListHeader,
DWARFLocationListHeader, etc)
DWARF inline encodings from www.dwarfstd.org/doc/DWARF4.pdf
A tuple of length (of a thing in a dwarf stream) and size of integers used in the dwarf section.
A structure read from .debug_line, contains indexed source filenames as well as a mapping between
addresses and source filename and linenumbers.
Represents an identifier of a value in a DWARFLine/DWARFFile object.
Defines a
DWARFLineContentType attribute value.Handles executing, step-by-step, the address-to-sourcefile mapping instructions found at the
end of a DWARFLine structure.
Represents the location of an item that is only valid for a certain range of program-counter
locations.
A collection of
DWARFLocation elements, each which represents a location of an item
that is only valid for a certain range of program-counter locations.Header found at the start of a set of DWARFLocationList entries, which are stored sequentially
in the
.debug_loclists section.A immutable hierarchical path based name implementation that can be viewed as either
namespaces or categorypaths.DWARF numeric attribute.
DWARFProgram encapsulates a
Ghidra program with DWARF specific reference data
used by DWARFDataTypeImporter and DWARFFunctionImporter, along with some
helper functions.Holds the start (inclusive) and end (exclusive, 1 past the last included address) addresses
of a range.
Represents a list of
DWARFRanges.DWARF Range List Entry id
Header found at the start of a set of DWARFRangeList entries, which are stored sequentially
in the
.debug_rnglists section.Immutable mapping information between DWARF and Ghidra.
Factory class to instantiate and cache
DWARFRegisterMappings objects.A DWARFSectionProvider is responsible for allowing access to DWARF section data of
a Ghidra program.
Auto-detects which
DWARFSectionProvider matches a Ghidra program.Represents the filename and line number info values from DWARF
DIEs.DWARF source lang consts from www.dwarfstd.org/doc/DWARF4.pdf.
DWARF string attribute.
Table of offsets that point into the string table.
Identifier/purpose of a DWARF DIE record.
The base class for a set of headers that share a common field layout.
Represents a function's parameter or local variable; or a global variable.
Provides a definition of a Double Word within a program.
Represents a dyld_cache_accelerator_info structure.
Represents a dyld_cache_accelerator_dof structure.
Represents a dyld_cache_accelerator_initializer structure.
Represents a dyld_cache_header structure.
A convenience interface for getting the address and path of a DYLD Cache image
Represents a dyld_cache_image_info structure.
Represents a dyld_cache_image_info_extra structure.
Represents a dyld_cache_image_text_info structure.
A
Loader for DYLD shared cache files.Represents a dyld_cache_local_symbols_entry structure.
Represents a dyld_cache_local_symbols_info structure.
Represents a dyld_cache_mapping_and_slide_info structure.
Represents a dyld_cache_mapping_info structure.
Options from the
DyldCacheLoaderBuilds up a DYLD Cache
Program by parsing the DYLD Cache headers.Represents a dyld_cache_range_entry structure.
Represents a dyld_cache_slide_info structure.
Represents a dyld_cache_slide_info2 structure.
Represents a dyld_cache_slide_info3 structure.
Represents a dyld_cache_slide_info4 structure.
Represents a dyld_cache_slide_info5 structure.
Class for representing the common components of the various dyld_cache_slide_info structures.
Utilities methods for working with Mach-O DYLD shared cache binaries.
Class to store a "split" DYLD Cache, which is split across several subcache files (base file,
.1, .2, .symbols, etc).
Represents a dyld_chained_fixups_header structure.
Represents a
dyld_chained_fixups_command structureRepresents a dyld_chained_import structure.
Represents a dyld_chained_import array.
Represents a dyld_chained_starts_in_image structure.
Represents a dyld_chained_starts_in_segment structure.
Represents a dyld_chained_starts_offsets structure.
Represents a dyld_chained_starts_offsets structure.
Represents a LC_DYLD_EXPORTS_TRIE command
Stores information needed to perform a dyld pointer fixup
Represents a dyld_info_command structure
Represents a dyld_subcache_entry structure.
A DataType class that must compute its length based upon actual data.
Marks this model as one that is column-based, using
DynamicTableColumns.Interface for dataTypes that don't get applied, but instead generate dataTypes
on the fly based on the data.
A HighSymbol mapping based on local hashing of the symbol's Varnode within a
function's syntax tree.
A hash utility to uniquely identify a temporary Varnode in data-flow
Most Varnodes can be identified within the data-flow graph by their storage address
and the address of the PcodeOp that defines them.
Represents a dylib structure.
Represents a dylib_command structure
Represents a dylib_reference structure.
Represents a dylinker_command structure
DynamicReference is a dynamically determined reference which
may not be explicitly added, deleted or modifiedRepresents a dysymtab_command structure.
The root interface for defining columns for
DynamicColumnTableModels.NOTE: ALL DynamicTableColumnExtensionPoint CLASSES MUST END IN "TableColumn".
Service that provides Eclipse-related functionality.
Deprecated.
GraphActionContext for when user invokes a popup action on a graph edge.
Provides notification when a text edit is completed.
Class used by some generic constraints to fulfill their requirement to provide and editor.
Command to change the reference type of a memory reference
Parses the exception handling structures within an '.eh_frame_hdr' memory section; contains
the frame header record and the FDE table.
Parses the call frame information exception handling structures within an '.eh_frame'
memory section.
An annotation for a specific collection of hierarchical data
This record parallels the XML concept of an element.
An Elf section that contains null-terminated strings, typically added by the compiler to
the binary
Header at the beginning of an ELF compressed section.
A collection of constants used in the ELF header.
ElfDefaultGotPltMarkup provides the legacy/default implementation of ELF GOT/PLT processing
which handles a limited set of cases.A class to represent the Elf
32_Dyn data structure.If an object file participates in dynamic linking, its program header table
will have an element of type PT_DYNAMIC.
An exception class to handle encountering
invalid ELF Headers.
A class to represent the Executable and Linking Format (ELF)
header and specification.
Interface and helper functions to read and markup things that have been read from an
Elf program.
Something that adds nice-to-have markup and program info to Elf binaries.
ElfLoadAdapter provides the base ELF load adapter implementation
which may be extended to facilitate target specific behavior.A
Loader for processing executable and linking files (ELF).ElfLoadHelper exposes loader methods useful to ElfExtension
implementations.ELF note sections have a well-defined format that combines identity information along with a
binary blob that is specific to each type of note.
An executable or shared object file's program header table is an
array of structures, each describing a segment
or other information the system needs to prepare the program for execution.
A class to represent the Elf32_Rel and Elf64_Rel data structure.
ElfRelocationContext provides a relocation handler context related
to the processing of entries contained within a specific relocation table.NOTE: ELF relocation handler implementations should extend
AbstractElfRelocationHandler
which now uses ElfRelocationType enum values instead of simple constants.A container class to hold ELF relocations.
A class to represent the Elf32_Shdr data structure.
A class to represent the ELF 32bit and 64bit Symbol data structures.
A container class to hold ELF symbols.
Implementation for an AddressIterator that is empty.
Implementation for an AddressIterator that is empty.
Class that is a JButton that has an empty border and adds a mouse listener
so that the button looks raised when the mouse pointer enters the button,
and looks lowered when the mouse pointer exits the button.e
A
ByteProvider that has no contents.Implementation for an empty
AddressableByteSourceCodeUnitIterator that represents an empty set of codeunits.
Exception thrown if the composite data type is empty.
Default GraphType implementation that has no vertex or edge types defined
Table loader for clearing the existing results
Used as proxy for a null value.
Implementation of a RecordIterator that is always empty.
A Text field that is blank.
An empty implementation of the ThreadedTableModel.
The content store to back a simulated file
The emulated program invoked a system call incorrectly
The simulated system interrupted with an I/O error
EmulateInstructionStateModifier defines a language specific
handler to assist emulation with adjusting the current execution state,
providing support for custom pcodeop's (i.e., CALLOTHER).MemoryStateBuffer provides a MemBuffer for instruction parsing use
which wraps an emulator MemoryState.The emulator interface
This is the primary "entry point" for using an
Emulator.A system call library simulating Linux for amd64 / x86_64
A system call library simulating Linux for x86 (32-bit)
A simulated process (or thread group) has exited
A library of system calls
The definition of a system call
The
EmuSyscallLibrary.syscall(PcodeExecutor, PcodeUseropLibrary) method wrapped as a
userop definitionA p-code execution exception related to system simulation
An exception for errors within UNIX sytem call libraries
A simulated UNIX file
A process's handle to a file (or other resource)
Collects the
stat fields common to UNIX platformsA simulated UNIX file system
Open flags as defined by the simulator
A simulated UNIX user
Action for enabling disabled fields
An interface for writing structured data to a stream
The resulting encoded data is structured similarly to an XML document.
Represents an encryption_info_command structure
Handles the actions required when the user presses the 'end' key; this moves the viewport
to the bottom of the file.
Column for the ProjectDataTable (Frontend) to display the endianness of a program.
SettingsDefinition for endianness
The integer offset of the address following the current instruction
"Solves" expressions of
inst_nextSymbol with semantic value equal to offset of address immediately
after current instruction
A class to represent a new-executable entry point.
Represents a Swift entry point
Represents an entry_point_command structure
Reference object for entry points
A class to represent a new-executable entry table.
A class to represent a new-executable entry table bundle.
Column Constraint where acceptable column values are Enum values that match one of a set of
selected values from the Enum.
A constraint editor for enumerated-type values;
Interface for a SettingsDefinition with enumerated values.
Keeps track of the signed state of an enum datatype.
This is a static utility class used to partition a set of long values into as many
non-intersecting BitGroups as possible.
Indicates that the tagged field should have an "end-of-line" comment placed
at each instance of the field, using the return value of a getter method for the field
or the return value of a specified method as the string.
Generates End of line comment Fields.
The
EolCommentFieldLocation class contains specific location information
within the EOL comment field of a CodeUnitLocation object.Utility class with methods to get comment information that can be displayed in the end of line
comment field.
This table column displays the Label for either the program location or the address
associated with a row in the table.
An option class that is used by the
EolExtraCommentsPropertyEditor to load and save
option settings.A pattern with no semantic or printing content, that will match
any pattern.
An Equate associates a string with a scalar value in the program,
and contains a list of addresses and operand positions that refer
to this equate.
Database object for an Equate.
Class to hold information about an Equate; it is used
in a ProgramChangeRecord when an equate is created and
when references to the Equate are updated.
Implementation of the Equate Table
A simple version of
OperandFieldLocation that allows us to store equate information.Interface to define an equate reference.
EquateTable manages all equates for program.
A dialog that takes error text and displays it with an option details button.
A handler to process
ErrorListingField clicks.Report database errors.
Plugin to demonstrate handling of Program within a plugin and how to
set up the list of consumed plugin events.
Helper class to manage the events that plugins consume and produce.
This class is used to provide information regarding the source of an event.
Interface for objects that represent event types.
A generic functional interface that is more semantically sound than
Runnable.A generic functional interface that allows you to consume an item and potentially throw
an exception.
A generic functional interface that allows you to consume an item, return a result,
and potentially throw an exception.
A generic functional interface that is more semantically sound than
Runnable.Generic Exception class for classes contained in the ehFrame package
This class represents an Exception Handler Frame Header.
An annotation for experimental things
This class allows clients to run swing action at some point in the future, when the given
condition is met, allowing for the task to timeout.
A class to represent the
IMAGE_EXPORT_DIRECTORY
data structure defined in winnt.h.See Apple's -- PEFBinaryFormat.h
See Apple's -- PEFBinaryFormat.h
See Apple's -- PEFBinaryFormat.h * Exported Symbol Hash Key
The interface that all exporters must implement.
A class to hold the information extracted from a
export data directory.
Dialog for exporting themes to external files or zip files.
Mach-O export trie
Creates a new
ExportTrie.ExportEntryA matcher for a form of patten expression
A context for defining expression matcher succinctly
A class for accessing a contiguous sequence of bytes from some underlying byte source to
be used for searching for a byte pattern within the byte source.
Representation of a Ghidra extension.
A convenience implementation of FileFilter that filters out
all files except for those type extensions that it knows about.
Utility class for managing Ghidra Extensions.
A class loader used with Ghidra extensions.
NOTE: ExtensionPoint logistics have changed! It is no longer sufficient to
implement ExtensionPoint in order for the ClassSearcher to dynamically pick
up your class.
ExtensionPoint propertiesUtility methods for working with
ExtensionPointPropertiesA collection of all extensions found.
Container for the
GTable that displays ghidra extensions.Component Provider that shows the known extensions in Ghidra in a
GTable.Utilities for finding extensions.
ExternalConflictInfoPanel appears above the 4 listings in the ListingMergeWindow.A
DWARFSectionProvider that reads .debug_info (and friends) sections from an external
ELF file that is referenced in the original ELF file's build-id or debuglink sections.A collection of
search locations that can be queried to find a
DWARF external debug file, which is a second ELF binary that contains the debug information
that was stripped from the original ELF binary.Metadata needed to find an ELF/DWARF external debug file, retrieved from an ELF binary's
".gnu_debuglink" section and/or ".note.gnu.build-id" section.
Command for setting/unsetting an external entry point.
Class for merging external function and label changes.
Analog to LanguageCompilerSpecQuery, for use with querying External Languages.
ExternalLocation defines a location within an external
program (i.e., library).Iterator interface for external locations.
External manager interface.
Manages the database for external references.
Plugin event that is generated when a tool receives an external
ProgramLocationToolEvent.
Manages external program name changes and conflicts between the latest versioned
program and the modified program being checked into version control.
Plugin event generated when a tool receives an
ProgramSelectionToolEvent; the selection in the external tool has
changed.
Interface for references to external locations.
Plugin event used to navigate to a location in another program when following
a external reference.
ExternalsAddressTranslator is a translator that can be used for merging external functions and
labels.
Moves dangling external function symbols found in the
EXTERNAL/UNKNOWN
namespace into the namespace of the external library that publishes a matching symbol.A simple interface that can build, lookup or otherwise return a value
V for a
key K.A DataType class that creates data types dynamically should implement this interface.
Abstract class used to create specialized data structures that act like
a Structure and create a new Dynamic structure each time they are used.
TripleSymbols whose semantic value and printing changes depending
on the pattern that they match
Represents a fat_arch structure.
Represents a fat_header structure.
An InputStream wrapper that suppresses any
IOExceptions thrown by the wrapped stream
and starts returning 0 value bytes for all subsequent reads.Class that builds the Frame Description Entry (FDE) Table for a Common Information Entry (CIE).
An input stream that wraps a native POSIX file descriptor
An output stream that wraps a native POSIX file descriptor
Field is an abstract data wrapper for use with Records.Interface for display fields used by the FieldPanel
Interface for classes that manage the background color of fields.
Context of an individual field that is being deserialized, or being markedup.
Provides descriptions for fields in a field panel
Represents a Swift FieldDescriptor structure
Used by
Fields to combine text, attributes and location information (for example to and
from screen and data locations).NOTE: ALL FIELDFACTORY CLASSES MUST END IN "FieldFactory".
Maintains the size and ordering for a layout of fields.
Class to manage the tabbed panel for field formats.
Class manage a header for the FieldViewer.
Class used to represent a location within the field header component.
A highlighter for for
Fields.FieldIndexTable provides a simplified index table whose key is
a fixed or variable length IndexField which consists of a concatenation of
the index field value and associated primary table key.Interface implemented by objects that want to be notified when key events occur
in the FieldPanel.
FieldKeyInteriorNode defines a common interface for FieldKeyNode
implementations which are also an InteriorNode.Listener interface for objects that are notified when a change is made to a Field, or Fields
were added or removed from a set of Fields.
Class to represent
Field locations within the field viewer.Listener interface for field location changes
Indicates that the tagged java field corresponds to a field in a Ghidra structure.
Immutable information needed to deserialize a field in a structure mapped class.
A function that decorates a field in a structure mapped class.
This class allows clients to match on multiple field attributes, such as name and offset
within a parent data type.
Query implementation used to test a field in a record to match a given value.
NOTE: ALL FieldMouseHandlerExtension CLASSES MUST END IN "FieldMouseHandler".
Listener interface for mouse pressed events in the field panel.
Generates Data Field (structure field names and array indexes) name Fields.
The
FieldNameFieldLocation class provides specific information about the Function
Name field within a program location.Helper class to navigate to an address when user double clicks in a
Field.
Indicates that the tagged java field is to be included when constructing a variable length
Ghidra structure data type.
A function that adds a field to a Ghidra structure using annotated field information
found in a Java class.
Immutable information needed to create fields in a Ghidra structure data type, using information
from a java field.
Interface implemented by objects that want to be notified when an overlay
is removed from the FieldPanel.
Coordinates the scrolling of a set of field panels by sharing bound scroll models.
An event related to component layout over a
FieldPanel.A listener for field panel overlay events.
A
LayoutManager that can be applied to a FieldPanel, allowing Components
to be placed over a given field location.A range consists of a start position within a start row to an end position within an end row
(exclusive).
Query implementation used to test a field in a record to fall within a range of values.
Functional interface to read a structure field's value.
Represents a Swift FieldRecord structure
This class represents a selection in a field viewer.
Listener interface for when the selection changes.
A matcher for a token or context field, constrained by its size in bits
A simple data container class that contains a part string that is part of a parent string with the
index of the part string into the parent string.
A utility class for working with Field objects.
Extends DataTypeManager to provide methods specific to file data type archives (.gdt).
A (type, type_display_string, value) tuple.
A collection of
FileAttribute values that describe a file.Well known types of file attributes.
Categories of file attributes.
Extends DataTypeManager to provide methods specific to a data type manager that is file based.
A
ByteProvider that reads its bytes from a file.FileBytes provides access to the all the byte values (both original and modified) from an
imported file.
File caching implementation.
Represents a cached file.
A best-effort cache of MD5 values of files, where the file is identified by its parent's
MD5 combined with the file's path inside its parent's 'namespace'.
Defines a file change listener interface.
Bean editor to show a text field and a browse button to bring
up a File Chooser dialog.
DataTypeManager for a file.
A model that allows the
DropDownSelectionTextField to work with File objects.A class to represent the IMAGE_FILE_HEADER struct as
defined in
winnt.h.Factory class for generating unique file ID's.
Service for importing files into Ghidra.
FileInUseException indicates that there was contention
for a file which is in-use.Generates Function Offset fields
Interface for classes that will handle drop actions for files dropped onto the tool
Handles drag/drop events on a given component such that a file
dropped on the component from the front end tool will cause
that file to be opened.
A simple class that holds info relating to the result of verifying a file's existence and
proper usage of case.
Represents a fileset_entry_command
FileSystem provides a hierarchical view and management of a
set of files and folders.A
Plugin that supplies a filesystem browser component
that allows the user to view the contents of filesystems and perform actions on the
files inside those filesystems.A service to interact with file systems.
Events broadcast when a
GFileSystem is closed or has a FileSystemRef change.FileSystemListenerList maintains a list of FileSystemListener's.Statically scoped mugger that handles the dirty work of probing for and creating
GFileSystem instances.A helper class used by GFilesystem implementors to track mappings between GFile
instances and the underlying container filesystem's native file objects.
Specifies the info needed of a
GFileSystem implementation.Holds information read from a
FileSystemInfo annotation.FileSystemListener provides a listener the ability
to be notified of folder and file changes within a FileSystem.A callback interface used to choose which filesystem implementation to use when
multiple filesystem types indicate that they can open a container file.
A handle to a
GFileSystem which allows tracking the current users of the filesystem.A threadsafe helper class that manages creating and releasing
FileSystemRef instances
and broadcasting events to FileSystemEventListener listeners.Provides methods for dealing with GFilesystem files and
filesystems.Used by
getDerivedByteProvider()
to produce a derivative stream from a source file.Used by
getDerivedByteProviderPush()
to produce a derivative stream from a source file.This class is essentially a global flag used to track the long running file system synchronizing
operation.
A datatype to interpret the FILETIME timestamp
convention, which is based on the number of 100-nanosecond ticks
since January 1, 1601.
Enumeration of file types
Value class for
File types.UI for viewing the contents of very large files efficiently.
The FileWatcher *watches* a single file and fires a change notification whenever the file
is modified.
Automatically creates a structure definition based on the references found by the decompiler.
Automatically create a Structure data-type based on references found by the decompiler to a
root parameter or other variable.
Class to create pair between an offset and its related PcodeOp
A class that allows clients to wrap a given accumulator, only adding elements that pass the
given filter.
A graph implementation that allows clients to mark vertices and edges as filtered.
An interface that will be called when the text filter changes.
Dialog that allows the user to select options related to table filtering.
Specialized layout for the TableFilterDialog panels.
A text field that is meant to be used in conjunction with tables that allow filter text.
An interface that is meant to take the column type of of a
DynamicTableColumn
and convert it to the specified type.Uses the given filter to fade out vertices that do not pass.
Dialog that shows all checkouts in a specific folder and all of its subfolders.
A simple interface for the
FindDialog so that it can work for different search clients.Table loader for executing an incremental search forwards or backwards and adding that result
to the table.
A text filter that uses a pattern and performs a 'find' using that pattern.
Plugin event class for notification of when programs have completed being analyzed for the first
time.
A job to scale one or more viewers such that the contained graph will fit entirely inside the
viewing area.
