Ghidra 11.0.2

The not-so-fine print: Please Read!
Ghidra 10.3 is fully backward compatible with project data from previous releases. However, programs and data type archives which are created or modified in 10.3 will not be useable by an earlier Ghidra version.
This release includes many new features and capabilities, performance improvements, quite a few bug fixes, and many pull-request contributions. Thanks to all those who have contributed their time, thoughts, and code. The Ghidra user community thanks you too!
IMPORTANT: Ghidra requires Java 17 JDK to run. A newer version of Java may be acceptable but has not been fully tested. Please see the Ghidra Installation Guide for additional information.
NOTE: Please note that any programs imported with a Ghidra beta versions or code built directly from source outside of a release tag may not be compatible and may have flaws that won't be corrected by using this new release. Any programs analyzed from a beta or other local master source build should be considered experimental and re-imported and analyzed with a release version. As an example, Ghidra 10.1 beta had an import flaw affecting symbol demangling that was not correctable. Programs imported with previous release versions should upgrade correctly through various automatic upgrade mechanisms. Any program you will continue to reverse engineer should be imported fresh with a release version or a build you trust with the latest code fixes.
NOTE: Ghidra Server: The Ghidra 10.3 server is compatible with Ghidra 9.2 and later Ghidra clients. Ghidra 10.3 clients are compatible with all 10.x and 9.x servers. Although, due to potential Java version differences, it is recommended that Ghidra Server installations older than 10.2 be upgraded. Those using 10.2 and newer should not need a server upgrade.
NOTE: Platform-specific native executables can be built directly from a release distribution. The distribution currently provides Linux 64-bit, Windows 64-bit, and MacOS x86 binaries. If you have another platform, for example a MacOS M1 based system or a Linux variant, the support/buildNatives script can build the Decompiler, demangler, and legacy PDB executables for your plaform. Please see "Building Ghidra Native Components" section in the the Ghidra Installation Guide for additional information.
Dark Mode / Theming:
Ghidra now supports UI theming, which allows for full customization of colors, fonts, and icons used consistently throughout the application. Ghidra themes are built on top of the various Java Look and Feel classes. Included are standard themes for all the supported Look and Feels. The most notable is the Flat Dark theme, which is built using the FlatLaf, a modern open-source flat Look and Feel library. Additionally, Ghidra includes various tools for editing and creating custom themes.
Also, all the main display windows (Listing, Decompiler, and Bytes Viewer) support quickly changing the font size via <Ctrl>+ or <Ctrl>-.
See the Ghidra Help pages for full details on the theming feature.
Debugger:
Perhaps the most exciting debugger change is the addition of new training course materials for the Debugger. The materials are written in Markdown so they display right on GitHub, but they can also be rendered to nice HTML pages by Pandoc for offline viewing. They are suitable both for self-paced learning and classroom environments. Even if you have used our Debugger before, we highly recommend reading these materials. They are in the docs/GhidraClass directory with the other course materials.
There are several changes to improve the user experience with the Emulator:
There is a dedicated Emulator tool. Previously, it was not apparent an Emulator GUI even existed in the Debugger tool. Most only accessed it via scripting. The Emulator tool is the same as the Debugger tool, but without the back-end debugger management plugins. This both showcases the Emulator and makes it safer to access, e.g., when examining malware. The launch buttons are removed, nearly eliminating the risk of accidental detonation.
The control actions (step, suspend, resume, etc.) have been moved to the main toolbar. When toggled to control the emulator, it is now possible to emulate to the next breakpoint. Before, it was only possible to step. If you were savvy, you could use the Go To Time action to run many steps, but you had to predict precisely how many steps. These controls present the Emulator as a more traditional trap-and-trace debugger and retain support for time travel.
Breakpoints are now applied to the Emulator. They also support injecting custom Sleigh semantics into the Emulator. This makes it possible, e.g., to stub out external function calls. Breakpoints are now displayed in the Decompiler margin, too.
Regarding uninitialized/undefined memory, the Emulator will still treat undefined bytes as zeros. When decoding an instruction; however, it will now interrupt if when encounters undefined bytes. Previously, it would just decode them as if zeros, which was never useful.
Nascent support for stack unwinding has been added. Up to now, we have relied on the back-end debugger to unwind the stack, which ruled out displaying accurate stack frames during emulation. There is still more work for full UI integration, but you can unwind a stack (whether on target or emulated) using the Debugger -> Analysis menu and view the results by navigating the Dynamic Listing to stack space. Please understand it may not work in most situations, yet.
Several miscellaneous actions have been added: To invalidate the Emulator cache, use the Debugger -> Configure Emulator menu. Use this whenever the Emulator seems to be ignoring configuration changes, especially when modifying custom Sleigh breakpoints. To display all bytes (not just changed ones) in the Dynamic Listing, choose Load Bytes from Emulator in the Auto-Read drop-down. To manually add or remove memory regions, e.g., to create and initialize a heap for emulation, use the new actions in the Regions window
There are several Debugger UI improvements:
The control actions are duplicated in the main toolbar. Previously, these were only in the Objects window. (They remain there for back-end connector/model development, troubleshooting, and diagnostics.) The actions in the main toolbar can be toggled to control a live target or the Emulator. The Emulator stepping actions have been removed from the Threads panel. (They never really made sense there.) Toggling these actions to the Emulator effectively forks an emulator from the target's live state, i.e., for extrapolation, just as the old emulator stepping actions did.
