ghidra-delinker-extension

ssembler peephole optimization), but with it my extension can delink the whole of Tenchu: Stealth Assassins without any manual annotations, just the regular references from the cleaned-up Ghidra database.

ging symbols generation. The results have been very promising, to the point where I can delegate the brunt of the work to it and stick to architecture design and code review. I've previously learned the hard way that the only way to keep this extension from imploding on itself was with an exhaustive regression test suite and it appears to guardrail the AI very effectively. Given that I work alone on this in my spare time, I have a finite amount of endurance and context and I was reaching the limits of what I could manage on my own. There's only so much esoterica about ISAs/object file formats/toolchains/platforms that can fit at once in one brain and some features (debugging symbols generation) were simply out of reach. Now, it seems that I can finally avoid burning out on this project, albeit at a fairly high rate of premium requests consumption. Interestingly enough, I've also experimented with local AI (mostly oss-gpt-20b) and it suffers from complete neural collapse when trying to work on this, probably because it's a genuinely difficult topic even for humans. [1] https://github.com/boricj/ghidra-delinker-extension

kshop at ACM CCS 2025 in Taiwan as a hobbyist, an absolutely insane story. [1] https://github.com/boricj/ghidra-delinker-extension

nsuited for scientific papers (it took all the might of Gemini and Copilot to even wring out something that vaguely resembles academic vernacular from my first draft). I've submitted it, exhausted and deeply unsatisfied by the compromises I've had to do under that severe time crunch. Then one month later, the reviews came in. The feedback was that the topic and my take on it were interesting; the criticisms can be summarized by saying that I've missed existing related work and it would've taken the long paper to address all the deficiencies in my paper. Fair I guess, but I definitely don't have that kind of spare time to spare on writing papers. But alongside the notification decision, something unexpected was also sent: an invitation by the program committee to present a poster at the ACM CCS 2025 conference in Taiwan. This is the kind of world-class conference with a $1800 entry ticket, happening in a convention center whose area is measured in hectares, attended by professional members of an academic, industrial or state organization, all expenses paid in a five star hotel room with a king bed. Somehow, a hobbyist who can charitably be described as a Doctor Frankenstein but with bits instead of gibs, who creates unholy chimeras of programs in his free time in spite of ABIs and common sense, received an invitation from the Hogwarts School of Witchcraft and Wizardry equivalent of the cyber-security academic world to present a poster. I can't even begin to express how utterly impossible this is. So of course I said yes and now I'm in a mad dash to get everything ready in time for the conference, three weeks from now. Bonus point: it's on the other side of the planet and in my entire adult life I've basically never got farther away than the next county (and groaning while doing so). There's even more to that story, but I'll leave it for a blog post once it's done. [1] Others call it unlinking, binary splitting or binary reassembly. [2] https://github.com/boricj/ghidra-delinker-extension

shenanigans. There's next to no literature on this and it's antithetical to anything one might learn in CS 101. The technique itself is as powerful as it is esoteric, but I like to think that any reverse-engineer can leverage it with my tooling. In particular, resynthesizing relocations algorithmically is one of those problems subject to the Pareto principle, where getting 80% of them right is reasonably easy but whittling down the last 20% is punishingly hard. Since I refuse to manually annotate them, I've had to relentlessly improve my analyzers until they get every last corner case right. It's by far the most challenging and exacting software engineering problem I've ever tackled, one that suffers no hacks or shortcuts. Once I got it working, I then proceeded in the name of science to commit countless crimes against computer science with it (some of those achievements are documented on my blog). Cross-delinking in particular, that is delinking an artifact to a different platform that it originates from, is particularly mind-bending ; I've had some successes with it, but I sadly currently lack the tooling to bring this to its logical conclusion: Mad Max, but with program bits instead of car parts. Ironically, most of my users are using it for matching decompilation projects: they delink object files from an artifact, then typically launch objdiff and try to create a source file that, when compiled, generates an object file that is equivalent to the one they ripped out of the artifact. I did not expect that to happen at all since I've built this tool to specifically not do this, but I guess when everything's a nail, people will manage to wield anything as a hammer.

anything's possible when you binary patch __usercall into MSVC. I should get back to it once work is less hectic. Delinking is an exquisitely intricate puzzle to solve algorithmically and I've managed to make that esoteric but powerful reverse-engineering technique not only scalable to megabytes worth of code, but also within reach of everyday reverse-engineers.

k to object files [1]), it's faster than a decompilation project because you merely need to figure out and undo all the relocation spots, but you don't get source code at the end. [1] https://github.com/boricj/ghidra-delinker-extension

I've originally built this as part of a video game decompilation project ; I've been working on this over the past 2.5 years and recently it has started gaining some users besides me.