FixedField10 provide an unsigned 10-byte fixed-length field value.The resulting data for a HandleTemplate after all the
placeholders have been resolved through context
A simple implementation of a LRU map that will throw away entries that exceed the given
maximum size.
An object that will cache values returned from the given factory.
Creates a fixed size stack.
Represents a fvmfile_command structure
Represents a fvmlib_command structure.
Built-in GTheme that uses the FlatDark
LookAndFeel and the dark application defaults.Built-in GTheme that uses the FlatLight
LookAndFeel and the dark application defaults.This class is a flattened version of the Program API.
Array of floats that grows as needed.
Array of float[] that grows as needed.
Converts Float Column objects to Double objects so that column gets Double type column
filters
Provides a definition of a
complex built-in data type consisting of two floating point
numbers in the IEEE 754 double precision format.Provides a definition of a Float within a program.
FloatFormat provides IEEE 754 floating-point encoding formats in support of
floating-point data types and floating-point emulation.SettingsDefinition to define the number of digits of precision to show.
A simple text field for inputing floating point numbers.
This class provides a TextField implementation that takes multiple AttributedString field
elements and places as many that will fit on a line without clipping before continuing to the
next line.
Class to define flow types for instruction (how it
flows from one instruction to the next)
Signals that the implementing cell editor desires to be notified when editing begins so that the
editor can request focus on the right widget.
An interface to provided the current focus owner.
FolderItem represents an individual file
contained within a FileSystem and is uniquely identified
by a path string.FolderLinkContentHandler provide folder-link support.FolderNotEmptyException is thrown when an attempt is
made to remove a Folder which is not empty.FollowFlow follows the program's code flow either forward or backward from an initial
address set.
ThemeEvent for when a font changes for exactly one font id.Font property editor that is a bit unusual in that its custom component is a button that when
pushed, pops up a dialog for editing the color.
Class that can transform one font into another.
Font subclass for creating an non UIResource Font from a FontUIResource.
Property Editor for editing
FontsA class for storing
Font values that have a String id (e.g.Editor for Theme fonts
Class to manage the set of format models.
Interface for listeners to format model changes.
The settings definition for the numeric display format
A Frame Description Entry (FDE) describes the
stack call frame, in particular, how to restore
registers.
Main plugin component for the Ghidra Project Window, which is
a PluginTool.
ProjectDataCollapseAction configured to work in the frontend.ProjectDataExpandAction configured to work in the frontend.ProjectDataNewFolderAction configured to work in the frontend.Interface for accessing front-end functionality.
Tool that serves as the the Ghidra Project Window.
FSBComponentProvider context for actionsPlugin component provider for the
FileSystemBrowserPlugin.GTreeNode that represents a directory on a filesystem.
Extension point, used by the
FSBComponentProvider to create actions that appear
in the fsb tree, and to delegate focus and default actions.Context given to a
FSBFileHandler instance when being initialized.GTreeNode that represents a file on a filesystem.
Static list of Icons for the file system browser plugin and its child windows.
Base class for all filesystem browser gtree nodes.
A GTreeNode that represents the root of a
GFileSystem, and keeps the
filesystem pinned in memory with its FileSystemRef.A _F_ile _S_ystem _R_esource _L_ocator, (name and string format patterned after URLs)
A type of
FSRL that is specific to the filesystem's identity.Implementation of the ShortKeySet interface that always contains
all the possible keys.
Interface to define methods available on a function.
Generates Function Call-Fixup Fields.
The
FunctionCallFixupFieldLocation class provides specific information
about the Function call-fixup field within a program location.The
FunctionCallingConventionFieldLocation class provides specific information
about the Function Calling Convention field within a program location.Specific function changes types for when the ProgramEvent is FUNCTION_CHANGED
ComparisonData for a function
A model for comparing one or more functions in a side by side display.
Allows subscribers to register for
function
comparison model changesService interface to create comparisons between functions which will be displayed
side-by-side in a function comparison window.
Database implementation of a Function.
Defines a function signature for things like function pointers.
Definition of a function for things like function pointers.
The
FunctionEndParametersFieldLocation class provides a field
for the close parenthesis of a function within a program location.The
FunctionInlineFieldLocation class provides specific information
about the Function Inline field within a program location.Interface for iterating over functions.
FunctionLocation provides information about the location
in a program within a Function.The manager for functions
Class that manages all functions within the program; there are some
convenience methods on Listing to create and access functions, but
all function related calls are routed to this class.
To change the template for this generated type comment go to
Window>Preferences>Java>Code Generation>Code and Comments
The
FunctionNameFieldLocation class provides specific information
about the Function Name field within a program location.This table field displays the Function Name containing either the program location or the address
associated with a row in the table.
The
FunctionNoReturnFieldLocation class provides specific information
about the Function noreturn field within a program location.Generates Function Offset fields
FunctionOverlapException is thrown in cases where
a function creation or change would result in overlapping functions.A
FunctionSignatureFieldLocation that indicates the user clicked on a function
parameter name.High-level prototype of a function based on Varnodes, describing the inputs and outputs
of this function.
Stores information about a function in a program such that the function can
be retrieved when needed.
Command for analyzing the Stack; the command is run in the background.
This table field displays the Function Purge for either the program location or the address
associated with a row in the table.
Option for controlling the renaming of a
Function when applying a
FunctionSignature or FunctionDefinition.Field for showing Function repeatable comments
The
FunctionRepeatableCommentFieldLocation class provides specific information
about the Function Repeatable Comment field within a program location.A handler to process
FunctionRepeatableCommentFieldLocation.Command for analyzing the Stack; the command is run in the background.
The
FunctionReturnTypeFieldLocation class provides specific information
about the Function Return Type field within a program location.Interface describing all the things about a function that are portable
from one program to another.
A hover service to show tool tip text for hovering over a function name in the decompiler.
A plugin to show tool tip text for hovering over function names in the decompiler.
Generates FunctionSignature Fields.
The
FunctionSignatureFieldLocation class provides specific information
about the Function Signature field within a program location.Deprecated.
FunctionDefinitionDataType should be used for defining a function signature
Class for parsing function signatures.
Generates Function Signature Source Fields.
The
FunctionSignatureFieldLocation class provides specific information
about the Function Signature field within a program location.This table field displays the Function Signature for either the program location or the address
associated with a row in the table.
Command for analyzing the Stack; the command is run in the background.
The
FunctionStartParametersFieldLocation class provides a field
for the open parenthesis of a function within a program location.Represents a LC_FUNCTION_STARTS command.
A "mix-in" interface that specific implementers of
ActionContext may also implement if
they can supply functions in their action context.Symbol class for functions.
Represents a function tag object that can be associated with
functions.
Defines a Function Tag Change set.
Database object for
FunctionTagAdapter objects.Generates a text label that lists the function tags for each
Function.Provides information about the location of an object that
represents the tag names assigned to a function.
Handles merging of function tags when they are added/removed from
functions.
Interface for managing function tags.
Class for merging function tag changes.
Table column for displaying all function tags associated with a given function.
The
FunctionThunkFieldLocation class provides specific information
about the Function Thunk field within a program location.Utility methods for performing function related actions.
Custom events to be used in conjunction with the
FVEventListener module. Custom slider that acts as the scroll bar for the FVTable.
Custom UI for a slider that dynamically adjusts the thumb height based on the size of the
given
JScrollPane and {JTable}.The table that backs the
FileViewer window.The model that backs the
FVTable table.Toolbar that contains widgets for controlling the
FileViewer.A drop-in replacement for clients using
SimpleAttributeSets.A drop-in replacement for
JButton that correctly installs a disabled icon.An abstract class that can be extended by other classes that perform part of the gcc analysis.
Utility methods for use by the gcc exception handling analysis.
An analyzer for locating and marking up the GCC exception handling information.
A
JCheckBox that has HTML rendering disabled.Provides a place for clients to retrieve the Clipboard they should be using.
Version of GColor that implements UIResource.
An interface for the
DynamicTableColumn.An enum that signals how the advanced column filtering should work.
A
JComboBox that disables HTML rendering.Provides a common implementation of a combo box drop-down list renderer, for use with
JComboBoxes.
A 'dynamic' label (the text can be changed), with HTML rendering allowed.
A directed graph
Unlike
GImplicitDirectedGraph, this graph is constructed explicitly
in memory.A 'dynamic' label (the text can be changed), with HTML rendering disabled.
Loads a packed Ghidra data type archive.
An abstract table model for showing DynamicTableColumns where each row is based on an object of
type ROW_TYPE.
An edge in a (usually directed) graph
A callback to get the weight of an edge
Analogous to Java's
Comparator, this provides a means to override the weight of an edge
in a graph, or provide a weight in the absence of a natural weight, when executing various graph
algorithms, e.g., shortest path.Generic implementation of the Address interface.
Generic implementation of the AddressSpace interface.
A low-level implementation of
ApplicationLayout that is suitable for basic applications.Templated simple DittedBitSequence Pattern for a byte/mask pattern and associated action.
Deprecated.
Calling convention name strings should be used instead of this class.
Generic data flavor class to override the equals(DataFlavor) method
in order to have data flavors support the same general class types
such as an ArrayList.
Base implementation for a generic data type.
The JDK-provided DateRenderer does not inherit the backgrounds and such properly.
Template for generic match action attached to a match sequence.
GenericSaveable is used by the DBPropertyMapManager
when the class can not be found and loaded for the class path name of a
property in the database.A simplified interface for stand alone applications.
A simple extension of
XMLOutputter that sets default settings to fix common bugs.A modal task that gets a domain object for a specified version.
Represents a file in a
filesystem.GFileSystem add-on interface that provides MD5 hashing for file located within the filesystem
Base implementation of file in a
filesystem.GFile implementation that refers to a real java.io.File on the local
file system.Interface that represents a filesystem that contains files.
This is the original GFileSystem implementation abstract base class, with most of the
initially implemented filesystem types extending this class.
A
GFileSystemFactory implementation that probes and creates instances of
GFileSystemBase which use the legacy filesystem lifecycle pattern.Task that recursively extracts all files from a GFileSystem directory
and writes them to a local filesystem.An empty interface that is a common type for the real factory interfaces to derive from.
A
GFileSystemFactory interface for filesystem implementations
that use a ByteProvider.Marker class that tells the
FileSystemFactoryMgr to not register this
filesystem instance.An empty interface that is a common type for the real probe interfaces to derive from.
A
GFileSystemProbe interface for filesystems that need to examine
a ByteProvider.A
GFileSystemProbe interface for filesystems that can be detected using
just a few bytes from the beginning of the containing file.GFileSystem add-on interface that allows a filesystem publish the fact that
it supports an import feature allowing the caller to import binaries directly into
Ghidra without going through a Loader.GFormattedTextField provides an implementation of JFormattedTextField
which facilitates entry validation with an indication of its current status.A component that acts as the general purpose glass pane for Java windows.
A class that allows clients to paint a message over top of a given component.
Ghidra help broker that displays the help set; sets the application icon on the help frame and
attempts to maintain the user window size.
A class to build help for an entire 'G' application.
A
ClassLoader for loading help data.A class that allows Ghidra to intercept JavaHelp navigation events in order to resolve them
to Ghidra's help system.
Ghidra help set that creates a GhidraHelpBroker, installs some custom HTML handling code via
the GHelpHTMLEditorKit, and most importantly, changes how the JavaHelp system works with
regard to integrating Help Sets.
Ghidra entry point that forwards the command line arguments to
GhidraLaunchable.The Ghidra application layout defines the customizable elements of the Ghidra
application's directory structure.
Interface for representing class objects in the program.
Custom Ghidra URL class loader which exposes the addURL method so we can add to the classpath
at runtime.
GhidraComboBox adds the following features:
An extension of File that does not translate to the
native operating system's file separator.
An implementation of a file chooser dialog.
Modes available for selecting files in the file chooser
Interface for the GhidraFileChooser data model.
Panel for entering a file name that includes a title border, a text field
for entering a filename, and a button for bringing up a file chooser dialog.
A listener for notifying when the file in the file chooser panel have changed.
GhidraFileData provides the managed object which represents a project file that
corresponds to matched FolderItem pair across both a versioned and private
filesystem and viewed as a single file at the project level.A interface that filters out all files
except for those type extensions that it knows about.
A class used to initialize the handling of files that are dropped onto the tool
Ghidra's help service.
The Ghidra jar application layout defines the customizable elements of the Ghidra application's
directory structure when running in "single jar mode."
A python interpreter meant for Ghidra's use.
Something intended to be launched by the
GhidraLauncher.Class used to prepare Ghidra for launching
This implementation expands
URLAnnotatedStringHandler providing an example form
of a local project Ghidra URL.Contains miscellaneous defines used for options.
GhidraPrincipal specifies a Ghidra user as a Principal
for use with server login/authentication.Helper class for using Ghidra in a "batch" mode.
GhidraProtocolConnector provides an abtract implementation to access Ghidra
repositories using various underlying communication protocols.GhidraProtocolHandler provides the extension point for
Ghidra protocol extensions.Instances of this class support both reading and writing to a
random access file.
Main Ghidra application class.
Extend this class to create screen shot images for help.
Ghidra Script Development.
A class to hold constants to be shared for clients of this package.
A utility class for managing script directories and ScriptInfo objects.
An exception for when a script provider cannot create a script instance
Handles processing for .properties files associated with a GhidraScript (.properties file and
script should share the same basename).
A provider that can compile, interpret, load, etc., Ghidra Scripts from a given language.
A simple class for running scripts outside of Ghidra.
A utility class for managing script directories and ScriptInfo objects.
GhidraServerHandle provides access to a remote server.This implementation expands
URLAnnotatedStringHandler providing an example form
of a Ghidra Server URL.Represents the current state of a Ghidra tool
The GhidraSwinglessTimer is similar to the javax.swing.Timer class.
Navigation is only supported if the underlying table model
implements
ProgramTableModel and the setGoToService() method
has been called with a valid reference.This is a "program aware" version of GTableFilterPanel
The Ghidra test application layout defines the customizable elements of the Ghidra
application's directory structure when running a test.
GhidraThreadGroup provides a means of catching all uncaught
exceptions which occur in any Ghidra thread.Creates a new
GhidraTimer appropriate for a headed or headless environment.Tool created by the workspace when the user chooses to create a new
tool.
Implementation for a tool template that has the class names of the
plugins that are part of the tool, and the tool's icon.
Supported URL forms include:
ghidra://<host>:<port>/<repository-name>[/<folder-path>]/[<folderItemName>[#ref]]
ghidra:/[X:/]<project-path>/<project-name>[?[/<folder-path>]/[<folderItemName>[#ref]]]
Connection status codes
GhidraURLQuery performs remote Ghidra repository and read-only local project
queries for processing either a DomainFile or DomainFolder that a
Ghidra URL may reference.GhidraURLQueryTask provides an abstract Task which performs remote Ghidra
repository and read-only local project queries for processing either a DomainFile
or DomainFolder that a Ghidra URL may reference.GhidraURLResultHandlerAdapter provides a basic result handler for
GhidraURLQuery.GhidraURLWrappedContent provides controlled access to a Ghidra folder/file
associated with a Ghidra URL.Extends GValuesMap to add Ghidra specific types such as Address and Program
A
JCheckBox that allows HTML rendering.An immutable label (the text can NOT be changed), with HTML rendering allowed.
A JTextPane for rendering HTML, as well as copying WYSIWYG text copying.
A label that only contains an image and no text.
GFileSystem add-on interface to allow filesystems to override how image files
are converted into viewable Icon instances.Version of GIcon that implements UIResource.
Class for determining the size of a GIF image.
A directed graph that need not be constructed explicitly
An immutable label (the text can NOT be changed), with HTML rendering disabled.
A sub-class of JList that provides an auto-lookup feature.
AutoLookup implementation for GListsProvides a common implementation of a list renderer, for use in both JList and JComboBox.
Action for global focus traversal.
Class to manage all the global actions that show up on the main tool menubar or toolbar
The global namespace implementation class
The global symbol implementation class
A container for global symbols in the decompiler's model of a function.
Represents a module in universe of repos.
A mouse listener implementation designed to provide consistent handling of triggers for
popups and double-clicking.
GNU Constants.
An ELF section (almost like a
ElfNote) that contains information about an external
DWARF debug file.Auxiliary version information.
Version definition sections.
Auxiliary needed version information.
Version dependency section.
GoType structure that defines an array.Represents the fundamental golang rtti type information.
This class represents a go build id string, along with a magic header.
A program section that contains Go build information strings, namely go module package names,
go module dependencies, and build/compiler flags, as well as the golang version itself.
Key=value element of Golang Build settings
A
GoType structure that defines a go channelMisc constant values for golang
A structure that golang generates that contains metadata about a function.
An index into a GoFuncData's variable-size funcdata array.
Bitmask flags for runtime._func (GoFuncData) flags field.
List of function ids for runtime._func (GoFuncData) funcID field.
A structure that golang generates that maps between a function's entry point and the
location of the function's GoFuncData structure.
Utility class to fix Golang function parameter storage
Handles creating a Ghidra structure to represent multiple return values returned from a golang
function.
A
GoType structure that defines a function type.A structure that golang generates that maps between a interface and its data
A
GoType structure that defines a golang interface.Represents a mapping between a golang interface and a type that implements the methods of
the interface.
Enum defining the various golang primitive types
Fixups for golang functions found during DWARF processing.
Handles marking up and program info for Golang binaries.
Golang type info about a specific map type.
Structure that defines a method for a GoType, found in the type's
GoUncommonType struct.Represents a golang moduledata structure, which contains a lot of valuable bootstrapping
data for RTTI and function data.
Represents information about a single golang module dependency.
Represents a golang "name" construct, which isn't represented in go as a normal structure
since it is full of variable length and optional fields.
Logic and helper for allocating storage for a function's parameters and return value.
An index into a GoFuncData's variable-sized pcdata array.
A low-level structure embedded in golang binaries that contains useful bootstrapping
information.
Evaluates a sequence of (value_delta,pc_delta) leb128 pairs to calculate a value for a certain
PC location.
WARNING: tricky code / class layout here!
GoType structure that defines a pointer.Immutable information about registers, alignment sizes, etc needed to allocate storage
for parameters during a function call.
XML config file format:
DataTypeMapper for golang binaries.A structure that represents a golang slice instance (similar to a java ArrayList).
Golang type information about a specific slice type.
Represents a golang source file and line number tuple.
A structure that represents a golang string instance.
Structure used to define a field in a
struct type.Golang type information about a specific structure type.
Represents a Golang symbol name.
The GoToService provides a general service for plugins to generate GoTo
events.
Listener that is notified when the GOTO completes.
Action assigning a parameter Address from the next available stack location
Common abstract base class for GoType classes
Small stub that is only used to fetch the "kind" field so that the real gotype can be detected
Enum defining the various bitflags held in a GoType's tflag
Structure found immediately after a
GoType structure, if it has the uncommon flag
set.A pascal-ish string, using a LEB128 (or a uint16 in pre-1.16) value as the length of the
following bytes.
Golang version numbers
This picked-state is a wrapper for
PickedState that allows us to broadcast events
with the trigger of that event.Class for saving name/value pairs as XML or Json.
A
JRadioButton that disables HTML rendering.The base ActionContext for the GraphDisplay instances.
A set of convenience methods for performing graph algorithms on a graph.
An interface and state values used to follow the state of vertices as they are processed by
algorithms
A component that contains primary and satellite graph views.
Interface for objects that display (or consume) graphs.
Ghidra service interface for managing and directing graph output.
Interface for being notified when the user interacts with a visual graph display
Class for managing graph display options.
Builder for building
GraphDisplayOptionsBasic interface for objects that can display or otherwise consume a generic graph
Exception thrown if a failure occurs while generating a Graph.
Deprecated.
A graph job is an item of work that needs to be performed.
A listener to
GraphJob stateA class to run
GraphJobs.Specification for the vertex label position relative to the vertex shape.
The methods on this interface are meant to enable graph traversal in a way that allows
the underlying graph to be walked from top-down or bottom-up.
Class for storing paths with fast "contains" method.
An object that allows for storing and restoring of graph perspective data, like the zoom
level and the position of the graph.
A listener to get notified of changes to the
SatelliteGraphViewerClass that defines a new graph type.
Builder class for building new
GraphTypesThe base viewer for the Graph module.
This class houses various methods for translating location and size data from the various
graph coordinate spaces.
An object that maps vertices to rows and columns and edges to their articulation points.
The interface for groupings of code units that may have attributes such
as names and comments.
A visual graph with methods needed to facilitate grouping of vertices.
The
GroupPath is a class to represent a unique path in a tree for a Group.Class to define a selection of GroupPath objects.
Class for tracking scheduled GTasks.
A sub-class of
JTable that provides navigation and auto-lookup.AutoLookup implementation for GTablesA default table cell renderer that relies on the
toString() method when rendering
the cells of the table.A state object to provide a table cell renderer with data beyond the standard Java
TableCellRenderer interface.A class to allow GTables to support drag operations.
This class is a panel that provides a label and text field that allows users to input text that
filters the contents of the table.
A special header for GhidraTables to handle things like tooltips and hover information.
A GUI that provides a filterable table.
Component for displaying a list of items as a series of horizontal tabs where exactly one tab
is selected.
Custom border for the
GTab.Interface for tasks to be run by
GTaskManager.Class for grouping several
GTasks that all should be
executed before any new group of tasks are
executed, regardless of priority.Interface used to track the state of a GTaskManager
A Dummy implementation to that listeners can subclass this and not have to fill in methods they
don't need.
