PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Guide to P-code Injection: Changing the intermediate representation of code on the fly in Ghidra

swarm.ptsecurity.com | research | #reverse-engineering | #ghidra | #research | #tooling
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A guide to Ghidra's p-code injection mechanism: for opcodes that are impractical to express in SLEIGH, Java callbacks can generate p-code dynamically at analysis time — illustrated by implementing V8's variable-argument CallRuntime opcode in the ghidra_nodejs plugin.
Published
Collected

Related coverage

research · volexity.com
Go Get ‘Em: Updates to Volexity Golang Tooling
# Go Get ‘Em: Updates to Volexity Golang Tooling August 11, 2025 Ivan Mladenov _This blog post was the final deliverable for asummer internship project, which was completed under the direction of...
tool · github.com
SuperGhidra: High-Performance Python Suite for Accelerated Ghidra Reverse Engineering
Drastically accelerates automated binary analysis and provides reliable mathematical verification for neural decompilers, bridging traditional reverse engineering with AI-driven workflows.
research · swarm.ptsecurity.com
Creating a Ghidra processor module in SLEIGH using V8 bytecode as an example
How PT SWARM built a Ghidra processor module in SLEIGH for V8 bytecode, gaining readable disassembly and a C-like decompiler for Node.js bytecode — covering the constant pool, p-code injections, analyzers and loaders that make the module work.
research · swarm.ptsecurity.com
Decompiling Node.js in Ghidra
Behind ghidra_nodejs: decompiling bytenode-protected Node.js applications in Ghidra by parsing the constant pool, function arguments and exception handlers, supporting all JSC opcodes including wide/extra-wide, and resolving cross-references even in obfuscated code.
research · swarm.ptsecurity.com
How we bypassed bytenode and decompiled Node.js bytecode in Ghidra
Part one of the ghidra_nodejs series: the V8 bytecode format and the bytenode scheme used to ship serialized .jsc binaries, and how the plugin parses, disassembles and decompiles them so otherwise opaque server-side JavaScript can be audited for vulnerabilities.
research · blog.quarkslab.com
BSIM explained once and for all!
Quarkslab finally explains Ghidra's BSIM internals: functions are lifted to normalized P-code, hashed into feature vectors, and compared to find semantically equivalent functions.
Back