Class for managing a queue of tasks to be executed, one at a time, in priority order.
Factory class managing a single GTaskManager for an DomainObject.
Main component for managing and viewing the state of a GTaskManager.
Implementation of a TaskMontor that can be "attached" to a GProgressBar.
Class to represent the result state of a GTask, such as whether it was cancelled or an exception
happened.
Class to store all the configurable appearance properties (Colors, Fonts, Icons, Look and Feel)
in an application.
This class contains many suitable default values for commonly used concepts.
Colors mapped to common system widget concepts, such as foreground, background, border, etc.
'Messages' is primarily used by system dialogs to display status.
Generic palette colors, using color names, that may be changed along with the theme.
Color values to use for tables
Color values to use with tooltips
Class for storing colors, fonts, and icons by id
Shares values for the three theme value tables so they all don't have their own copies
A convenience component designed specifically for rendering threaded table models.
Class for managing and sharing thread pools.
A class to schedule
Runnables to run after some delay, optionally repeating.Class for caching key,value entries for a limited time and cache size.
Monitor object returned from a GTimer.schedule() call
LookAndFeelManager for GTKBuilt-in GTheme that uses the GTK+
LookAndFeel and the standard (light)
application defaults.Class for creating a JTree that supports filtering, threading, and a progress bar.
A GTree task to fully collapse a tree
A GTree task to fully expand a tree node to a maximal depth.
Interface for providing a filter for GTrees.
Base class for GTreeNodes that populate their children on demand (typically when expanded).
Base implementation for GTree nodes.
A transferable for sharing data via drag/drop and clipboard operations for GTrees
An enum that contains the origin of the GTreeSelectionEvent (see each enum for more
details).
This class was created so that GTree users can know the origin of tree selections.
Base class for nodes that generate their children on demand, but because generating their
children is slow, that operation is moved to a background thread.
A class to remember the current state of the tree, for things like expanded paths,
selected paths and the view location.
A generic transfer handler used by GTrees to handle transferring drag/drop data and clipboard
data.
Provides a static set of methods for globally managing application themes and their values.
GUIDs identify objects such as interfaces, manager entry-point vectors (EPVs),
and class objects.
Class for defining, storing, and retrieving groups of values of various types.
An edge having a natural weight
Loads a packed Ghidra program.
Handler provides a "ghidra" URL protocol handler which
corresponds to the GhidraURLConnection implementation.Placeholder that resolves for a specific
InstructionContext into a FixedHandle
representing the semantic value of a ConstructorThis encodes the main hash value for an n-gram, and the number of Instructions hashed
Interface for hashing across sequences of Instructions in different ways
Correlator to construct a 1-1 map between the Instructions of two similar Functions.
Cross-reference container for different n-grams that share a particular hash
A filtering
OutputStream that calculates the hash of the bytes being
written.HashStore is a sorted, basic-block aware, store for Instruction "n-grams" to help quickly match similar
sequences of Instructions between two functions.
Class explicitly labeling (one-side of) a matching n-gram pair.
Command object for performing HCS12/XGate disassembly
The cursor values used when drag-n-dropping dockable components
The class used kick-off and interact with headless processing.
HeadlessClientAuthenticator provides the ability to install a Ghidra Server
authenticator needed when operating in a headless mode.Options for headless analyzer.
This class is analogous to GhidraScript, except that is only meant to be used with
the HeadlessAnalyzer.
Options for controlling disposition of program after the current script completes.
This is a strange implementation of
ThemeManager that is meant to be used in a headless
environment, but also needs theme properties to have been loaded.Monitor used by Headless Analyzer for "timeout" functionality
Creates the HelpManager for the application.
Register help for a specific component.
Class to identify where help can be located for some object.
Class that uses JavaHelp browser to show context sensitive help.
A class that is meant to hold a single help input directory and 0 or more
external, pre-built help sources (i.e., jar file or directory).
A basic arrow that points to the right, with padding on the sides and above.
HelpService defines a service for displaying Help content by an ID or URL.Topics for Help.
Hack to fix:
JFrames cannot be invisible
Allocate the return value as an input parameter
A pointer to where the return value is to be stored is passed in as an input parameter.
Component displayed when not all tabs fit on the tab panel and is used to display a popup
list of all tabs.
A global symbol as part of the decompiler's model of a function.
A constant that has been given a datatype (like a constant that is really a pointer)
A symbol, within a decompiler model, for a function without a body in the current Program.
High-level abstraction associated with a low level function made up of assembly instructions.
HighFunctionDBUtil provides various methods for updating the state of a
function contained within a program database.A function symbol that represents only a shell of (the name and address) the function,
when no other information is available.
A function symbol that encapsulates detailed information about a particular function
for the purposes of decompilation.
All references (per function) to a single global variable
A symbol with no underlying data-type.
A class to used to track a
Decompiler token along with its highlight colorOther forms of variable, these are typically compiler infrastructure
like the stackpointer or saved registers
High-level function parameter
High-level abstraction associated with a low level function made up of assembly instructions.
A symbol within the decompiler's model of a particular function.
A High-level variable (as in a high-level language like C/C++)
built out of Varnodes (low-level variables).
Simple text field that shows a text hint when the field is empty.
An object meant to track items with the ability to go back and forth within the list of
items.
Handles the actions required when the user presses the 'home' key; this moves the viewport
to the top of the file.
Filter on a homogeneous aggregate data-type
All primitive data-types must be the same.
LayoutManager for arranging components in a single row.
An action that can be added to a menu in order to separate menu items into groups
Panel that displays an animation of a spinning hourglass
HoverService provides the ability to popup data Windows over a Field viewer
in response to the mouse hovering over a single Field.An implementation of exporter that creates
an HTML representation of the program.
Splits into lines a given String that is meant to be rendered as HTML.
A helper class providing static methods for formatting text with common HTML tags.
A component that acts like a label, but adds the ability to render HTML anchors and the
ability for clients to add anchor handlers.
IBO32DataType provides a Pointer-Typedef BuiltIn for
a 32-bit Image Base Offset Relative Pointer.IBO64DataType provides a Pointer-Typedef BuiltIn for
a 64-bit Image Base Offset Relative Pointer.ThemeEvent for when an icon changes for exactly one icon id.Class that can transform one icon into another.
A class that knows how to provide an icon and the URL for that icon.
A class to get generic icons for standard actions.
A class for storing
Icon values that have a String id (e.g.Editor for Theme fonts
IconWrapper provides a simple icon wrapper which
delays icon construction until its first use.Represents a ident_command structure.
A transformer that never alters its input
GTreeFilter that allows for some nodes that are never filtered out.
Replace illegal characters in the given name with '_'.
An illegal access has been performed on a field.
IllegalPanelStateException allows unexpected IOExceptions and other errors
to be thrown during Wizard panel transitionsException thrown if a data type does not allow its name to be changed.
Generates Imagebase Offset fields
typedef struct IMAGE_COR20_HEADER
{
// Header versioning
DWORD cb; // Size of the structure
WORD MajorRuntimeVersion; // Version of the CLR Runtime
WORD MinorRuntimeVersion; // Version of the CLR Runtime
// Symbol table and startup information
IMAGE_DATA_DIRECTORY MetaData; // A Data Directory giving RVA and Size of MetaData
DWORD Flags;
union {
DWORD EntryPointRVA; // Points to the .NET native EntryPoint method
DWORD EntryPointToken; // Points to the .NET IL EntryPoint method
};
// Binding information
IMAGE_DATA_DIRECTORY Resources; // A Data Directory for Resources, which are referenced in the MetaData
IMAGE_DATA_DIRECTORY StrongNameSignature; // A Data Directory for unique .NET assembly signatures
// Regular fixup and binding information
IMAGE_DATA_DIRECTORY CodeManagerTable; // Always 0
IMAGE_DATA_DIRECTORY VTableFixups; // Not well documented VTable used by languages who don't follow the common type system runtime model
IMAGE_DATA_DIRECTORY ExportAddressTableJumps; // Always 0 in normal .NET assemblies, only present in native images
// Precompiled image info (internal use only - set to zero)
IMAGE_DATA_DIRECTORY ManagedNativeHeader;
};
Data type for
ImageCor20Header.flags.Class for displaying images in fields.
Deprecated, for removal: This API element is subject to removal in a future version.
This class has been replaced by a series of classes that extend
LazyImageIcon: UrlImageIcon, DerivedImageIcon, BytesImageIcon,
DisabledImageIcon, and ScaledImageIcon.A class that represents the original location of an IMG tag along with its location
resolution within the help system.
Creates a panel that displays an
Image.An interface for working with function table entries used for exception handling, which are found
in the .pdata section.
typedef struct _IMAGE_ARM_RUNTIME_FUNCTION_ENTRY {
DWORD BeginAddress;
union {
DWORD UnwindData;
struct {
DWORD Flag : 2;
DWORD FunctionLength : 11;
DWORD Ret : 2;
DWORD H : 1;
DWORD Reg : 3;
DWORD R : 1;
DWORD L : 1;
DWORD C : 1;
DWORD StackAdjust : 10;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
} IMAGE_ARM_RUNTIME_FUNCTION_ENTRY, * PIMAGE_ARM_RUNTIME_FUNCTION_ENTRY;
typedef struct _IMAGE_RUNTIME_FUNCTION_ENTRY {
DWORD BeginAddress;
DWORD EndAddress;
union {
DWORD UnwindInfoAddress;
DWORD UnwindData;
} DUMMYUNIONNAME;
} RUNTIME_FUNCTION, *PRUNTIME_FUNCTION, _IMAGE_RUNTIME_FUNCTION_ENTRY, *_PIMAGE_RUNTIME_FUNCTION_ENTRY;
#define UNW_FLAG_NHANDLER 0x0
#define UNW_FLAG_EHANDLER 0x1
#define UNW_FLAG_UHANDLER 0x2
#define UNW_FLAG_CHAININFO 0x4
typedef struct _UNWIND_INFO {
UCHAR Version : 3;
UCHAR Flags : 5;
UCHAR SizeOfProlog;
UCHAR CountOfUnwindCodes;
UCHAR FrameRegister : 4;
UCHAR FrameOffset : 4;
UNWIND_CODE UnwindCode[1];
//
// The unwind codes are followed by an optional DWORD aligned field that
// contains the exception handler address or the address of chained unwind
// information.
Provides drag-n-drop support for Images
Performs a batch import using the data provided in the
BatchInfo object which
specifies what files and the import language that should be used.A class to represent the
IMAGE_IMPORT_BY_NAME
data structure defined in winnt.h.Points to the imports (an array of IMAGE_IMPORT_DESCRIPTOR structures).
typedef struct _IMAGE_IMPORT_DESCRIPTOR {
union {
DWORD Characteristics; // 0 for terminating null import descriptor
DWORD OriginalFirstThunk; // RVA to original unbound IAT (PIMAGE_THUNK_DATA)
};
DWORD TimeDateStamp;
DWORD ForwarderChain; // -1 if no forwarders
DWORD Name;
DWORD FirstThunk; // RVA to IAT (if bound this IAT has actual addresses)
}
Imported Libraries
See Apple's -- PEFBinaryFormat.h
A class to represent the new-executable imported name table.
Dialog for importing a file into Ghidra as a program.
A
Plugin that supplies menu items and tasks to import files into Ghidra.Utilities for importing files.
Exception class to be used when API calls are improperly used (i.e., GhidraScript.askProjectFolder() method is
being used in Headless mode).
Marker row object that signals to the table API that the references contained therein all
share the
to address, with each row showing the from address.Exception thrown when attempting to replace one language in a program with another that
is not "address space" compatable.
An IncompatibleMaskException is thrown when operations
are attempting involving two masks of different lengths.
Column Constraint where acceptable column values are within some range defined by a min value and
a max value.
Field responsible for drawing +/- symbols when over an aggregate datatype that
can be opened or closed.
The
IndentFieldLocation class contains specific location information
within the indent field of a CodeUnitLocation object.Iterates over a FieldIterator; the field is the address but not
the key; the column for the field must be indexed.
Indexed Dynamic Data Type template.
IndexedLocalFileSystem implements a case-sensitive indexed filesystem
which uses a shallow storage hierarchy with no restriction on file name or path
length.BadStorageNameException invalid storage name
encountered.IndexReadException occurs when an error occurs
while reading/processing the filesystem indexIndexReadException occurs when an error occurs
while reading/processing the filesystem indexInterface for scrolling a FieldPanel or container of a group of FieldPanels which displays
a list of displayable items (layouts)
IndexedLocalFileSystem implements a case-sensitive indexed filesystem
which uses a shallow storage hierarchy with no restriction on file name or path
length.Interface for mapping indexes when the LayoutModel changes.
Class for holding a begin and end index.
Iterator interface for index ranges.
A class to represent the Information Block
defined in the Windows new-style executable.
Exception thrown by
DefaultPcodeThread.PcodeEmulationLibrary.emu_injection_err(), a p-code userop invoked
when client-provided Sleigh code in an injection could not be compiled.InjectPayload encapsulates a semantic (p-code) override which can be injected
into analyses that work with p-code (Decompiler, SymbolicPropagator)
The payload typically replaces either a subroutine call or a useropA substitute for a callfixup that did not successfully parse.
A substitute for a callother fixup that did not fully parse
InjectPayloadSleigh defines an InjectPayload of p-code which is defined via
a String passed to the sleigh compilerA panel with a component-containing border.
InputBlockStream provides a BufferFile input block stream.A dialog that has text fields to get user input.
Listener that is notified when the OK button is hit on the input dialog.
Cspec prototype model input listtype
A
ByteProvider implementation that wraps an InputStream, allowing
data to be read, as long as there are no operations that request data from a previous
offset.A dialog that has text fields to get user input.
Column Constraint where acceptable column values are within some range defined by a min value and
a max value.
Action class that inserts a new row into a FieldModel.
This class is the container for hashing information about a particular instruction, including all the
n-grams it is currently involved in within the HashStore.
Interface to define an instruction for a processor.
Represents a block of instructions.
InstructionContext is utilized by a shared instruction prototype to
access all relevant instruction data and context-register storage needed during
instruction parse and semantic pcode generation.Database implementation for an Instruction.
A means of decoding machine instructions from the bytes contained in the machine state
Interface to define an iterator over over some set of instructions.
Matches against the actual instruction bit stream
InstructionPrototype is designed to describe one machine level instruction.
Converts a record iterator into an instruction iterator.
A set of instructions organized as a graph of basic blocks.
InstructionStub can be extended for use by tests.
An InsufficientBytesException indicates that there were not enough
consecutive bytes available to fully parse an instruction.
Array of ints that grows as needed.
Array of int[] that grows as needed.
An ArrayList type object for ints.
An editor for Boolean properties.
A fixed size 16 byte signed integer (commonly referred to in C as int128_t)
This class provides a storage mechanism for integer-valued information about
the elements of a KeyIndexableSet, e.g.
A constraint editor for specifying comparison with a single integer-type value (Byte, Short,
Integer, and Long).
Basic implementation for an signed Integer dataType
Base class for providing single value numeric editors.
A constraint editor for specifying ranges of integer-type numbers (Byte, Short, Integer,
and Long).
Base class for providing numeric range editors.
The settings definition for the numeric display format for handling signed values.
Creates a component for editing Integer values using an
IntegerTextField and a JSpinner.TextField for entering integer numbers, either in decimal or hex.
Exports the current program (or program selection) as bytes in Intel Hex format.
Marker interface for
Table interior nodes within the BTree structure.Specifies a selection that consists of components inside a structure.
An annotation for things internal to an implementation
For organization, some interfaces and classes exist in packages outside where they are used, and
method access is required.
Exception thrown by
DefaultPcodeThread.PcodeEmulationLibrary.emu_swi(), a p-code userop exported by
emulators for implementing breakpoints.IntField provides a wrapper for 4-byte signed integer data
which is read or written to a Record.Class to generate int indexes to be used for arrays or tables.
Class that implements a hashtable with int keys and int values.
This class converts arbitrary int keys into compacted int indexes suitable
for use as indexes into an array or table.
Class to manage multiple linked lists of int indexes.
Class that implements a hashtable with int keys and Object values.
Property manager that deals with properties that are of
int type.
Property manager that deals with properties that are of
int type and stored with a database table.
Class for storing a set of integers
Value class for
Integer Value with an option for display the value as decimal or hex.Handles general storage and retrieval of int values indexed by long keys.
Exception for invalid address either due to improper format
or address not defined within target
An annotated string handler that is used to display an error message string when there is a
problem creating an annotated string.
Objects of this class are the result of
SearchFormats not being able to fully parse
input text.An
IOException that indicates that the data being transmitted was invalid or bad format.Exception thrown if a data type is not valid for the operation being performed.
Exception thrown if input is invalid.
Exception thrown if a name has invalid characters.
An exception class to handle encountering
invalid NT Headers.
Class to represent an invalid instruction prototype.
A link that represents the case where the HTML tried to reference a runtime Java image, but
that value is not found
An exception class to handle encountering
invalid Windows Headers.
An IO operation was cancelled by the user.
Class to pass to a thread pool that will consume all output from an external process.
A simulated file descriptor that proxies a host resource, typically a console/terminal
IsolatedEntryCodeSubModel (S-model) defines subroutines with a
unique entry point, which may share code with other subroutines.ItemCheckoutStatus provides immutable status information for a
checked-out item.ItemDeserializer facilitates the reading of a compressed data stream
contained within a "packed" file.ItemSerializer facilitates the compressing and writing of a data stream
to a "packed" file.Finds all paths between two vertices for a given graph.
JarWriter is a class for writing to a jar output stream.
A
SettingsDefinition implementation that uses a real java Enum.A handler to facilitate drag-n-drop for a list of Java
File objects which is dropped
onto the Project data tree or a running Ghidra Tool (see DataFlavor.javaFileListFlavor).This class:
Creates a XXX_map.xml file (topic IDs to help files)
Creates a XXX_TOC.xml file from a source toc.xml file
Finds unused images
Generate a file of all components and actions in the
A base class that represents a Java UIManager property.
The provider for Ghidra Scripts written in Java
Finds all circuits (loops) in the given graph.
A utility class to format strings in JSON format.
A
ToStringStyle inspired by ToStringStyle.JSON_STYLE that places
object fields all on one line, with Json style formatting.A
ToStringStyle inspired by ToStringStyle.JSON_STYLE that places
object fields on newlines for more readabilityA convenience class for creating a GProperties object from a file containing JSon data
generated from
GProperties.saveToJsonFile(File)JumpTable found as part of the decompilation of a function
A class to combine the
JungDirectedGraph and the VisualGraph
interfacesA layout provider that works on
JungDirectedVisualGraphs.A factory to produce
JungLayoutProviders that can be used to layout
VisualGraphsPickingGraphMousePlugin supports the picking of graph elements
with the mouse.
A class that turns a
Graph into a GDirectedGraph.A wrapper that allows for existing Jung layouts to be used inside of the Visual Graph system.
Generates CodeCompletions from Jython objects.
This plugin provides the interactive Jython interpreter.
Launcher entry point for running Ghidra from within Jython.
A Jython version of a
GhidraScript.A
GhidraScriptProvider used to run Jython scriptsPython utility method class.
Translated from the C++ version.
A class for storing an action's key stroke, mouse binding or both.
Allows Ghidra to give preference to its key event processing over the default Java key event
processing.
An enum that holds the values for order of keybinding precedence, in order from
highest priority to lowest.
An object that maps actions to key strokes and mouse bindings.
A class that organizes system key bindings by mapping them to assigned
DockingActionIfs.Panel to show the key bindings for the plugin actions.
Allows clients to signal their support for the assigning of key binding shortcut keys.
A class to provide utilities for system key bindings, such as importing and
exporting key binding configurations.
Deprecated.
Deprecated.
Dialog to set the key binding on an action.
Interface used to notify listener when a keystroke has changed.
Text field captures key strokes and notifies a listener to process the key entry.
Deprecated.
Class for holding a range of database keys (long values)
To change this generated comment edit the template variable "typecomment":
Window>Preferences>Java>Templates.
To enable and disable the creation of type comments go to
Window>Preferences>Java>Code Generation.
A version of
BrowserCodeUnitFormat that changes how labels are rendered in offcut
situations.Generates label Fields.
The
LableFieldLocation class contains specific location information
within the LABEL field of a CodeUnitLocation object.Container for history information about what happened to a label.
This table column displays the Label for either the program location or the address
associated with a row in the table.
An enumeration that represents the set of supported
LookAndFeelsRepresents an opinion's processor language and compiler.
Represents an opinion's processor language (x86:LE:32:default, 8051:BE:16:default, etc).
Exception class used when the named language cannot be found.
LanguagePostUpgradeInstructionHandler provides an abstract implementation
of a post language-upgrade instruction modification handler.NOTE: ALL LanguageProvider CLASSES MUST END IN "LanguageProvider".
Service that provides a Language given a name, and
information about the language.
NOTE: ALL LanguageTranslator CLASSES MUST END IN "LanguageTranslator".
LanguageTranslatorAdapter provides a default language translator
behavior which may be extended to provide customized language translations.LanguageTranslatorFactory manages all language translators within Ghidra.Value class for LanguageCompilerSpecPair types.
Interface for a set of data fields that represent one indexable set of information
in the model.
Just a static list of graph layout algorithm names
Interface for classes that manage the background color of a layout.
Cache for MultiLayout objects
A listener for layout changes.
A class that holds row and column data for each vertex and edge.
A LayoutLockedFieldPanelCoordinator is an extension of a LineLockedFieldPanelCoordinator that
handles the fact that field panel layouts vary in size.
The Big Layout Model interface.
An
Iterator returning Layout objects that hides the details of using LayoutModel's
indexing methods.A mapping from pixel coordinate to layout index
Simple container class to hold vertex locations (points) and edge articulation locations
(points).
A layout provider creates
VisualGraphLayout instances.A version of
LayoutProvider that is discoverable at runtime.LazyImageIcon provides the ability to instantiate
an ImageIcon with delayed loading.Instances of this class will provide a simple map interface to a cached set of key,value
pairs.
Abstract class for finding the Longest Common Subsequence (LCS) between two
sequences of Matchable objects,
x and y.Logic for reading LEB128 values.
Class to hold result of reading a
LEB128 value, along with size and position metadata.Form new expression by left shifting PatternExpression the amount
determined by another PatternExpression
Solves expressions of the form
A << BA class to hold a length/string/ordinal set.
A class to store a length/string set,
where the string is not null-terminated
and the length field determines the string
length
A class to represent the libobjc DYLIB Mach-O that resides within a DYLD cache
Represents a objc_opt_t structure, which resides in the libobjc DYLIB within a DYLD cache
Interface for a Library namespace.
Dialog for editing Library Search Paths which are used by the importer to locate referenced
shared libraries.
A dummy
Option used to render a button that will allow the user to edit the global
list of library search pathsA simple class for managing the library search path and avoiding duplicate directories.
Class for library symbols.
Creates an address correlation with a simplistic correlation where each address correlates based
on an offset from the address set's minimum address.
A class to manage loading Linear Executables (LX).
A LineLockedFieldPanelCoordinator coordinates the scrolling of a set of field panels by sharing
bound scroll models that are locked together by a set of line numbers.
The built-in provider for the Decompiler's line number margin
A byte buffer that is stored as a linked list of pages.
A linked-list page node
An iterator into the byte buffer
LinkedDomainFolder extends DomainFolder for all folders which are
accessable via a folder-link (see FolderLinkContentHandler).LinkedGhidraFolder provides the base LinkedDomainFolder implementation which
corresponds to a project folder-link (see FolderLinkContentHandler).Represents a linkedit_data_command structure
Represents a linker_option_command structure
NOTE: ALL ContentHandler implementations MUST END IN "ContentHandler".
A handler to facilitate drag-n-drop for a Linux URL-based file list which is dropped
onto the Project data tree or a running Ghidra Tool (see
LinuxFileUrlHandler.linuxFileUrlFlavor).A simple interface that allows listener structures to use different error handling
A simple interface for creating listener error handlers
A data structure meant to be used to hold listeners.
This interface provides all the methods needed to create,delete, retrieve,
modify code level constructs (CodeUnits, Macros, Fragments, and Modules).
This is the interface for a correlator that associates addresses from one program with
addresses from another program or it can associate addresses from one part of a program
with addresses from another part of the same program.
This interface extends the
BackgroundColorModel exclusively for BackgroundColorModels used by
the ListingPanel.Panel that displays two listings for comparison.
Action context for a ListingCodeComparisonPanel.
Keeps two listing panels synchronized, both the view and cursor location
Determines where instructions couldn't be matched and where they differ between sets of
addresses as provided by a ListingAddressCorrelation.
Manages the actions that control a ListingDiff.
Interface defining a listener that gets notified when the ListingDiff's set of differences
and unmatched addresses has changed.
Represents one side of a dual listing compare window.
Class for editing Listing display properties.
Interface that extends the Field interface to add addition information that
the browser needs from the fields.
Wrapper class to translate calls to
FieldHighlightFactory into a call needed by the
ListingHighlightProvider.Provider of Highlight objects appropriate
ListingFields.ListingMergeConstants is an interface that provides constants
that are used throughout all of the Listing merge managers for multi-user.Manages program listing changes and conflicts between the latest versioned
program (LATEST) and the modified program (MY) being checked into version control.
ListingField implementation for text fields.
A better linked list implementation than provided by java.util.
This class provides a panel that contains a JList component.
A listener designed to forward events from a JList to its renderer.
Helper class to convert a byte array to a Java primitive in Little endian
order, and to convert a primitive to a byte array.
Live memory handler interface.
Represents a load_command structure
A factory used to create
LoadCommandsRepresents an lc_str union
LoadCommand typesA class to represent the
IMAGE_LOAD_CONFIG_DIRECTORY
data structure which is defined in winnt.h.A loaded
DomainObject produced by a Loader.An interface that all loaders must implement.
An option chooser that applies loader options that were passed in as command line arguments.
See Apple's -- PEFBinaryFormat.h
See Apple's -- PEFBinaryFormat.h
Factory and utility methods for working with
Loaders.Thrown when a
load
fails in an expected way.The result of a
load.Represents a possible way for a
Loader to load something.LocalBufferFile implements a BufferFile as block-oriented
random-access file.A simple interface that allows for dependency injection
LocalDatabaseItem provides a FolderItem implementation
for a local database.LocalDataFile provides a FolderItem implementation
for a local serialized data file.LocalDataFileHandle provides random access to
a local File.Spinner Model for LocalDate
Text field for entering dates.
A
SearchLocation that recursively searches for dwarf external debug files
under a configured directory.A default implementation of the file chooser model that browses the local file system.
A
GFileSystem implementation giving access to the user's operating system's
local file system.LocalFileSystem provides access to FolderItem's which
exist within a File-based directory structure.A
GFileSystem interface to a part of the user's local / native file system.LocalFolderItem provides an abstract implementation of a folder
item which resides on a local file-system.LocalManagedBufferFile implements a BufferFile as block-oriented
random-access file which utilizes a BufferFileManager to
identify and facilitate versioning of buffer files.A pty session consisting of a local process and its descendants
A container for local symbols within the decompiler's model of a function.
Specifies location and metrics for
PopupWindowPlacer.Class to handle location based highlights for a decompiled function.
An auxiliary arithmetic that reports the location the control value
An auxiliary state piece that reports the location of the control value
Ghidra synchronization lock.
Indicates a failure to obtain a required lock.
Provides for the creation and management of a named lock file.
Pattern converter for Log4j 2.x that adds a hyperlink for the calling class
of the current log message.
Renderer for the
FVTable that will set the background color based on
the text contents.An interface that allows clients to receive log messages.
A JPanel that contains a label to show the last message displayed.
Log4j appender that writes messages to the log panel in the main Ghidra window.
Array of longs that grows as needed.
Array of long[] that grows as needed.
An ArrayList for longs.
This class provides a storage mechanism for long-valued information about
the elements of a KeyIndexableSet, e.g.
Interface that defines a method for comparing two long values.
Interface used by number constraints.
Basic implementation for a Signed Long Integer dataType
Provides a definition of a
complex built-in data type consisting of two LongDouble
numbers in the IEEE 754 double precision format.Provides a definition of a Long Double within a program.
Class that implements a hashtable with long keys and double values.
Class for providing editor for long columns.
LongField provides a wrapper for 8-byte signed long data
which is read or written to a Record.Class that implements a hashtable with long keys and int values.
Iterator over a set of Java-type long values.
This class converts arbitrary long keys into compacted int indexes suitable
for use as indexes into an array or table.
Basic implementation for an Signed LongLong Integer dataType
Class that implements a hashtable with long keys and long values.
A string table that contains the full filenames of COFF archive members who's actual
filenames can not fit in the fixed-length name
field.Class that implements a hashtable with long keys and Object values.
Property manager that deals with properties that are of
long type.
Property manager that deals with properties that are of
long type and stored with a database table.
Class for providing range editor for long columns.
Value class for Long Values with an option for display the value as decimal or hex.
Manages installing and updating a
LookAndFeelA utility class to manage LookAndFeel (LaF) settings.
A LRU (Least Recently Used) map that maintains access-order (newest to oldest)
iteration over the elements.
An ordered set-like data structure.
A record that associates the type info with a catch action.
Defines the follow-on behavior of how to handle an exception in the context
of the exceptions' C++ type.
Defines the bounds of a try-catch region.
Defines the specific program regions that may throw an exception within the
context of the LSDA.
Defines the bounds of exception unwinding support, within a function,
and unwind procedures.
The Language Specific Data Area (LSDA) serves as a reference to the runtime for how to
respond to an exception.
Stores addresses of __type_info structures for thrown values.
A cosine vector where we can accumulate the (feature,weight) pairs over time
using the addHash method.
An exception class to handle encountering
invalid Mach-O Headers.
Represents a mach_header structure.
Constants for the flags field of the mach_header
PE machine ID constants defined by standard header file 'ntimage.h'
A
Loader for Mach-O files.Taken from:
http://www.opensource.apple.com/source/xnu/xnu-1456.1.26/libkern/libkern/prelink.h
Builds up a PRELINK Mach-O
Program by parsing the Mach-O headers.Utilities methods for working with Mach-O PRELINK binaries.
Builds up a Mach-O
Program by parsing the Mach-O headers.A representation of a single Mach-O relocation that the
MachoRelocationHandler will use
to perform the relocation.An abstract class used to perform Mach-O relocations.
A class that gets the appropriate Mach-O relocation handler for a specific Mach-O file
A datatype to interpret the Mac OS timestamp
convention, which is based on the number of
seconds measured from January 1, 1904.
Manages installing and updating the Mac Aqua look and feel.
Built-in GTheme that uses the Aqua
LookAndFeel and the standard (light)
application defaults.An action to make a program selection based on the given table's selection.
BufferFile facilitates read/write access to buffer oriented file.ManagedBufferFileAdapter provides a ManagedBufferFile implementation which
wraps a ManagedBufferFileHandle.ManagedBufferFileHandle facilitates access to a ManagedBufferFileData table that keeps track of rows that are occupied.
Interface that all subsection managers of a program must implement.
MangledLocalFileSystem implements the legacy project data storage
scheme which utilizes a simplified name mangling which provides case-sensitive
file-naming with support for spaces.A
Loader for processing Microsoft MAP files.Class that maps one type of column constraint into another.
A constraint editor that supports object type conversions, wrapping the editor for the
converted-to type.
A normal address based HighSymbol mapping with an associated Data object
A normal mapping of a HighSymbol to a particular Address, consuming a set number of bytes
A class that is an Adapter in order to allow for the use of existing
DynamicTableColumns
when the actual row type of the table is not the same as the row type that the
DynamicTableColumn supports.Interface for objects that want to add a component to the listing's left margin.
Interface for notifications when the user double-clicks in the marker margin
Allows clients to specify how
MarkerLocations are navigated, as well as how they
should be paintedMarker location in the tool navigation bars
Service to manage navigation markers displayed around a scrollable window like the Listing.
Defines methods for working with a set of addresses that correspond to markers.
Indicates that the objects in the return value of the tagged method should be recursively
marked up, or if a tagged field, the object in the field should be recursively marked up.
Indicates that the target of the tagged field should be decorated in Ghidra as
receiving a data reference from the location of the field.
State and methods needed for structure mapped objects to add markup, comments, labels, etc
to a program.
The Mask class is used to perform some basic bit tests on an
array of bits.
ByteMatcher where the user search input has been parsed into a sequence of bytes and
masks to be used for searching a byte sequence.A
64-bit value where each bit is 0, 1, or x (undefined)Implements the Mask interface as a byte array.
Match maintains information about a single match between two programs.
Represents a match of a DittedBitSequence at a given offset in a byte sequence.
Interface for a match action to be taken for the Program@Address for a ditted bit seqence pattern
A FunctionComparisonModel comprised of matched pairs of source and target functions.
A filter that will pass text when it matches exactly.
A filter factory that creates
TextFilters that will pass text when it matches
the filter exactly.A text filter that uses a pattern and performs a 'matches' using that pattern.
This class does the work of matching subroutines.
class that contains a collection of matches.
MaximizeSpecificColumnGridLayout is a row oriented grid type of layout.MemBuffer provides an array like interface into memory at a
specific address.
ImageInputStream for reading images that wraps a MemBuffer to get the bytes.
Adapter between
membuffers and inputstreams.An MemoryAccessException indicates that the attempted
memory access is not permitted.
A means of intercepting and/or modifying the emulator's memory access.
This class implements the CharSequence interface using Memory and an AddressSet.
Interface that defines a block in memory.
TODO To change the template for this generated type comment go to
Window - Preferences - Java - Code Style - Code Templates
MemoryBlockDiff determines the types of differences between two memory blocks.Exception thrown for memory block-related problems.
Methods for a listener that is called when changes are made to a
MemoryBlock.
Generates
MemoryBlock Offset fieldsDescribes the source of bytes for a memory block.
Generates a text label on each
CodeUnit that marks the start of a memory block.BlockStartLocation provides information about the location
(within a program) of an object that represents the start of a memory block.MemoryBlockStub can be extended for use by tests.
Convenience methods for creating memory blocks.
MemBufferImpl implements the MemBuffer interface.
Class to iterate over the bytes in memory for an address set.
Multi pattern/mask/action memory searcher
Patterns must be supplied/added, or a pre-initialized searchState supplied
Preload search patterns and actions, then call search method.
A
ByteProvider implementation based on Memory.Exception for overlapping memory blocks.
Memory Constants
MemoryDiff determines where the memory differs between two programs as well as the
types of differences.MemoryLoadable serves as both a marker interface which identifies a memory
loadable portion of a binary file (supports use as a Hashtable key).The database memory map manager.
MemoryMap adapter for version 3.
A class that represents a memory search hit at an address.
Listing highlight provider to highlight memory search results.
Interface for loading the memory search results table.
Table model for memory search results.
Maps
MemoryMatch objects (search result) to an address to pick up address based
table columns.Maps
MemoryMatch objects (search result) to program locations to pick up
program location based table columns.Maps
MemoryMatch objects (search result) to functions to pick up function based
table columns.Merge memory blocks that have changes to the name, permissions or comments.
A Byte Provider implementation based on Memory.
MemoryPage is allows the contents/data of a memory page
to be maintained along with an initializedMask.MemoryBlockDiff determines the types of differences between two memory blocks.Internal panel of the memory search window that manages the controls for the scan feature.
An interface to unify the different methods for searching memory.
Class for searching bytes from a byteSource (memory) using a
ByteMatcher.Class for managing search tool options.
Plugin for searching program memory.
ComponentProvider used to search memory and display search results.
Deprecated.
This is not a generally useful service, may go away at some point
Implementation for a reference, not associated with a program.
Search memory using the provided search text.
A class that represents a memory search hit at an address.
Manages the main menu bar on the main frame
Maps menuPaths to groups
MenuHandler provides a listener interface for menus.Handles the processing of key events while menus or popup menus are open.
Class to manage a hierarchy of menus.
Command to merge a Folder with its Parent folder.
Top level object that manages each step of the merge/resolve conflicts
process.
Plugin that provides a merge component provider.
The MergeProgressPanel displays the name of each merge phase along with an icon indicating
whether the phase is Pending, In Progress or Completed.
Interface for resolving domain object merge conflicts.
MergeUtilities provides generic static methods for use by the
multi-user program merge managers.A simple class to handle logging messages and exceptions.
Represents a Swift MetadataSourceRecord structure
Built-in GTheme that uses the Metal
LookAndFeel and the standard (light)
application defaults.Filter on a single meta data-type.
Abstract base for information about type methods and interface methods
Puts the first child of the given component in the middle of the component, both vertically
and horizontally.
Instances of this class will find sequences of characters that are in the given char set and
of a minimum length.
Form new expression by taking twos complement of a PatternExpression
Solves expressions of the form
-ACommand object for performing Mips disassembly
Provides an implementation of a data type that stands-in for a missing Built-In data type.
Generates Mnemonic Fields.
The
MnemonicFieldLocation class contains specific location
information within the MNEMONIC field of a CodeUnitLocation object.A handler to process
MnemonicFieldLocation clicks.Hash function hashing only the mnemonic of an individual Instruction
Defines a set of actions that can be performed on a selection to initiate a memory search.
PluginTool that is used by the Merge process to resolve conflicts
when a file is being checked into a server repository.
A rule controlling how parameters are assigned addresses
Rules are applied to a parameter in the context of a full function prototype.
A p-code thread which incorporates per-architecture state modifiers
Command that applies the "module" algorithm to a specified Module or
Fragment.
An
ExtensionPoint that users can implement to perform work before the application
is loaded.A class to represent the new-executable module reference table.
Utility methods for module related things.
An InputStream which utilizes a TaskMonitor to indicate input progress and
allows the operation to be cancelled via the TaskMonitor.
An OutputStream which utilizes a TaskMonitor to indicate output progress and
allows the operation to be cancelled via the TaskMonitor.
Motif
LookAndFeelManager.A simple class that represents a mouse button and any modifiers needed to bind an action to a
mouse input event.
Allows Ghidra to give preference to its mouse event processing over the default Java mouse event
processing.
A debugging shape painter that allows the user to see where a mouse clicked happened.
Paints a line showing the start and end points of a drag operation.
Paints a rectangle showing the start and end points of a drag.
Invoked when the user scrolls the mouse wheel either up or down.
Listener that is notified when a move block completed or some state
has changed.
Command that runs in the background to move a memory block, as the move may
be a time consuming operation.
An abstract class containing static utility methods for creating structure data types.
Class with static methods to report errors as either a short message or a
more detailed message (e.g., stacktrace).
MultEntSubModel (M-model) defines subroutines which do not share code with
any other subroutine and may have one or more entry points.Form new expression by multiplying two PatternExpressions
Solves expressions of the form
A * BBuilder for
MultiActionDockingActionDialog to show multiple actions that are mapped to the same keystroke;
allows the user to select which action to do.
A class that supports multiple sub-actions, as well as a primary action.
MultiAddressIterator is a class for iterating through multiple
address iterators simultaneously.MultiAddressRangeIterator is a class for iterating through multiple
address range iterators simultaneously.MultiCodeUnitIterator is a class for iterating through multiple
code unit iterators simultaneously.MultiComparableArrayIterator takes multiple arrays of comparable
objects and iterates through them simultaneously.Icon class for for displaying overlapping icons.
A builder to allow for easier creation of an icon that is composed of a base icon, with
other icons overlaid.
An iterator that is comprised of one or more
PeekableIterators.Class to render a String that has new line characters as a multiline
label.
Class for creating multiple coordinated ListingModels for multiple programs.
Consume a register per primitive member of an aggregate data-type
The data-type is split up into its underlying primitive elements, and each one
is assigned a register from the specific resource list.
Represents a Swift MultiPayloadEnumDescriptor structure
Use an instance of this class as the cause when you need to record several causes of an
exception.
Action that manages multiple
DockingActions mapped to a given key bindingHandles layouts with muliple rows.
Consume multiple registers to pass a data-type
Available registers are consumed until the data-type is covered, and an appropriate
join space address is assigned.
Consume multiple registers from different storage classes to pass a data-type
This action is for calling conventions that can use both floating-point and general purpose registers
when assigning storage for a single composite data-type, such as the X86-64 System V ABI
Builder for
MultiStateDockingActionA button that has a drop-down list of choosable
ButtonStates.An action that can be in one of multiple states.
The settings definition for the numeric display format
An interface for a generic random-access byte provider, plus mutation methods.
A class that can wrap a
GDirectedGraph and allows for vertex and edge additions
without changing the underlying graph.The MutableMemBuffer interface facilitates repositioning of a MemBuffer object.
A class to manage loading old-style DOS MZ executables
A
Loader for processing old-style DOS MZ executablesNamedDaemonThreadFactory is a thread factory which forms daemon threads
with a specified name prefix for the Java concurrent Executors pools.
Helper for allocating unique string names.
The Namespace interface
Converts Namespace Column objects to Strings so that column gets String type column
filters
Class to manage namespaces.
Represents a hierarchical path of containers that hold names of objects.
Symbol class for namespaces.
A class to hold utility methods for working with namespaces.
An option class that allows the user to edit a related group of options pertaining to
namespace display.
A ValueSymbol whose printing aspect is determined by looking
up the context value of the symbol in a table of strings
Interface to transform (shorten, simplify) names of data-types, functions, and name spaces
for display.
Utility class with static methods for validating project file names.
Interface for ComponentProviders to implement if they support basic navigation and selection
capabilities.
Marker interface to signal a context specifically for actions that work on a range of
program locations.
An interface that signals the client supports navigation.
The NavigationHistoryService maintains a stack of locations that the user has visited via a
navigation plugin.
An exception to indicate that the solution of an expression is not yet known
A
Loader for processing Microsoft New Executable (NE) files.A class to manage loading New Executables (NE).
Command for analyzing the Stack; the command is run in the background.
Table loader that performs a search and displays the results in the table.
The integer offset of the address following the current instruction
"Solves" expressions of
inst_next2Symbol with semantic value equal to offset of address immediately
after the next instruction (inst_next2)
Action for transferring focus to the next or previous visible window in the application.
Nimbus
LookAndFeelManager.Built-in GTheme that uses the Nimbus
LookAndFeel and the standard (light)
application defaults.Represents an nlist and nlist_64 structure.
Build a structure from a "noisy" source of field information.
A class to represent the new-executable non-resident name table.
A class for clients that wish to create a button that has multiple states, controlled by a
drop-down menu.
AddressSetView implementation that handles image base changes.
Exception thrown if a requested index does not exist.
NotConnectedException indicates that the server connection
is down.An ELF note that specifies the minimum kernel ABI required by this binary
An ELF note that specifies the build-id (sha1/md5/etc hash or manually specified bytes that
can be hex-ified) of the containing program.
An ELF note that contains a list of enumerated "properties".
Contains the information of an individual note property.
An ELF note that specifies the golang build-id.
exception thrown whenever some container is expected to be empty and it isn't.
Form new expression by complementing a PatternExpression
Solves expressions of the form
~AException thrown when an object is not found.
Column Constraint where acceptable column values are not within some range defined by a min value and
a max value.
Column Constraint where acceptable column values are outside some range defined by a min value and
a max value.
Exception thrown if user is not the owner of a file or
data object being accessed.
Negates the given query such that this query is the logical "NOT" of the given query.
NoTransactionException occurs when a database modification is
attempted when no transaction exists.NotYetImplementedException is used during development of a class.
Exception thrown if there is no value at a
requested index.
A class to represent the
IMAGE_NT_HEADERS32 and
IMAGE_NT_HEADERS64 structs as defined in
winnt.h.A stub implementation of the highlight controller that allows clients to avoid null checks
A
OutputStream that discards all bytes written to it.A table filter that represents the state of having no filter.
An implementation of
Writer to use when you wish to not use any writing, but to also
avoid null checks.Provides number related column constraints.
An icon that paints the given number
DialogComponentProvider that provides information to create a modal dialog
to prompt for a number (int) to be input by the user.
An input dialog that accepts number input as discrete values or a range of values using
':' as the range separator.
A
ByteProvider that reads from an on-disk file, but obfuscates / de-obfuscates the
contents of the file when reading / writing.An
InputStream wrapper that de-obfuscates the bytes being read from the underlying
stream.An
OutputStream wrapper that obfuscates the bytes being written to the underlying
stream.Array of objects that grows as needed.
This class provides a storage mechanism for Object-valued information about
the elements of a KeyIndexableSet, e.g.
ObjectClass provides a fixed-size long-key-based object cache.Class that implements a hashtable with Object keys and int values.
This class converts arbitrary Objects into compacted int indexes suitable
for use as indexes into an array or table.
Class that implements a hashtable with Object keys and long values.
Property manager that deals with properties that are of
Object type.
Property manager that deals with properties that are of
a
Saveable Object type and store within a database table.Associates objects with long index ranges.
An interface for clients to know when an object is selected and when the selection is cleared
Methods for saving and restoring Strings and Java primitives or arrays of
Strings and primitives.
Convenience adapter implementation for saving and restoring Strings and
Java primitives or arrays of Strings and primitives for a row of a data table.
ObjectStorageAdapterDB provides an ObjectStorage
implementation for use by Saveable objects.Implementation for ObjectStorage to save and restore Strings and
Java primitives using an ObjectOutputStream and ObjectInputStream,
respectively.
Handles general storage and retrieval of object values indexed by long keys.
Associates an integer value with a numeric range.
This table field displays the number of references to the location that was found
Provides specific information about a program location within an offset field
The type of offset field
Setting definition for a pointer offset bit-mask to be applied prior to any
bit-shift (if specified) during the computation of an actual address offset.
OffsetReference is a memory reference whose "to" address is
computed from a base address plus an offset.A dialog with an OK button.
This class represents a DOS Header
This class only exists to support upgrading Ghidra Version 2.1 and earlier.
OldGenericNamespaceAddress provides a means of instantiating namespace
oriented addresses which were previously used for External, Stack and Register addresses.ProgramContextDB defines a processor context over an address
space using database range maps for storage.OMF-166 record types
An OMF value that is either 2 or 4 bytes
A
Loader for OMF-51 filesA class for reading/creating OMF-51 records
OMF-51 record types
A class to represent the Object Module Format (OMF) alignment symbol.
Object representing data loaded directly into the final image.
An
Exception used to indicate there was a problem parsing an OMF recordA class to represent the Object Module Format (OMF) File Index data structure.
A class to represent the Object Module Format (OMF) Global data structure.
An OMF index that is either 1 or 2 bytes
Contain the definition of one part of a datablock with possible recursion
A class to represent the Object Module Format (OMF) Library data structure.
A
Loader for Relocatable Object Module (OMF) files
typedef struct OMFModule {
unsigned short ovlNumber; // overlay number
unsigned short iLib; // library that the module was linked from
unsigned short cSeg; // count of number of segments in module
char Style[2]; // debugging style "CV"
OMFSegDesc SegInfo[1]; // describes segments in module
char Name[]; // length prefixed module name padded to long word boundary
} OMFModule;
A generic OMF record
A class for reading/creating Relocatable OMF records
Relocatable OMF record types
A class to represent the Object Module Format (OMF) Segment Descriptor data structure.
typedef struct OMFSegMap {
unsigned short cSeg; // total number of segment descriptors
unsigned short cSegLog; // number of logical segment descriptors
OMFSegMapDesc rgDesc[0]; // array of segment descriptors
};
A class to represent the Object Module Format (OMF) Segment Mapping Descriptor data structure.
A class to represent the Object Module Format (OMF) Source Module data structure.
A class to represent the Object Module Format (OMF) Source Module File data structure.
A class to represent the Object Module Format (OMF) Source Module Line data structure.
An variable length OMF string
An unknown OMF record
A known but currently unsupported OMF record
Utility class for OMF-based file formats
Operation interface for clients to visit nodes in a ByteTrie.
Abstract class used to represent the generic components of a Mach-O opcode table
FactoryField class for displaying the open/close field.
Generates Open/Close Fields.
Manages the open/close state of structures and arrays at specific addresses.
OpenMode provides an instantiation mode for DomainObject
implementations and internal storage adapters.Event for telling a tool to open a program
Task for opening one or more programs.
Dialog to open a file that is versioned and allow a version to be
opened.
Represents a way to open a
DomainFile in a ProgramManagerGenerates Operand Fields.
The
OperandFieldLocation class contains specific location information within the
OPERAND field of a CodeUnitLocation object.A handler to process
OperandFieldLocation mouse clicks.OperandRepresentation provides a list for operand sub-elements.Variable representing an operand to a specific Constructor
Helper class for testing operand related flags in an integer.
An Expression representing the value of a Constructor operand
A matcher for a constructor's operand value, constrained by its defining expression
Solves expressions of an operand value
A class to represent an error when processing an opinion.
Container class to hold a name, value, and class of the value.
typedef struct _IMAGE_OPTIONAL_HEADER {
WORD Magic; // MANDATORY
BYTE MajorLinkerVersion;
BYTE MinorLinkerVersion;
DWORD SizeOfCode;
DWORD SizeOfInitializedData;
DWORD SizeOfUninitializedData;
DWORD AddressOfEntryPoint; // MANDATORY
DWORD BaseOfCode;
DWORD BaseOfData;
DWORD ImageBase; // MANDATORY
DWORD SectionAlignment; // MANDATORY
DWORD FileAlignment; // MANDATORY
WORD MajorOperatingSystemVersion; // MANDATORY
WORD MinorOperatingSystemVersion;
WORD MajorImageVersion;
WORD MinorImageVersion;
WORD MajorSubsystemVersion;
WORD MinorSubsystemVersion;
DWORD Win32VersionValue;
DWORD SizeOfImage; // MANDATORY
DWORD SizeOfHeaders; // MANDATORY
DWORD CheckSum;
WORD Subsystem; // MANDATORY
WORD DllCharacteristics;
DWORD SizeOfStackReserve;
DWORD SizeOfStackCommit;
DWORD SizeOfHeapReserve;
DWORD SizeOfHeapCommit;
DWORD LoaderFlags;
DWORD NumberOfRvaAndSizes; // USED
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
};
A class to represent the IMAGE_ROM_OPTIONAL_HEADER
data structure.
A utility class to easily show dialogs that require input from the user.
Class for creating OptionDialogs using the builder pattern.
Exception thrown if there was a problem accessing an Option, or if
an informational message is to be conveyed.
Notification that an Option changed.
Interface for notifying listeners when options change.
Dialog for editing options within a tool.
Dialog for editing the import options for a selected importer format.
Interface to define methods for an editor that supplies its own
component to be displayed in the OptionsDialog.
Listener that is notified when the "apply" button is hit.
Panel that shows each property in an Options category or a Group in an
Options category.
Editor Panel for displaying and editing options associated with importing or exporting.
Class for displaying and manipulating field colors and fonts.
Created by PluginTool to manage the set of Options for each category.
Provides a service interface that allows the user to get Options and to check for the
existence of options.
Intended to be thrown from
OptionsChangeListener.optionsChanged(ToolOptions, String, Object, Object) to signal that
the setting of an option property is invalid and should not happen.Utility class for providing convenience methods for working with
Option's.Callback interface for validating a list of options with values.
Placeholder for what will resolve to a PcodeOp
for a specific InstructionContext
Class for walking pcode templates OpTpl in the correct order
Supports walking the tree of an entire SleighInstructionPrototype or just a single ConstructTpl
Form new expression by ORing together two PatternExpressions
Solves expressions of the form
A | BAn
Exporter that can export the originally imported file.A pattern that can be matched by matching any of a list of subpatterns
Combines two queries such that this query is the logical "OR" of the two queries.
Signals that an attempt to find a Ghidra "OS-file" (native binary) has failed.
Marker row object that signals to the table API that the references contained therein all
share the
from address, with each row showing the to address.OutputBlockStream provides a BufferFile output block stream.Complains about function parameters that are marked as 'output' and don't have storage
locations.
Paints an oval of the given size, based upon the Component passed to
OvalBackgroundColorIcon.paintIcon(Component, Graphics, int, int).OverlapCodeSubModel (O-model) defines subroutines with a
unique entry point, which may share code with other subroutines.A class that will take in a group of help directories and create a tree of
help Table of Contents (TOC) items.
OverlayRegionSupplier provides a callback mechanism which allows a
ProgramOverlayAddressSpace to identify defined memory regions within its
space so that it may properly implement the OverlayAddressSpace.contains(long)
method.Interface implemented by classes that provide overview components to the right side of the
listing.
A class for dynamically collecting a stream of bytes and then later dumping those bytes to a stream
It allows the bytes to be edited in the middle of collection
PackedDatabase provides a packed form of Database
which compresses a single version into a file.Packed Data Contents
See Apple's -- IOPEFInternals.h
DBHandle provides access to a PackedDatabase.Alter address space decoding for a specific overlay space.
A byte-based encoder designed to marshal to the decompiler efficiently
See
PackedDecode for details of the encoding formatAlter address space encoding for a specific overlay space.
PackingType specifies the pack setting which applies to a composite data type.The Settings definition for setting the padded/unpadded setting
Handles the actions required when the user presses the page down key.
Handles the actions required when the user presses the page down key.
Handles the actions required when the user presses the page up key.
Handles the actions required when the user presses the page up key.
A base class for shapes that can be painted on the graph.
Miscellaneous information needed by fields to paint.
The analog of
PairedPcodeExecutorStatePiece for simulated file contentsAn arithmetic composed from two.
A paired executor state
A paired executor state piece
LayoutManger for arranging components into exactly two columns.
Interface to define methods that control what panel is displayed in a
wizard.
Generates Parallel execution marks '||' for those language which have a
ParallelFieldLanguageHelper class and have specified the corresponding
language property in the pspec.
ParallelInstructionLanguageHelper provides the ability via a language
specified property to identify certain parallel instruction attributes.Interface for function parameters
ParameterDefinition specifies a parameter which can be
used to specify a function definition.Generic implementation of Parameter.
Basic elements of a parameter: address, data-type, properties
A group of ParamEntry that form a complete set for passing parameters (in one direction)
A list of resources describing possible storage locations for a function's return value,
and a strategy for selecting a storage location based on data-types in a function signature.
Standard analysis for parameter lists
A list of resources describing possible storage locations for a function's return value,
and a strategy for selecting a storage location based on data-types in a function signature.
ParamMeasure
Ensures that function parameter names are unique and valid
Steal storage location from parameters that are defined in a function's local variable
area, because the storage location isn't the parameter location during call, but its location
after being spilled.
This exception is thrown when parse errors are encountered.
This exception is thrown when parse errors are encountered.
ParserContext represents a language provider specific parser context
which may be cached.Class for walking the Sleigh Parser tree.
A data-type representing an unspecified piece of a parent Union data-type.
PartitionCodeSubModel (Model-P) defines subroutines which do not share code with
other subroutines and may have one or more entry points.Wrapper for a password, held in a char[] array.
PasswordClientAuthenticator provides a fixed username/password
authentication response when connecting to any Ghidra Server or accessing
a protected PKI keystore.PasswordDialog is a modal dialog which
prompts a user for a password.Instances of this interface provide passwords to decrypt files.
Task to paste files at given destination folder.
This is an encoder that produces encodings that can be retroactively patched.
A class to represent a PATH item.
Deprecated.
A simple boolean supplier that signals if path highlighting work should not take place
An enum that lists possible states for highlighting paths between vertices in a graph.
A class that wraps a Path and allows map lookup for paths from different file systems
Component that has a table to show pathnames; the panel includes buttons to control
the order of the paths, and to add and remove paths.
Component that has a table to show pathnames; the panel includes buttons to control the order of
the paths, and to add and remove paths.
A pattern which either matches or doesnt match a particular
InstructionContext.
Pattern is an association of a DittedBitSequence to match,
a set of post rules after a match is found that must be satisfied,
and a set of actions to be taken if the pattern matches.
A mask/value pair viewed as two bitstreams
An expression which results in a pattern for a specific InstructionContext
Interface for factories that create Match Pattern classes
Symbols with semantic value, but with no pattern aspect,
i.e.
A set of "pre" DittedBitSequences and a set of "post" Patterns are paired to form a larger pattern.
This is a PatternExpression which can be interpreted as an
integer value.
An interface that defines arithmetic p-code operations on values of type
T.Reasons for requiring a concrete value
Blocks of PcodeOps
A basic block constructed from PcodeOps
Class for marshaling DataType objects to and from the Decompiler.
Class for converting ConstructTpl into a pcode ops given
a particular InstructionContext
A p-code machine which executes on concrete bytes and incorporates per-architecture state
modifiers
Exception generated from problems with Pcode.
The base exception for all p-code execution errors
An executor of p-code programs
An interface that provides storage for values of type
TAn interface that provides storage for values of type
T, addressed by offsets of type
AReasons for reading state
A p-code program that evaluates a Sleigh expression
A clever means of capturing the result of the expression.
Interface for classes that build PcodeOps and Varnodes
Pcode field factory.
The executor's internal counter
A machine which execute p-code on state of an abstract type
The kind of access breakpoint
Specifies whether or not to interrupt on p-code breakpoints
Pcode Op describes a generic machine operation.
Some extra things attached to PcodeOp for ease of walking the syntax tree
Container for PcodeOpAST's
An interface for visiting Pcode operations in a SLEIGH language
This class is intended to parse p-code snippets, typically from compiler specification files or
extensions.
This class wraps on existing SleighLanguage with the SleighBase interface expected by
PcodeCompile.
A p-code program to be executed by a
PcodeExecutorAn extension for preparing execution state for sleigh emulation
Varnodes and PcodeOps in a coherent graph structure
PCodeTestAbstractControlBlock data is models the general capabilities
of the TestInfo data structure which is used for different puposes as handled
by extensions of this class.PCodeTestControlBlock data is read from each binary test file and
identified by the MAIN_CONTROL_BLOCK_MAGIC 64-bit character field value at the start of the
data structure.PCodeTestGroup identifies a test group function and its corresponding
PCodeTestGroupControlBlock.PCodeTestGroupControlBlock corresponds to each test group contained within
a binary test file and identified by the GROUP_CONTROL_BLOCK_MAGIC 64-bit character
field value at the start of the data structure.An emulated thread of execution
A "library" of p-code userops available to a p-code executor
The class of the empty userop library.
The definition of a p-code userop.
An Address datatype whose value is computed in relation to its location in memory.
Bag of information about a Pdb symbol file, usually extracted from information present in a PE
binary.
Older style pdb information, using a simple 32bit hash to link the pdb to its binary.
Newer style pdb information, using a GUID to link the pdb to its binary.
Program Information options related to PDB data.
A datatype for creating portable executable data structures.
An iterator that allows you to peek at the next item on the iterator.
An exception class to handle encountering
invalid PEF Headers.
Microsoft Portable Executable (PE) loader.
Common interface for standardizing the markup of a PE structure.
The PhaseProgressPanel provides a title, progress bar and message for the current phase that is
in progress
Marker interface for lines that are generic place holders for diffing
Indicates that the tagged class or field should have an plate comment placed
before each instance of the object or field, using the return value of the field's
getter method, or if a class, the object's "toString()" method.
Class for showing plate comments
The
PlateFieldLocation class contains specific location information
within the Plate field of a CodeUnitLocation object.Identifies the current platform (operating system and architecture) and
identifies the appropriate module OS directory which contains native binaries
Plugins are a basic building block in Ghidra, used to bundle features or capabilities
into a unit that can be enabled or disabled by the user in their Tool.
A listing of commonly used
PluginDescription category names.Exception thrown when a an error occurs during the construction
of a plugin.
Class to hold meta information about a plugin, derived from meta-data attached to
each
Plugin using a @PluginInfo annotation.Event generated by a plugin.
Listener that is notified when an event is generated.
Exception thrown if plugin was not found.
Information about a Ghidra
Plugin.An interface that facilitates the adding and removing of plugins
Dialog that displays plugins in a tabular format, allowing users to install or uninstall them.
Provides
PluginPackages and plugin descriptions and to clientsThis class maintains a collection of all plugin classes that are acceptable for a given tool
type.
Base class that is a container to manage plugins and their actions, and to coordinate the
firing of plugin events and tool events.
Utility class to provide access to non-public methods on PluginTool.
A plugin-level about handler that serves as the callback from the Dock's 'About' popup action.
A plugin-level quit handler that serves as the callback from the Dock's 'Quit' popup action.
Utility class for plugin-related methods.
Expression formed by adding together two PatternExpressions
Solves expressions of the form
A + BInterface for pointers
Pointer16 is really a factory for generating 2-byte pointers.
Pointer24 is really a factory for generating 3-byte pointers.
Pointer32 is really a factory for generating 4-byte pointers.
Pointer40 is really a factory for generating 5-byte pointers.
Pointer48 is really a factory for generating 6-byte pointers.
Pointer56 is really a factory for generating 7-byte pointers.
Pointer64 is really a factory for generating 8-byte pointers.
Pointer8 is really a factory for generating 1-byte pointers.
Basic implementation for a pointer dataType
PointerType specified the pointer-type associated with a pointer-typedef.PointerTypedef provides a Pointer-Typedef template datatype
which may be used as an alternative to PointerTypedefBuilder for
select use cases.The settings definition for the numeric display format
Provides notification when the popup action menu is displayed.
Pops up up a GUI dialog prompting the user to enter a password for the specified file.
A class that holds information used to show a popup menu
A class to control popups for graph clients, bypassing Java's default tool tip mechanism
An interface that provides graph and component information to the
PopupRegulatorA generic window intended to be used as a temporary window to show information.
This class places a rectangle on the boundary of an inner bounds area, such that it is not
placed outside of an outer boundary.
This class builds a PopWindowPlacer that can have subsequent PopWindowPlacers.
A class to manage loading Portable Executables (PE).
Indicates how sections of this PE are laid out in the underlying ByteProvider.
To change this generated comment edit the template variable "typecomment":
Window>Preferences>Java>Templates.
To enable and disable the creation of type comments go to
Window>Preferences>Java>Code Generation.
Filter that selects for a particular parameter position.
Interface for POSIX functions in libc
Generates post comment Fields.
The
EolCommentFieldLocation class contains specific location information
within the EOL comment field of a CodeUnitLocation object.Inteface for post match rules that are checked after a match is idenfied
Command object for performing PPC disassembly when VLE instructions are supported.
Represents a prebind_cksum_command structure
Represents a prebound_dylib_command structure
Generates pre-comment fields.
Uses Properties to manage user preferences as name/value pairs.
An implementation of SaveState that exists primarily to signal its intended usage.
Token literal values and constants.
Token Manager.
A
TaskMonitor wrapper that restores all changed values of the wrapped TaskMonitor when
the wrapper is closed.This class is used to convert a C/C++ language
token group into readable C/C++ code.
A custom renderer used to display what is at the
ProgramLocation similarly to
how it is displayed in the Listing window..A generic data type used by table models in order to signal that the data should render
a preview for a given
ProgramLocation, where the preview is what is displayed in
the Listing.This table column displays a preview of the
ProgramLocation with a row in the table.Class that provides a static nextPrime method that gives out prime numbers
that are useful in a buffer doubling strategy with all buffer sizes being prime.
A class to convert from debug data types into Ghidra data types.
Maintains a list of objects in priority order where priority is just
an integer value.
Executes a single job at a time in priority order.
PrivateDatabase corresponds to a non-versioned database.A class that signals this saveable is not meant to broadcast its changes.
A class that allows clients to asynchronously consume the output of a
Processs
input and error streams.Defines the interface for an object containing the state
of all processor registers relative to a specific address.
An implementation of processor context which contains the state of all
processor registers.
Defines the interface for an object containing the state
of all processor registers relative to a specific address.
ProcessorEmulatorTestAdapter provides an abstract JUnit test implementation
for processor-specific test cases.Miscellanious address space defines for language providers.
This interface represents the main entry point into an object which
stores all information relating to a single program.
Plugin event class for notification of programs being created, opened, or
closed.
An annotated string handler that allows handles annotations that begin with
ProgramAnnotatedStringHandler.SUPPORTED_ANNOTATIONS.ProgramArchitecture which identifies program architecture details required to
utilize language/compiler-specific memory and variable storage specifications.Marker interface for plugins that only get constructed programmatically for specific purposes.
Extends DataTypeManager to include methods specific to a data type manager for
a program.
DB-based Program datatype manager implementation
which has the concept of an address-based listing and corresponding
datatype instance settings.
NOTE: ALL ProgramBasedDynamicTableColumnExtensionPoint CLASSES MUST END IN "TableColumn".
AddressableByteSource implementation for a Ghidra ProgramEvent data for a DomainObjectChangeEvent generated by a Program.
Interface for a Program Change set.
Plugin event class for notification of programs being created, opened, or closed.
Class for providing Program related column type constraints.
A Program-specific version of the
CompilerSpec.Exception for incompatible programs when comparing programs for differences
or when merging program differences.
ProgramContentHandler converts between Program instantiations
and FolderItem storage.Interface to define a processor register context over the address space.
Implementation for a processor context over the address space
ProgramContextMergeManager merges register value changes
for multi-user program versions.Class for managing data types in a program
Database implementation for Program.
ProgramDiff is a class for comparing two programs and
determining where there are differences between them.ProgramDiffDetails is used to determine the detailed differences between
two programs at a particular address.
The
ProgramDiffFilter is used when determining or working with
differences between two programs.Generic interface to handle drag and drop.
Event types for
Program changes.Wrapper for Ghidra code to find images (and maybe other artifacts later) in a program
NOTE: This is intended for end-user use and has no direct references within Ghidra.
Value class for
Program files.A
ProgramFragment is a set of CodeUnits that have been
bundled together with some additional information such as a name, comment,
alias, etc.Defines a common set of vertex and edge types
GraphType for program code and data flow
graphs.Plugin event generated when the highlight in a program changes.
This class stores values pulled from the
PROGRAM, INFO_SOURCE, and LANGUAGE tag inside a ghidra program XML file.
ProgramLocation provides information about a location in a program in the most
generic way.Converts ProgramLocation Column objects to Addresses so that column gets Address type column
filters
A comparator for the common fields of
ProgramLocationListener that is notified when the program location changes.
A simple object that contains a ProgramLocation and its associated Program
This plugin event class provides program location information.
Table model that shows a location, label, and a preview column to
show a preview of the code unit.
An table column that knows how to generate ProgramLocation objects for a give row type.
A convenience class that allows subclasses to signal that they implement
ProgramLocationTableColumn and that they are ExtensionPoints.NOTE: ALL TableRowMapper CLASSES MUST END IN "TableRowMapper".
Class for converting a program location from one program to another
Service for managing programs.
ProgramMemoryComparator is a class for comparing two programs and
determining the address differences between them.ProgramMemoryUtil contains some static methods for
checking Memory block data.ProgramMerge is a class for merging the differences between two
programs.The
ProgramMergeFilter is used to specify which portions of a
program should be merged into another program.ProgramMergeManager is a class for merging the differences between two
programs as specified by a ProgramMergeFilter and the address
ranges to be merged.Plugin that provides a merge component provider.
A
ProgramModule is a group of ProgramFragments
and/or other ProgramModules together with some related
information such as a name, comment, and alias.Top level object that manages each step of the merge/resolve conflicts
process.
Plugin event class for notification of programs being created, opened, or closed.
Helper class that contains the logic for opening program for all the various program locations
and program states.
Base class to handle common program events: Program Open/Close, Program Activated,
Program Location, Program Selection, and Program Highlight.
Plugin event class for notification that plugin first pass processing of a newly activated
program is complete.
Implementation for the program processor context interface
An enum specifying the selectable regions within a
Program that users can select for
searching memory.Class to define a selection for a program.
Listener that is notified when the program selection changes
Plugin event generated when the selection in a program changes.
An interface for translating table rows and columns into program locations and selections.
Task for operating on programs.
Interface for a Program Tree Change set.
Manages changes and conflicts between the latest versioned Program and the
Program that is being checked into version control.
Service provided by the program tree plugin to get the current view
(address set shown in the Code Browser),
and the name of the tree currently being viewed.
General utility class that provides convenience methods
to deal with Program objects.
Event for telling a tool to open a program.
The manager responsible for reading and writing a program in XML.
Interface to define methods to manage data and tools for users working on a
particular effort.
Panel that shows the users for a given repository and the users associated with the current
shared project.
Extends DataTypeManager to provide methods specific to project data type archives.
The ProjectData interface provides access to all the data files and folders
in a project.
A context that understands files that live in a
Project.Interface for providing the ProjectData
Panel that contains a DataTree for showing project data.
Class for managing data types in a project archive
NOTE: default data organization is used.
A not-thread-safe
DomainFile iterator that recursively walks a
project's data and returns each DomainFile that is
found.A not-thread-safe
DomainFolder iterator that recursively walks a
project's data and returns each DomainFolder that is
found.Value class for project files (
DomainFile).Value class for project folders (
DomainFile).An in-memory index of FSRL-to-domainfile in the current project.
Dialog to show project information.
Listener that is notified when a project is opened, closed.
Lightweight descriptor of a local Project storage location.
Interface for methods to create, open, and delete projects; maintains a
list of known project views that the user opened.
Plugin event for notifying when a project is opened or closed.
Ghidra framework and program test utilities
Common methods appropriate for both the
FrontEndProjectTreeContext and the
DialogProjectTreeContext.ProjectViewListener provides a listener interface for tracking project views added
and removed from the associated project.Default
BackgroundColorModel for the ListingPanel where the color returned
for an index is based on that corresponding address having a color set in the
program's database.A basic editor for booleans.
Class that represents a file of property names and values.
Loads all the system theme.property files that contain all the default color, font, and
icon values.
Manages options changes and conflicts between the latest versioned
Program and the Program that is being checked into version control.
PropertyManagerPlugin
PropertyManagerDialog
Interface to define a map containing properties over a set of addresses.
Abstract class which defines a map containing properties over a set of addresses.
Interface for managing a set of PropertyManagers.
An implementation of a PropertyComponent that is represented as a
combo box.
Iterator over Property Set Index ranges that have the same value
An implementation of PropertyComponent that is represented as a text field.
Address Space for (intel) 16-bit protected mode programs.
A wrapper for an icon that suppresses errors.
A function calling convention model.
A PrototypeModel cloned from another, but marked as an error placeholder
This model serves as a placeholder for multiple model
Currently all the models being selected between must share the same output model
Raw components of a function prototype (obtained from parsing source code)
Implementing objects of this interface hold an object from a program (e.g., CodeUnit, Function,
etc.) in such a way as to be robust against changes to the program.
"Fake" data generated by the PseudoDisassembler.
PseudoDisassembler.java
Useful for disassembling and getting an Instruction or creating Data
at a location in memory when you don't want the program to be changed.
Defines methods for flow as if the code were actually being disassembled.
Pseudo (i.e., fake) instruction that is generated by the Disassembler.
A pseudo-terminal
The child (UNIX "slave") end of a pseudo-terminal
Mode flag for local echo
A terminal mode flag
One end of a pseudo-terminal
A mechanism for opening pseudo-terminals
The parent (UNIX "master") end of a pseudo-terminal
A session led by the child pty
Interface that defines the callback to work on the items given to the
ConcurrentQ.add(I) methods.Callback for when items have completed processing.
Interface for listeners who want progress and transient message information from QWorkers while
processing items.
Class for holding the result of processing an Item in a ConcurrentQ.
Interface that defines the Runnable to work on the items given to the
ConcurrentQ.add(I) methods.Enum specifying the quadrant of an overlay, either upper left, upper right, lower left, lower right.
A filter on some aspect of a specific function prototype.
Query interface used to test a record for some condition.
Iterator that only returns records from another iterator that match the given query.
A do-nothing, stubbed version of the
Queue interface.Provides a definition of a Quad Word within a program.
Deprecated, for removal: This API element is subject to removal in a future version.
See
FileByteProvider as replacement ByteProvider.An implementation of ByteProvider where the underlying
bytes are supplied by a random access file.
A class for holding a minimum and maximum signed int values that define a range.
Abstract base class for range constraints.
Stores ranges of int values throughout "long" space.
A
ByteProvider that is a concatenation of sub-ranges of another ByteProvider, also
allowing for non-initialized (sparse) regions.A method outline for setting an entry in a range map where coalescing is desired
DataTypeComponents from dataTypes that can not be modified.
Exception thrown if a method attemps to change an object that is marked as read-only.
General purpose modal dialog to display text in a text area.
Rebase opcodes
A Mach-O rebase table
A piece of rebase information from a
RebaseTableNOTE: ALL Recognizer CLASSES MUST END IN "Recognizer".
RecordIterator provides the ability to iterate over
data records within a table.Table record leaf nodes within the BTree structure.This singleton class seeks solutions to
PatternExpressionsFinds all paths between two vertices for a given graph.
A RedBlack Tree implementation of the ShortKeySet interface.
A RedBlack Tree implementation of a long key set.
A RedBlack Tree implementation with K type keys and place to store V type values.
A RedBlack Tree implementation with K type keys and place to store V type values.
A class that re-disassembles where necessary
Calculates the longest common subsequence (LCS) between two sequences of Matchable
objects,
x and y.An implementation of the
ReducingLcs that takes as its input a list of <T>items, where
the list is the 'sequence' being checked for the Longest Common Subsequence.A means of detecting and handling reentrant conditions.
A
ByteProvider along with a FileSystemRef to keep the filesystem pinned
in memory.A
GFile along with a FileSystemRef to keep the filesystem pinned
in memory.An
InputStream wrapper that keeps a FileSystemRef pinned.Base class to hold information about a referring address.
This table field displays the number of references to the location that was found
Reference manager implementation for the database.
A plugin to show tool tip text for hovering over references in the decompiler.
An object that is one end of a
Reference.This table field displays the FromAddress for the reference or possible reference address pair
associated with a row in the table.
This table field displays the bytes of the code unit at the FromAddress
for the reference or possible reference address pair
associated with a row in the table.
This table field displays the name of the function containing the from address for the reference.
This table field displays the primary symbol at the FromAddress
for the reference or possible reference address pair
associated with a row in the table.
Iterator that gives out MemReference objects.
Interface to define methods that are called when references are
added or removed.
Interface for managing references.
Table model for showing the 'from' side of passed-in references.
This table field displays the ToAddress for the reference or possible reference address pair
associated with a row in the table.
This table field displays the reference type for the reference
associated with a row in the table.
LazyImageIcon that creates a reflected version of an icon.The
RefRepeatCommentFieldLocation class contains specific location information
within the Referenced Repeatable comments of an EOL comment field of a CodeUnitLocation object.Table loader that reloads the table with existing results after refreshing the byte values in
those results.
Factory class to create RefType objects.
ByteMatcher where the user search input has been parsed as a regular expression.Search memory using the provided regular expression.
RegionDescriptor holds information about a call frame.
Class to represent a processor register.
Interface for a Register Change set.
Field to show register values at the function entry point.
ProgramLocation for the Register Field.
ProgramLocation for the Register Field.
The RegisterTree class builds and represents relationships between registers.
Class for representing register values that keep track of which bits are actually set.
This is a generalized class for storing register values over ranges.
Simple warning dialog for letting the user know when the input file has been updated.
The high-order 7 bits for the currently defined relocation opcode values.
A class to store the information needed for a single
program relocation.
Relocation status.
Relocation Adapter (v6) introduced a stored status and length value.
RelocationException thrown when a supported relocation encounters an
unexpected error during processing.NOTE: ALL RelocationHandler CLASSES MUST END IN "RelocationHandler".
Represents a relocation_info and scattered_relocation_info structure.
An implementation of the relocation table interface.
RelocationResult provides the status and byte-length of a processed relocation during
the Program load process.This class maintains the running state while
applying relocations.
An interface for storing the relocations defined in a program.
See Apple's -- PEFBinaryFormat.h
See Apple's -- PEFBinaryFormat.h
See Apple's -- PEFBinaryFormat.h
See Apple's -- PEFBinaryFormat.h
See Apple's -- PEFBinaryFormat.h
See Apple's -- PEFBinaryFormat.h
See Apple's -- PEFBinaryFormat.h
See Apple's -- PEFBinaryFormat.h
See Apple's -- PEFBinaryFormat.h
RemoteAdapterListener provides a listener interface
which facilitates notifcation when the connection
state of a remote server/repository adapter changes.RemoteBufferFileHandle facilitates access to a remote BufferFile
via RMI.RemoteDatabaseItem provides a FolderItem implementation
for a remote database.RemoteFileSystem provides access to versioned FolderItem's which
exist within a Repository-based directory structure.RemoteFolderItem provides an abstract FolderItem implementation
for an item contained within a remote Repository.RemoteManagedBufferFileHandle facilitates access to a ManagedBufferFile
via RMI.RepositoryHandle provides access to a remote repository via RMI.RepositoryServerHandle provides access to a remote repository server via RMI.Action for adding all fields to the current format.
Command to remove all references at an address or for a particular operand
index at an address.
Command to remove an external program name from the reference manager.
Command for removing external references.
Action for removing fields
Command for removing a tag from a function
Command for removing memory references.
Action for removing empty rows.
Command for renaming a fragment or a module in listing.
Command to rename a component in a data type.
Command for renaming labels.
Command to rename a tree in a program; this does not affect
the root module of the tree.
Settings definition for controlling the display of UNICODE characters.
Command to reorder children in a module.
Interface to define a comment that can be shared by more
than one code unit.
The
RepeatableCommentFieldLocation class contains specific location information
within the Repeatable comment of an EOL comment field of a CodeUnitLocation object.Base abstract data type for a Dynamic structure data type that contains
some number of repeated data types.
Repeat the annotated test method some number of times
Template for a repeated Dynamic Data Type.
A JUnit test statement that repeats its base statement 1 or more times
Some number of repeated strings.
A test rule which processes the
Repeated annotationRepeatInstructionByteTracker provides pseudo-disassemblers the ability to track
repeated bytes during disassembly of a block of instructions.RepositoryAdapter provides a persistent wrapper for a remote RepositoryHandle
which may become invalid if the remote connection were to fail.Repository change event (used by server only).
RepositoryHandle provides access to a repository.RepositoryItemStatus provides status information for a
repository folder item.RepositoryNotFoundException thrown when a failed connection occurs to a
non-existing repository.Panel that shows a list of existing repositories, or allows the user
to enter the name of a new repository to be created.
RepositoryServerAdapter provides a persistent wrapper for a
RepositoryServerHandle which may become invalid if the
remote connection were to fail.RepositoryServerHandle provides access to a repository server.Action for adding all fields to the current format.
Action for adding all fields to the current format.
An action to re-center the image on a NavigableImagePanel.
A class to represent the new-executable resident name table.
An implementation of the new-executable TNAMEINFO structure.
Identifies code units that are resources, such as Bitmap, jpeg, png, etc.
Points to the root resource directory.
typedef struct _IMAGE_RESOURCE_DATA_ENTRY {
DWORD OffsetToData;
DWORD Size;
DWORD CodePage;
DWORD Reserved;
};
typedef struct _IMAGE_RESOURCE_DIRECTORY {
DWORD Characteristics;
DWORD TimeDateStamp;
WORD MajorVersion;
WORD MinorVersion;
WORD NumberOfNamedEntries;
WORD NumberOfIdEntries;
};
typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY {
union {
struct {
DWORD NameOffset:31;
DWORD NameIsString:1;
};
DWORD Name;
WORD Id;
};
union {
DWORD OffsetToData;
struct {
DWORD OffsetToDirectory:31;
DWORD DataIsDirectory:1;
};
};
};
typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING {
WORD Length;
CHAR NameString[ 1 ];
};
typedef struct _IMAGE_RESOURCE_DIR_STRING_U {
WORD Length;
WCHAR NameString[ 1 ];
};
A
ProgramLocation of an item that is a Resource
embedded in a binary (ie.Class for representing file object regardless of whether they are actual files in the file system or
or files stored inside of a jar file.
A
JavaFileManager that works with Ghidra's ResourceFiles.A
JavaFileObject that works with Ghidra's ResourceFileJavaFileManager.A class to hold the information extracted from a
resource data directory.
General resource management class that provides a convenient
way of accessing external resources used in Ghidra.
A class for storing new-executable resource names.
A class to hold the information extracted from a
resource data directory.
A class for storing new-executable resource string tables.
A class for storing the new-executable resource table.
An implementation of the TTYPEINFO structure.
Marker interface for
Navigatable contexts that don't support navigating to the entire
program.A view of the value-sorted map for implementing
RestrictedValueSortedMap.subMapByValue(Object, boolean, Object, boolean), etc.ReturnParameterImpl represent the function return value.A version of
DialogComponentProvider for clients to extend when they intend for their
dialog to be reused.Field for showing multiple strings, each with its own attributes in a field,
on a single line, clipping the beginning of the text as needed to fit within the field's width.
Wraps a
ListIterator so that the operations are reversed.Reads in a single line of text from a given input file, in reverse order.
The "Rich" header contains encoded metadata about the tool chain used to generate the binary.
An element of a
RichTableTop level object model of the
RichHeader.Form new expression by right shifting a PatternExpression the amount
determined by another PatternExpression
Solves expressions of the form
A >> BLayout for two components laid out horizontally where the first component gets its preferred width
and the second component gets the remaining space up to its preferred width.
Exception thrown when a transaction should be rolled back.
Special root node for a decision tree.
Represents a routines_command and routines_command_64 structure
A row in a grid.
A comparator for a specific column that will take in a T row object, extract the value
for the given column and then call the give comparator
Simple class to return a row, column location.
This layout arranges components in rows, putting as many components as possible on a
row and using as many rows as necessary.
Instances of this class converts table rows into lists of strings.
RowLayout handles a single row layout that may be part of a multiple row layout that
is generic enough to be used by the SingleRowLayout or the MultiRowLayout.
This layout arranges components in rows, putting as many components as possible on a
row and using as many rows as necessary.
Deprecated, for removal: This API element is subject to removal in a future version.
this class is no longer used and will be removed
A class to track and restore selections made in a table.
An interface to mark that the given model uses a single object to represent each row in the
table.
The RTTI0 data type represents a TypeDescriptor structure.
Deprecated.
Use of this dynamic data type class is no longer recommended.
Deprecated.
Use of this dynamic data type class is no longer recommended.
Deprecated.
Use of this dynamic data type class is no longer recommended.
Deprecated.
Use of this dynamic data type class is no longer recommended.
An abstract class that each RTTI data type should extend to get common functionality.
Helper class to execute a Runnable in a separate thread and provides a
progress monitor component that is shown as needed.
Represents a rpath_command structure
Adjust functions in a Rust compile unit to use Rust calling convention, ignore any information
about parameter storage locations.
A class to represent the S_BPREL32_NEW data structure.
A class to represent the S_GPROC32_NEW data structure.
A
SearchLocation that only looks in the program's original import directory.Check for errors and prevent probable bad function info from being locked in
A graph viewer that shows a scaled, complete rendering of the graph with which it is
associated.
Save and restore elements that are compatible with ObjectStorage objects.
Modal dialog to display a list of domain objects that have changed.
An action to save the image from a NavigableImagePanel to a file.
Class for saving name/value pairs as XML or Json.
Shows the modal dialog to save tool configuration to the current
name or to a new name.
The Scalar defines a immutable integer stored in an arbitrary number of bits (0..64), along
with a preferred signed-ness attribute.
A ScalarOverflowException indicates that some precision would
be lost.
A plugin to show tool tip text for hovering over scalar values in the decompiler.
LazyImageIcon that creates a scaled version of an iconDeprecated, for removal: This API element is subject to removal in a future version.
This class has been replaced by
ScaledImageIcon since it
extends ImageIconWrapper which has also been deprecated.Scan algorithms that examine the byte values of existing search results and look for changes.
Class for definining the columns in a Ghidra Database table.
Plays a MIDI score
This class parses the meta-data about a script.
A simple
Message implementation that allows us to use the filtering capability
of log4j.Panel that shows each property in an Options category or a Group in an Options category
A JScrollPane wrapper for a text area that can be told to scroll to bottom
ScrollingListChoicesPanel provides a table type of format for resolving
Each row that has choices represents the choices for a single conflict.Miscellaneous constants
SearchFormats are responsible for parsing user input data into a
ByteMatcher that
can be used for searching memory.Maintains the state of all the settings and controls for the memory search window.
Class for managing memory search history.
Component for displaying and selecting from a filterable list of items that are grouped into
categories.
An record to hold the list item and additional information needed to properly render the item.
Interface for the model for
SearchList.An object that describes a search result.
Represents a collection of dwarf external debug files that can be searched.
Information outside of a location string that might be needed to create a new
SearchLocation
instance.List of
SearchLocation types that can be saved / restored from a configuration string.Manages the
MarkerSet for a given MemorySearchProvider window.Interface to specify a named region within a byte source (Program) that users can select to
specify
AddressSetViews that can be searched.A search result container class used with ByteTrie.
Immutable container for all the relevant search settings.
Represents a section and section_64 structure.
A class to the represent the IMAGE_SECTION_HEADER
struct as defined in
winnt.h.See Apple's -- PEFBinaryFormat
Values for the sectionKind field.
Values for the shareKind field.
SecureRandomFactory provides a static singleton instance of SecureRandomA class to represent the
WIN_CERTIFICATE
struct as defined in winbase.h.A class to represent a new-executable segment.
Represents a segment_command and segment_command_64 structure
Address class for dealing with (intel) segmented addresses.
Address Space for dealing with (intel) segmented address spaces.
SegmentMismatchException is thrown when two
addresses with different segments are used in an operation
that requires the same segment.A class to represent a new-executable segment relocation.
A class to represent the new-executable segment table.
Nimbus selected tree row painter
Dialog that presents the user with a list of strings and returns the object
associated with the user-picked element.
A class to track and restore selections made in a table.
A listener that will get notified of selections made by the
SelectionManager.This action is used by
GhidraTables to allow the user to trigger navigation when
selections are made.Defines data that is available for drag/drop and clipboard transfers.
Data that is the transferable in SelectionTransferable; it contains an address set and the
path of the program.
A generic reusable panel for selecting a language.
A listener for the SelectLanguagePanel
A simple panel with buttons for selecting and de-selecting items
A sparse byte array characterized by contiguous dense regions
typedef struct _IMAGE_SEPARATE_DEBUG_HEADER {
WORD Signature;
WORD Flags;
WORD Machine;
WORD Characteristics;
DWORD TimeDateStamp;
DWORD CheckSum;
DWORD ImageBase;
DWORD SizeOfImage;
DWORD NumberOfSections;
DWORD ExportedNamesSize;
DWORD DebugDirectorySize;
DWORD SectionAlignment;
DWORD Reserved[2];
} IMAGE_SEPARATE_DEBUG_HEADER, *PIMAGE_SEPARATE_DEBUG_HEADER;
Generates Separator Fields.
Basically a unique address for a PcodeOp
It is unique, maintains original assembly instruction address, and is comparable
within a basic block
SeqenceSearchState holds the state of a search for a DittedBitSequence within a byte
sequence.
Container for a host name and port number.
Component that allows the user to specify the host name and port
number for the remote repository server.
Wizard panel that allows the user to specify the host name and port
number for the remote repository server.
Meta-data about a Plugin's Service.
Notifications for when services are added to or removed from a PluginTool.
Class for managing plugin services.
Interface for providing Services
Command to set a specific type of comment on a code unit.
Command for editing and removing comments at an address.
Command for setting an equate at a location.
Command for setting the external program name and path.
Command class for adding external references.
Command for setting the fallthrough property on an instruction.
Command for setting the fallthrough property on an instruction.
Command to set the name of a function.
A simple command to set the stack purge size of a function.
Command to set the Function's Repeatable Comment.
A simple command to set whether or not a function has VarArgs.
Command to make a label the primary label at an address.
Command class for setting a reference to be primary.
Command for setting the value of a register over a range of addresses.
Command for setting a function's return type.
Settings objects store name-value pairs.
Generic interface for defining display options on data and dataTypes.
Basic implementation of the Settings object
Property map interface for storing Settings objects.
Command to set the comment on a function varible.
Command to set the datatype on a stack variable.
Command to rename a stack variable.
A place used to hold
DockingActionIfs that are meant to be used by components.A marker interface to signal that the implementing action serves as an action that should
not itself be used in the tool, but should only be used to register and manage keybindings.
Deprecated.
This map class should not be used except by the OldFunctionMapDB class
Identifies functions to which Jump references exist and converts
the associated branching instruction flow to a CALL-RETURN
A stub action that allows key bindings to be edited through the key bindings options.
Provides a definition of a Double Word within a program.
ShiftedReference is a memory reference whose "to" address is
computed from a base value left shifted by a shift amount.Array of shorts that grows as needed.
Array of byte[] that grows as needed.
Basic implementation for a Short Integer dataType
ShortField provides a wrapper for 2-byte signed short data
which is read or written to a Record.This class converts arbitrary short keys into compacted short indexes suitable
for use as indexes into an array or table.
The ShortKeySet provides an interface for managing a set of ordered short keys
between the values of 0 and N.
Class to manage multiple linked lists of short indexes.
Class that implements a hashtable with Short keys and long values.
Class that implements a hashtable with short keys and Object values.
Class that implements a hashtable with short keys and String values.
Action for displaying the
ActionChooserDialog.An action to trigger a context menu over the focus owner.
ShutdownHook wrapper class for shutdown callbackA Vertical JScrollbar that displays an additional component to its right and sized such that
its top is just below the top button of the scrollbar and its bottom is just above the bottom
button of the scrollbar.
SignatureCallback provides a Callback implementation used
to perform PKI authentication.An unordered list of features describing a single function.
Provides a definition of a Signed Byte within a program.
Provides a definition of a primitive signed char data type.
Provides a definition of a Signed Double Word within a program.
A Signed Little Endian Base 128 integer data type.
Signedness attribute of a structure mapped field
Defines how the sign of integer-type numbers is to be interpreted for rendering.
Provides a definition of a Signed Quad Word within a program.
SignedToken provides the result of a signed token byte array.Provides a basic implementation of a signed word datatype
SimpleBlockIterator is an implementation of
CodeBlockIterator capable of iterating in
the forward direction over "simple blocks".This BlockModel implements the simple block model.
An implementation of interface CharStream, where the stream is assumed to
contain only ASCII characters (without unicode processing).
An implementation of interface CharStream, where the stream is assumed to
contain only ASCII characters (without unicode processing).
This iterator is implemented by getting the flows from the instruction
and iterating over those flows (plus the fallthrough).
Field to display an image.
SimpleSourceReferenceIterator is a unidirectional iterator over the
CodeBlockReferences
for a CodeBlock.The simplest possible Text field.
Deprecated, for removal: This API element is subject to removal in a future version.
A simple implementation of AddressSetCollection that contains exactly one AddressSet.
SingleEntSubIterator is an implementation of
CodeBlockIterator capable of iterating in
the forward direction over subroutine code blocks.A helper class used by GFilesystem implementors that have a single file to handle lookups
and requests for that file.
Format of resource data for a single resource.
Convienence class for SingleRowLayout.
Abstract base class for single value constraints such as "At Most" or "At Least"
A common base class for data-type filters that tests for a size range.
Encoding values for the .sla file format
Exceptions generated from parsing the SLED/SSL configuration files (load time)
An
Assembler for a SleighLanguage.An
AssemblerBuilder capable of supporting almost any SleighLanguageA class to traverse SLEIGH constructors in a language
An internal visitor
The
SleighConstructorTraversal.traverse(ConstructorEntryVisitor) method iterates
over each subtable, traversing each with this visitor.SleighDebugLogger provides the ability to obtain detailed instruction
parse details.TODO To change the template for this generated type comment go to
Window - Preferences - Java - Code Style - Code Templates
The default instruction decoder, based on Sleigh
The InstructionPrototype for sleigh languages.
Class for holding Language identifiers
Searches resources for spec files and provides LanguageDescriptions for these
specifications
A collection of utility functions for traversing constructors and Pcode operations of SLEIGH
languages
An internal visitor
The
SleighLanguages.traverseAllPcodeOps(SleighLanguage, PcodeOpEntryVisitor) method
uses this visitor to traverse every constructor a given language.Validate SLEIGH related XML configuration files: .cspec .pspec and .ldefs
A ResourceFile containing an XML document can be verified with one of the
static methods:
- validateCspecFile
- validateLdefsFile
- validatePspecFile
Alternately the class can be instantiated, which will allocate a single verifier
that can be run on multiple files.
An exception thrown by
PcodeExecutor.executeCallother(PcodeOp, PcodeFrame, PcodeUseropLibrary) when a p-code
userop turns up missing.All the recovered context for a single instruction
The main data structure is the tree of constructors and operands
A p-code userop defined using Sleigh source
A builder for a particular userop
A factory for building
SleighPcodeUseropDefinitions.Methods for compiling p-code programs for various purposes
A p-code parser that provides programmatic access to error diagnostics.
A factory for
PcodeProgramsA collection of utilities for parsing and manipulating Sleigh semantic source
An exception indicating the parse tree did not match a pattern
A function representing a non-terminal in the Sleigh semantic grammar
An exception carrying one or more Sleigh parsing errors
A Sleigh parsing error
Class that is a JButton that has an empty border and adds a mouse listener
so that the button looks raised when the mouse pointer enters the button,
and looks lowered when the mouse pointer exits the button.
Class to manage a "soft" HaspMap that keeps its keys as soft references so
they can be reclaimed if needed.
An exception that indicates no solution is possible
A type for solver hints
An interface for sorted lists
Provides a list of integer ranges that are maintained in sorted order.
A table model that allows for setting the sorted column(s) and direction
Occurs when a graph cannot be sorted
DataTypeSource holds information about a single data type archive which supplied a data type
to the program.
This class is used to index source files in a SLEIGH language module.
Represents a source_version_command structure
Generates empty line Fields.
The
SpaceFieldLocation class contains specific location information
within the Space field of a CodeUnitLocation object.Reserved AddressSpace names across architectures and associated attributes
Generates Spacer Fields.
The
SpacerFieldLocation class contains specific location information
within a spacer field of a CodeUnitLocation object.A (closed) interval
The default implementation of
Span.SpanMap and Span.MutableSpanMap using an interval
treeThe default implementation of
Span.SpanSet and Span.MutableSpanSet using an interval
treeThe (discrete) domain of endpoints for a span
A mix-in interface for empty spans
An abstract interface for a mutable
Span.SpanMapAn abstract interface for a mutable
Span.SpanSetAn abstract interface for an immutable map of spans to values
A partial implementation of
RangeMapSetter for Spans.An abstract interface for a set of spans
Utility class for installing/removing "specification extensions" to a Program.
Helper class for collecting information about an extension XML document
and constructing its option name for storage
The possible types of spec extensions.
Status of a particular compiler specification element
Class used represent "special addresses"
This is a TripleSymbol whose semantic value can be determined
at compile time (i.e.
Utilities for encoding and decoding XML datatypes for use in specification files that
are validated by RelaxNG.
Splash screen window to display version information about the current release of
the Ghidra application.
SSHSignatureCallback provides a Callback implementation used
to perform SSH authentication.Initialize the default SSLContext for use by all SSL connections (e.g., https).
HttpsHostnameVerifier is required by HttpsURLConnection even
if it does nothing.
The Stack class represents a last-in-first-out (LIFO) stack of objects.
Definition of a stack frame.
Compares stack variable offsets; has a static factory method to get
a StackVariableComparator.
Basic implementation of the DataTypeManger interface
Handles marking up and program info for basic ELF note (and note-like) sections.
The offset value of the current instructions address
"Solves" expression of
inst_startA filter that will pass text when it starts with the filter text.
TripleSymbol with semantic value equal to offset of instruction's
current address
Provides a status bar panel which has a text area to the left.
A class to handle the space requirements on the status bar that vary for different OSes.
StatusListener is a general purpose status listener
responsible for displaying and/or recording status messagesData-type class for the purpose of assigning storage
Downgrades the function's signature commit mode to FORMAL-param-info-only if there are
problems with param storage info.
A layout manager that gives the affect of CENTER in BorderLayout.
Array of Strings that grows as needed.
Array of String[] that grows as needed.
This class provides a storage mechanism for String-valued information about
the elements of a KeyIndexableSet, e.g.
A
PropertyEditor that allows the user to edit strings by way of a File editor, as is
done by StringBasedFileEditor.StringEnum objects represent a choice from a limited set of options.
Base class for various String constraints.
Provides String related column constraints.
A constraint editor for String-type values.
String column constraint for matching column values if they contain the constraint value pattern.
Represents an instance of a string in a
MemBuffer.Container object that holds a start and end position within a string.
String column constraint for matching column values if they end with the constraint value pattern.
StringField provides a wrapper for variable length String data which is read or
written to a Record.Class with static methods formatting values in hex.
Class that implements a hashtable with String keys and int values.
String column constraint for matching when the value is null or the empty string.
String column constraint for matching when the value is not null and not the empty string.
This class converts arbitrary Strings into compacted int indexes suitable
for use as indexes into an array or table.
String column constraint for matching column values if they match a full regular expression pattern.
Query for matching string fields with wildcard string.
String column constraint for matching column values if they don't contain the constraint value pattern.
String column constraint for matching column values if they don't end with the constraint value pattern.
String column constraint for matching column values if they do not match a full regular
expression pattern.
String column constraint for matching column values if they don't start with the constraint value pattern.
Property manager that deals with properties that are of
String type.
Property manager that deals with properties that are of
String type and stored with a database table.
A Java property value for keys that use String values.
Helper class used to build up a formatted (for human consumption) string representation returned
by Unicode and String data types.
A parser to invert
StringDataInstance.getStringRepresentation(),
StringDataInstance.getCharRepresentation(), and related.An exception for when a string representation cannot be parsed.
String column constraint for matching column values if they start with the constraint value pattern.
Represents a DWARF string table, backed by a memory section like .debug_str.
Interface for providing string translating services.
A fixed-length UTF-8 string
DataType.Class with static methods that deal with string manipulation.
About the worst way to wrap lines ever
A service that judges the validity of a string
Result of a
StringValidatorService's judgment about a string.Value class for
String values.Allows a class to create a structure
datatype equivalent to its class members.
The structure interface.
BitOffsetComparator provides ability to compare an normalized bit offset (see
Structure.BitOffsetComparator.getNormalizedBitfieldOffset(int, int, int, int, boolean)) with a
DataTypeComponent object.Information about an instance of a structure that has been read from the memory of a
Ghidra program.
Basic implementation of the structure data type.
Structured Dynamic Data type.
The primary class for using the "structured sleigh" DSL
A generated Sleigh label
A value which can be used on either side of an assignment
Declare a parameter of the p-code userop
A value which can only be used on the right-hand side of an assignment
A Structured Sleigh statement
A Structured Sleigh statement that also has a value
An exception for unrecoverable Structured Sleigh compilation errors
"Export" a method as a p-code userop implemented using p-code compiled from structured Sleigh
The declaration of an "imported" userop
A Sleigh variable
Creates and initializes
Structure objects.Indicates that the tagged class corresponds to a Ghidra structure.
Contains immutable information about a structure mapped class needed to deserialize
a new object from the data found in a Ghidra program.
Optional interface that structure mapped classes can implement that allows them to control how
their class is marked up.
Function that decorates a Ghidra structure
Interface used by structure mapped classes that need to manually deserialize themselves from
the raw data, required when the structure contains variable length fields.
Used to force a clip to happen by using this field with space characters and size that far
exceeds the available painting width.
ListingStub can be extended for use by tests.
MemoryStub can be extended for use by tests.
Version of ThemeManager that is used before an application or test installs a full
ApplicationThemeManager.
Represents a sub_client_command structure
Generates data value Fields for data subcomponents.
The
SubDataFieldLocation class contains specific location information
within the Sub-data field of a CodeUnitLocation object.New expression formed by subtracting two PatternExpressions
Solves expressions of the form
A - BRepresents a sub_framework_command structure
Represents a sub_library_command structure
Subroutine block model.
SubroutineDestReferenceIterator is a unidirectional iterator over
the destination
CodeBlockReferences for a CodeBlock.Cheap container for match info.
To change the template for this generated type comment go to
Window>Preferences>Java>Code Generation>Code and Comments
Command that organizes a Module or Fragment according to a specified block
model.
SubroutineSourceReferenceIterator is a unidirectional iterator over
the source
CodeBlockReferences for a CodeBlock.An interface for visiting constructors in a SLEIGH subtable
A collection of Constructors or a Symbol representing
one out of a family of Constructors, choosen based on InstructionContext
Represents a sub_umbrella_command structure
An exception thrown during execution if
PcodeThread.setSuspended(boolean) is invoked with
true.Used to refer to a Swift section, which can have different names depending on the platform
Parses marks up, and provide access to Swift type metadata
Implemented by all Swift type metadata structures
Swift-related utility methods
A utility class to handle running code on the AWT Event Dispatch Thread
A simple interface that allows implementing clients to get called back from the animation
framework.
Class to handle exceptions caught within the Swing event dispatch thread.
Runnable that has a method that may need to be run in the Swing AWT thread.
A class to allow clients to buffer events.
Base class for symbols in sleigh
Interface for a symbol, which associates a string value with
an address.
An annotated string handler that handles annotations that begin with
SymbolAnnotatedStringHandler.SUPPORTED_ANNOTATIONS.Interface for a Symbol Change set.
Imported and exported symbol classes
Converts Symbol Column objects to Strings so that column gets String type column
filters
Represents a symseg_command structure.
Base class for symbols
A mapping from a HighSymbol object to the storage that holds the symbol's value.
Class for coloring symbols.
Iterator defined to return Symbol objects.
A convenience object for parsing a namespace path to a symbol.
A parser for breaking down namespaces in the presence of complicating factors such
as templates.
A single scope of symbol names for sleigh
Full symbol table for sleigh
A SymbolTable manages the Symbols defined in a program.
Represents a symtab_command structure
Listener methods that are called when changes to symbols are made.
Class to represent the various types of Symbols.
Class with static methods to deal with symbol strings.
Implementation of AddressSetCollection used by
ProgramChangeSet.Creates a thread-safe pass-through
ByteProvider.An
DockingKeyBindingAction to signal that the given DockingAction gets priority
over all other non-system actions in the system.Default key strokes for System actions.
This class provides a set of IDs that can be used in the application, regardless of which Look
and Feel (LaF) is being used.
General purpose class to provide convenience methods for doing "System" type
stuff, e.g., find resources, date/time, etc.
Table implementation class.
A strategy to perform table add and remove updates
Deprecated, for removal: This API element is subject to removal in a future version.
This class has been replaced by
TableSelectionDialog.Dialog to show a table of items.
The interface clients must implement to use the
TableChooserDialog.A class to keep track of and persist state for column models, including size, ordering and
visibility.
A utility class for tables to use when sorting
A concept that represents the data used by the
ThreadedTableModel.An entry in a (sparse) LR(0) transition table or LALR(1) action/goto table
A key in a (sparse) LR(0) transition table or LALR(1) action/goto table
T
Provides additional information (context) to column filter constraint objects.
Listener interface for the ColumnFilterModel.
Allows clients to create a table model that will call them back via this interface so
that they may perform their own loading.
A wrapper that will take a table model and decorate it with filtering capability.
Represents a dylib_table_of_contents structure.
NOTE: ALL TableRowMapper CLASSES MUST END IN "TableRowMapper".
Dialog for displaying table data in a dialog for the purpose of the user selecting one or
more items from the table.
Service to show a component that has a JTable given a table model
that builds up its data dynamically (a
ThreadedTableModel).Represents the concept of a table's sorted state, which is the number of sorted columns, their
sort order and their sort direction.
Table statistics data
State machine object for performing the various update functions on a ThreadedTableModel.
A utility class for JTables used in Ghidra.
Undecorated dialog for showing a popup window displaying a filterable, scrollable list of tabs
in a
GTabPanel.Represents a Swift TargetClassDescriptor structure
Represents a Swift TargetContextDescriptor structure
Represents a Swift TargetEnumDescriptor structure
Represents a Swift TargetProtocolConformanceDescriptor structure
Represents a Swift TargetProtocolDescriptor structure
Represents a Swift TargetStructDescriptor structure
Represents a Swift TargetTypeContextDescriptor structure
Base class for Tasks to be run in separate threads
A builder object that allows clients to launch tasks in the background, with a progress
dialog representing the task.
Dialog that is displayed to show activity for a Task that is running outside of the
Swing Thread.
Class to initiate a Task in a new Thread, and to show a progress dialog that indicates
activity if the task takes too long.
Listener that is notified when a thread completes its task.
TaskMonitor provides an interface that allows potentially long running tasks to show
progress and check for user has cancellation.Implementation of
TaskMonitor with most features stubbed out.Component that contains a progress bar, a progress icon, and a cancel
button to cancel the task that is associated with this task monitor.
Schedules tasks to be run in the
DialogComponentProvider.Class for simplify names with template data.
A handle to a terminal window in the UI.
A service that provides for the creation and management of DEC VT100 terminal emulators.
Settings definition for strings being terminated or unterminated
TerminatedTransactionException occurs when a database modification is
attempted following the forced/premature termination of an open transaction.A null-terminated UTF-32 string
DataType.TerminatingConsumer is a Consumer
Consumer that can request termination
of the supplier once some condition is reached, for example some number of consumed results
accepted.Interface for classes that need to split strings into a series of individual terms.
A class to take an exception and capture test system state for later reporting.
An error display wrapper that allows us to fail tests when errors are encountered.
A test version of the
FrontEndTool that disables some functionalityA class that helps to delegate key events to the system override key event dispatcher.
A class to handle locating, opening and caching (within a JVM) programs in the test
environment.
This class exists to open access to the
DefaultProjectManager for testsA
RuntimeException that will print a custom stack trace.A set of static utilities to facilitate JUnit testing.
Actually, not.
An autocompleter that may be attached to one or more
JTextField.A demonstration of the autocompleter on two linked text fields.
A demonstration of the autocompleter on a single text field.
A class that links text fields into a "formatted text field", separated by expressions.
Graphics used to render copied text data.
A class that will layout text into lines based on the given display size.
Options implementation for theme color options.
Color Table for Theme Dialog
Table model for theme colors
Tree for showing colors organized by similar colors and reference relationships.
Primary dialog for editing Themes.
Event for when a theme value changes;
Options implementation for theme font options.
Font Table for Theme Dialog
Table model for theme fonts
Icon Table for Theme Dialog
Table model for theme icons
Listener interface for theme changes
This class manages application themes and their values.
Reads and writes current theme info to preferences
Reads the values for a single theme.properities file
A common interface for theme tables
ActionContext for ThemeDialog tables
Some common methods related to saving themes.
A generic class for storing theme values that have a String id (e.g.
Base class for Theme property Editors (Colors, Fonts, and Icons)
Writes a theme to a file either as a single theme file or as a zip file that contains the theme
file and any external (from the file system, not the classpath) icons used by the theme.
Update the function's calling convention (if unset) if there is a "this" parameter.
Represents a thread_command structure
A version of
ColumnRenderedValueBackupComparator that uses the
ThreadedTableModel's cache for column lookupsA comparator for comparing table column values for threaded table models.
The base implementation of the threaded table model.
A listener to be notified of
ThreadedTableModel loading changes.A version of
ThreadedTableModel for clients that do not need a DATA_SOURCE.Class for creating a Ghidra memory block representing the TEB: Thread Environment Block.
An enumeration describing a Windows OS version by String and by ordinal.
A p-code executor state that multiplexes shared and thread-local states for use in a machine that
models multi-threading
Represents a _STRUCT_ARM_THREAD_STATE structure.
Represents a _STRUCT_ARM_THREAD_STATE64 structure.
Represents a _STRUCT_X86_THREAD_STATE32 structure.
Represents a _STRUCT_X86_THREAD_STATE64 structure.
A class to represent the
IMAGE_THUNK_DATA32 struct
as defined in
winnt.h.Generates Thunked Function Fields.
The
ThunkedFunctionFieldLocation class provides specific information
about a thunked function within a program location.A handler to process
OperandFieldLocation mouse clicks.ThunkFunction corresponds to a fragment of code which simply passes control
to a destination function.Implementation for a Thunk Function reference.
Indicates that a
CancelledException happened due to a timeout.A task monitor that allows clients the ability to specify a timeout after which this monitor
will be cancelled.
Adds a border to a component that displays a title and provides a area for adding
components (usually icon buttons)
Points to the Thread Local Storage initialization section.
A class to represent the IMAGE_TLS_DIRECTORY32 and
IMAGE_TLS_DIRECTORY64 data structures.
Converts the Ghidra "source" TOC file to a JavaHelp TOC file.
A Table of Contents entry, which is represented in the help output as an xml tag.
A representation of the <tocdef> tag, which is a way to define a TOC item entry in
a TOC_Source.xml file.
An interface that allows us to perform dependency injection in the testing environment
A representation of the <tocref> tag, which is a way to reference a TOC item entry in
a TOC_Source.xml file other than the one in which the reference lives.
Builder for
ToggleDockingActionsInterface for actions that have a toggle state
Describes the input token stream.
Describes the input token stream.
A contiguous set of bits within instruction stream, interpreted
as an integer value
Solves expressions of a token (instruction encoding) field
A class to create and store colors related to token names
A simple class to manage
HighlightTokens used to create highlights in the Decompiler.An iterator over ClangToken objects.
Token Manager Error.
Token Manager Error.
Generic tool interface for managing
ComponentProviders and actionsAn class to manage actions registered with the tool
A class that describes a content types and the tool used to open it.
Class to manager toolbar buttons.
Manages the actions to be displayed in the toolbar.
Defines data that is available for drag/drop and clipboard transfers.
Interface to define methods to manage tools in a central location.
Listener that is notified when a ToolTemplate is added or removed from a
project
Represents a connection between a producer tool and a
consumer tool.
Values used to define standard menu names and other miscellaneous constants
Annotation for publishing the ToolEvent name so that is shows up in the tool connection
dialog.
Container class for an icon and its location.
Interface to be implemented by objects that want to receive PluginEvents.
Interface to define methods to manage running tools and tools in
the Tool Chest.
Tool manager that knows about all the running tools for each workspace
in the project; the tool manager is responsible for launching new tools,
and managing connections among tools.
Class to manage a set of option name/value pairs for a category.
Services that the Tool uses.
Interface to define a set of Tools.
Container object for the state of the tool to hold an XML element.
Manages a queue of background tasks that execute commands.
Configuration of a tool that knows how to create tools.
Basic container object that knows how to generate tooltips
A utility class that creates tool tip text for given data types.
Provides syntax for opening a database transaction using a try-with-resources block
An interface for listening to transactions
Simple static class to keep track of transient domain file/domain objects.
The item is present for transitional purposes only and will soon be removed
SettingsDefinition for translation display, handles both the toggle of
"show" vs "don't show", as well as accessing the translated value.
Manage the set of trees in the program.
Notification for a new Program Tree selection.
A multi-valued map using a tree map of tree sets
TaskMonitor implementation that is useful for monitor work when traversing trees.
A tree-based implementation of a value-sorted map
The underlying implementation is currently an unbalanced binary tree whose nodes also comprise a
doubly-linked list.
Patterned after
BiConsumer.Abstract class for the primary sleigh variable.
A class to animate a vertex in order to draw attention to it.
LayoutManger for arranging components into exactly two columns.
Represents a twolevel_hint structure.
Represents a twolevel_hints_command structure
The typedef interface
Basic implementation for the typedef dataType.
TypeDefSettingsDefinition specifies a SettingsDefinition whose
use as a TypeDef setting will be available for use within a non-Program
DataType archive.Filters a symbol iterator to only return a specific symbol type
Exception thrown when a PropertyPage does not support a
requested data type.
An exception class to handle encountering
invalid UBI Headers.
The purpose of this class is to introduce multiple levels of indirection into the Java
LookAndFeel (LaF), which allows the user to change these values.A span of unsigned longs
An interval tree implementing
ULongSpan.MutableULongSpanMapAn interval tree implementing
ULongSpan.MutableULongSpanSetThe domain of unsigned longs
The singleton empty span of unsigned longs
A non-empty span of unsigned longs
A mutable map of unsigned long spans to values
A mutable set of unsigned long spans
A map of unsigned long spans to values
A set of unsigned long spans
Signals that a background thread attempted to
SwingUtilities.invokeAndWait(Runnable)
operation that timed-out because the Swing thread was busy.Base class for unary operators on PatternExpressions
A matcher for a unnary expression
Undefined identifies an undefined data typeProvides an implementation of a byte that has not been defined yet as a
particular type of data in the program.
Provides an implementation of a 2 byte dataType that has not been defined yet as a
particular type of data in the program.
Provides an implementation of a byte that has not been defined yet as a
particular type of data in the program.
Provides an implementation of a 4-byte dataType that has not been defined yet as a
particular type of data in the program.
Provides an implementation of a byte that has not been defined yet as a
particular type of data in the program.
Provides an implementation of a byte that has not been defined yet as a
particular type of data in the program.
Provides an implementation of a byte that has not been defined yet as a
particular type of data in the program.
Provides an implementation of an 8-byte dataType that has not been defined yet as a
particular type of data in the program.
An UndefinedValueException is thrown when a value
for a register is looked up that is undefined.
Dialog that confirms undo of an action; specify whether a .keep file
should be created on the undo of the action.
Handles tracking undo and redo events.
This serves both as a marker interface for classes missing important methods and as container for
the
Unfinished.TODO(String, Object...) method.A fixed-length UTF-32 string
DataType.A fixed-length UTF-16 string
DataType.Template for a constructor which is officially "unimplemented" as opposed to a
constructor which does nothing (like a NOP).
The union interface.
Basic implementation of the union data type.
A specialized HighSymbol that directs the decompiler to use a specific field of a union,
when interpreting a particular PcodeOp that accesses a Varnode whose data-type involves the
union.
Some utilities for when singleton collections are expected
Offsets for various ranges in the p-code unique space.
An subclass of
MemoryBank intended for modeling the "unique" memory
space.A simple class representing a byte-addressable word of memory.
An UnknownContextException indicates a processor state context must be known
before the bytes at the parse address can form a legal known instruction.
An UnknownDataException indicates that the bytes at the parse
address did not form a legal known data item.
UnknownFolderItem acts as a LocalFolderItem place-holder for
items of an unknown type.An UnknownInstructionException indicates that the bytes at the parse
address did not form a legal known instruction.
A class that is meant to wrap a
TaskMonitor when you do not know the maximum value
of the progress.UnknownRegister is used when a register is requested in the register space
for an undefined location.A
ByteProvider constrained to a sub-section of an existing ByteProvider
although reads beyond the specified sub-section are permitted but will return zero byte
values.This wrapper class is used to detect cases where code is
modifying iterators that shouldn't change.
Icon class for when we can't find an icon for a path
Provides a definition of a primitive unsigned char data type.
A fixed size 16 byte unsigned integer (commonly referred to in C as uint128_t)
Basic implementation for an unsigned Integer dataType
An Unsigned Little Endian Base 128 integer data type.
A constraint editor for 64 bit unsigned numbers.
Provides an editor for editing constraints for unsigned 64 bit values.
Basic implementation for a Signed Long Integer dataType
Basic implementation for an Signed LongLong Integer dataType
A constraint editor for specifying ranges of unsigned long values.
Basic implementation for a Short Integer dataType
This class provides a dummy map for an unsupported map.
A stub provider for unsupported scripts.
Command to update the name for an external program.
A command to update
Function signature in its entirety including optional
custom storage.An annotated string handler that allows handles annotations that begin with
URLAnnotatedStringHandler.SUPPORTED_ANNOTATIONS.LazyImageIcon that is created from a URL to an icon file.DomainObjectAdapterLink object provides a Ghidra URL (see GhidraURL) wrapper
where the URL is intended to refer to a DomainFile within another local or remote
project/repository.Container class for the user name and the permission type: READ_ONLY,
WRITE, or ADMIN.
Exception thrown when a user requests some operation to be performed
but does not have sufficient privileges.
This class holds information regarding a single user-added source file added
to a batch import session.
UserData is a marker interface for
DomainObjects used to store user-data associated with
another DomainObject.A class to manage and track Decompiler highlights created by the user via the UI or from a
script.
A system call that is defined by delegating to a p-code userop
A user-defined pcode operation (PcodeOp)
This is implemented as a name and a unique id which is passed
as the first parameter to a PcodeOp with the opcode = "CALLOTHER".
Base Class for all ghidra non-runtime exceptions
The interface for linking to
openpty via jnaRepresents a uuid_command structure
A loose concept that represents a line of text, potentially with multiple parts, that can
be validated against other instances and can change the color of the text.
The location of a value
Base class for managing data values that are accessed by an ordered long index key.
Associates an integer value with a numeric range.
Dialog for displaying and editing values defined in a
GValuesMap.Exception thrown when processing/parsing ValuesMap values.
Interface for validating values in a
GValuesMapA map that is sorted by value.
An interface with a subset of methods from
List.A variable with its semantic (and printing) value equal to a fixed
mapping of its pattern
A filter that selects function parameters that are considered optional.
Defines an object that stores a value of some specific data type.
An interface for marking table models whose supported columns are discovered at runtime
Generates StackVariableComment Fields.
The
VariableCommentFieldLocation class provides specific information
about the stack variable comment field within a program location.Database implementation of a Variable.
LayoutManger for arranging components into exactly two columns.
A panel that is scrollable and uses a VariableHeightLayoutManager that
deals with components of varying heights.
VariableLocation provides information about the location
on a variable within a Function.Generates VariableOffset Fields.
The
VariableLocFieldLocation class provides specific information
about the stack variable offset field within a program location.Generates VariableName Fields.
The
VariableNameFieldLocation class provides specific information
about the variable name field within a program location.VariableOffset can be used as an operand or sub-operand representation
object.Stores information about a variable in a program such that the variable can
be retrieved when needed.
VariableSizeException is thrown when a variable
data-type exceeds storage constraints.Symbol class for function variables.
Generates VariableType Fields.
The
VariableTypeFieldLocation class provides specific information
about the variable type field within a program location.Variable Cross-reference Field Factory
The
VariableXRefFieldLocation class provides specific information
about the variable's cross reference field within a program location.A handler to process
VariableXRefFieldLocation clicksField for showing Xref Headers for variables
VariousChoicesPanel provides a table type of format for resolving
multiple conflicts in one panel.Rawest possible Varnode.
Set of Varnode pieces referred to by a single Varnode in join space
as returned by Varnode.decodePieces
This type of Varnode is a node in an Abstract Syntax Tree
It keeps track of its defining PcodeOp (in-edge) and PcodeOps which use it (out-edges)
Container class for VarnodeAST's
All the resolved pieces of data needed to build a Varnode
A ValueSymbol where the semantic context is obtained by looking
up the value in a table of VarnodeSymbols
A feature representing a portion of the data-flow graph rooted at a particular Varnode.
A symbol representing a global varnode, i.e.
To change this generated comment edit the template variable "typecomment":
Window>Preferences>Java>Templates.
To enable and disable the creation of type comments go to
Window>Preferences>Java>Code Generation.
Placeholder for what will resolve to a Varnode instance given
a specific InstructionContext
Class for containing intermediate results of doing the LSHVector compare operation
Version provides immutable information about a specific version of an item.VersionControlAction is an abstract class that can be extended by each specific version
control action to be taken on a domain file.
Action to add a domain file to version control in the repository.
Action to check-in domain files to the repository.
Action to checkout domain files from the repository.
Action to undo checkouts for domain files in the repository.
Dialog to get comments for adding a file to version control or
checking in a file.
Action to show the version history for a single version controlled domain file in the repository.
Task to show a dialog to enter comments for checking in a file
Action to undo checkouts for domain files in the repository.
Action to undo hijacked domain files in the project.
Action to update the current checked out domain file to contain the changes
which have been checked in to the repository since our file's version was checked out.
Action to view the current checkouts for a single domain file in the repository.
VersionedDatabase corresponds to a versioned database.VersionedDBListener provides listeners the ability to be notified
when changes occur to a versioned database.Service that provides a Language given a name, and
information about the language.
Exception thrown when an object's version does not match its expected version.
VersionFileHandler allows a set of VersionFile's to be used in
the dynamic reconstruction of an older BufferFile.Panel that shows version history in a JTable
Version info that is inside of the VersionInfoTransferable;
must be serializable.
Defines a transferable
Represents a version_min_command structure
Deprecated, for removal: This API element is subject to removal in a future version.
A listener that allows clients to be notified of vertex clicks.
A listener called when a vertex is focused.
GraphActionContext for when user invokes a popup action on a graph vertex.
A class that knows how and where a given vertex was clicked.
Class for defining shapes to use for rendering vertices in a graph
An interface that can be implemented to provide vertex shapes to the UI.
Creates tooltips for a given vertex.
VerticalChoicesPanel is a conflict panel for the Listing Merge.LayoutManager for arranging components in a single column.
An implementation of
LayoutPixelIndexMap for vertical coordinatesThis class provides a TextField implementation that takes multiple FieldElements and places
each on its own line within the field.
Maps vertical pixel locations to layouts on the currently displayed screen.
Context for
VisualGraphsContext for
VisualGraph's satellite viewerA sub-feature that provides a satellite viewer to
VisualGraphComponentProvidersContext for a
VisualGraph when a vertex is selectedEvent for notifying plugins when the program view changes (what the
Code Browser shows in the listing window).
Records the current top of screen position of the viewer.
Listener interface for notification when the top of screen position changes.
Service to manage generic views; the view controls what shows up in the code
browser.
Utility class for managing the viewport in the
FVTable.Extension of the
ProjectAccessPanel that only shows the user access list.Base interface class for the view providers and view manager service.
Some constants for controlling traversal
A callback (
visit()) can return one of these constants to control whether or not
traversal continues.An edge that contains properties and state related to a user interface.
Basic class to calculate the position of an edge arrow
Edge render for the
VisualGraph systemThe primary interface for graphs that are to be rendered.
Usage Notes:
We clear state on mouseReleased() and mouseExited(), since we will get
at least one of those calls
Action context for
VisualGraphsA mouse handler to center a vertex when the header is double-clicked
A listener to get notified of graph changes.
A base component provider for displaying
VisualGraphsOverrides the
DefaultEdgeLabelRenderer so that the client can set the non-picked
foreground color.A renderer designed to override default edge rendering to NOT paint emphasizing effects.
An interface that represents a sub-feature of a
VisualGraphComponentProvider.A mouse plugin to handle vertex hovers, to include animating paths in the graph, based
upon the current
PathHighlightMode.The interface for defining functions provided that are additional to that of
Layout.An interface to provide a common set of methods for classes that could not otherwise
extend an abstract class.
A simple plugin that allows clients to be notified of mouse events before any of the other
mouse plugins.
A class that calculates flow between vertices and then triggers that flow to be painted
in the UI.
This is the class that controls which mouse plugins get installed into the graph.
This was created to add the ability to paint selected vertices above other vertices.
An implementation of
ScalingControl that allows us to zoom in and out of the view.Overridden implementation that allows us to change scaling behavior through options.
Note: this class is based on
TranslatingGraphMousePlugin.Context for a
VisualGraph when a vertex is selectedThe default
VisualGraph renderer.A view object, where 'view' is used in the sense of the Model-View-Controller (MVC) pattern.
This is the class through which operations travel that manipulate the view and graph while
plugged-in to the UI.
A handler to zoom nodes when double-clicked.
A vertex that contains properties and state related to a user interface.
A renderer for the
VisualGraph system.A renderer for vertices for the satellite view.
Special dataType used only for function return types.
Property manager that deals with properties that are of
"void" type, which is a marker for whether a property exists.
Property manager that deals with properties that are of
"void" type, which is a marker for whether a property exists.
A class to represent the VS_VERSION_CHILD data structure which generally corresponds
to either StringFileInfo or VarFileInfo.
A class to represent the VS_VERSION_INFO data structure.
A reusable watchdog that will execute a callback if the watchdog is not disarmed before
it expires.
Factory for creating containers to use in various threading environments
Other non-weak listeners:
ConcurrentListenerSet
Class for storing a weak reference to object instances.
Class to provide a hash map with weak values.
Class to provide a tree map with weak values.
Class for web color support.
Deprecated, for removal: This API element is subject to removal in a future version.
An enum used to signal where windows should be placed when shown for the first time.
After being shown, a window's location is remembered, so that values is no longer used.
Built-in GTheme that uses the Windows Classic
LookAndFeel and the standard (light)
application defaults.A class to represent and parse the
Windows new-style executable (NE) header.
Built-in GTheme that uses the Windows
LookAndFeel and the standard (light)
application defaults.A collection of window related utility methods
A dialog that controls the panels for going to "Next" and "Previous" in some
process that the user is being led through.
Interface to define methods for panels to be shown in the wizard dialog.
Listener that is called when something on the WizardPanel has
changed.
Provides a basic implementation of a word datatype
A simple object that represents a word as defined by
StringUtilities.findWord(String, int).Executes a single job at a time in FIFO order.
Defines methods for accessing a workspace; a workspace is
simply a group of running tools and their templates.
Listener that is notified when a tool is added or removed from a
workspace, or when workspace properties change.
WrappedMemBuffer implements a MemBuffer that provides a zero based index
on top of an underlying membuffer with at a given address.
Wrapper class for an object that represents a property value and is
saved as a set of primitives.
An implementation of
PeekableIterator that can take a Java Iterator and
wrap it to implement the PeekableIterator interface.Signals that the implementing table model is wrapping another table model.
An implementation of the
TaskMonitor interface that simply wraps a delegate task
monitor.A text field meant to take a string of text and wrap as needed.
An interface for writing out class state information.
Command object for performing 64-/32-bit x86 disassembly
The
ARHeader class is used to store the per-object file
archive headers.XCOFF File Header.
Names of "special" sections.
Class to support the "XDG Base Directory Specification"
A runtime exception that is throw when invalid
or missing attributes are encountered.
A container class for creating XML attribute strings.
Defines the method for creating an Object from an
XML file in a JarInputStream.
An XML based encoder
The underlying transfer encoding is an XML document.
An implementation of the basic interface for SAX error handlers.
An implementation of exporter that creates
an XML representation of the program.
A sub-class of MessageLog to handle appending messages from the XML parser.
Exception that gets thrown if there is a problem parsing XML.
A class to represent the start or end tag from an XML file.
A class to hold XML options.
A convenience class for creating a GProperties object from a file containing XML data
generated from
GProperties.saveToXmlFile(File)An interface describing the API for the XML pull parsing system.
A class to represent a corresponding start and end tag.
A set of utility methods for working with XML.
A class for creating XML files.
Form new expression by XORing two PatternExpressions
Solves expressions of the form
A $xor BDeprecated.
deprecated for 10.1; removal for 10.3 or later
Cross-reference Field Factory
The
XRefFieldLocation class contains specific location information
within the XREF field of a CodeUnitLocation object.A handler to process
XRefFieldMouseHandler clicksField for display XRef headers.
The
XRefHeaderFieldLocation class contains specific location information
within the XREF field header that precedes the XREF field locations.A class that paints a given image with varying zoom levels.
An action to zoom the image on a NavigableImagePanel.
An action to de-zoom the image on a NavigableImagePanel.
An action to reset the zoom of a NavigableImagePanel.
UpdateFunctionCommandorApplyFunctionSignatureCmd.