The current program counter is now displayed in the top right corner of the Dynamic Listing (or whatever the listing is configured to track). It will display in red if the address cannot be shown in the listing, e.g., because it is not mapped in memory. This provides better feedback when the listings seem to be out of sync.
GDB's advance command has been added to the Listing context menus as well as the equivalent actions for other debuggers. (More generally, any command provided by a back-end connector that takes a single address parameter is presented in context menus where an address is available.)
The Go To dialog in the Dynamic Listing can now take simple addresses in hexadecimal. Previously, it only took Sleigh expressions, which are powerful, but made the common case too complicated. It still accepts Sleigh expressions, and those expressions can now refer to labels (symbols) from any mapped program database (static image).
A new kind of hover has been added for displayed variables. If there is a debugger target (live or emulated) mapped to the current program, the hover will display the variable's current value. This applies to Listings and the Decompiler window.
You can now select a different thread, frame, or snapshot without activating it. Single-click to select. Double-click to activate.
There are a few small improvements to back-end debugger integration:
You can now set the working directory when launching a Windows target.
GADP agents now accept a single connection and automatically terminate when Ghidra disconnects.
Launch scripts have been added for starting a GADP agent from the command line.
There is now a script to build the Java bindings needed for the LLDB connector.
Decompiler:
Support has been added for expanding assignment statements on structures or arrays, where multiple fields or elements are moved as a group by a single instruction. This is especially helpful for analyzing structure initialization code and stack strings.
Support continues to improve for structures that are either stored across multiple registers or in a single register that is accessed in pieces. Data types associated with the component fields are propagated more fully throughout the function, and assignments to fields are displayed simply.
Data Types:
Data Type Archives may now optionally target a specific architecture as specified by a processor and associated compiler specification such as data organization. This has the advantage of better conveying datatype details for a desired architecture and preserving aspects which may change when resolved into a program. In the future, this will also allow function definitions to retain architecture-specific details.
Function definition data types have been improved to preserve calling convention names which may differ from the predefined generic calling convention names to include those which may have originated from an extended compiler specification. In addition, function definitions now support the noreturn attribute.
Enum handling has been improved in the data type manager when creating new enums from an existing set of enum values, for example define_ enums parsed from header files. Enum values will be automatically sized to fit all the values contained in the enum. Setting the size of an Enum will check if the values will fit within the new size. In addition, define_ values created as enums with a single value are sized to the minimum size to fit the value. Parsed enums from header files are sized based on the declared size of an int from the data organization used to parse. A future version will have a setting to size all parsed enums to the smallest size that will fit all the values.
C Header File Parsing:
The C-Parser GUI has been refactored to remove include paths from the Options section done as -D define lines, to a new Include section. This should make it easier to configure paths to the include files and has the added benefit of coloring the include file entries red if they are not found within any include path. You may find creating and using a Ghidra Script instead of the GUI an easier repeatable process. There are several included examples scripts, including ones to parse AVR8 header files, and Visual Studio version 22 files.
All supplied data type archive GDT files, except macOS, have been re-parsed to include the new processor architecture.
Mach-O Binary Import:
Mach-O binary analysis continues to improve. Support has been added for new file formats introduced in iOS 16 and macOS 13. Improvements have also been made to function identification, symbol detection, and Objective-C support.
Analysis:
New ApplyDataArchives analyzer settings enable use of locally created GDT data type archive files or project archives in the analysis pipeline. Used in conjunction with analysis options settings saved to a named analysis configuration you can easily switch to using a new GDT file and associated analysis options for a given type of binary. For example, if you are working with AVR8 binaries and have an associated AVR8.gdt file, create an AVR8 configuration and it will be used as the default analysis options configuration until you change to a new configuration.
Constant Propagation now deals with constants passed as stack parameters. In addition, there are several new settings which can better control when a constant is considered to be an address. For example, processors with small memory spaces, the setting Require pointer param data type, will only create a reference if the parameter is declared with a data type that would be a pointer. This can be useful for Harvard architectures with multiple address spaces used in conjunction with the PointerTypedef to specify the address space of the pointer. Currently, once you change the parameter of a called function to be a pointer, you will need to re-run analysis to get the constants passed to the function to be turned into a reference. This will be automated in the near future.
By default, pointer-to-pointer analysis is turned off for ARM binaries in the Operand and Data Reference analyzers. This can result in fewer references created and can be turned back on if your ARM binaries use pointers data stored in memory instead of offset values from the current PC to calculate all references.
Added support for PE MinGW pseudo-relocation processing.
Shared Projects:
Folder and file links to contents of another shared project repository may now be added to a Ghidra Project. This could allow a team to include a program or subfolder that resides in another project rather than copying the program into your project for easy access. The linked files are opened for read-only viewing.
Processors:
Improvements and bug fixes have been made to many processors since 10.2 to include: AARCH64, ARM, Coldfire, HCS12 MIPS X86, PowerPC, RISCV SPARC, SuperH, TriCore, V850, Z80, 6x09, 68K, and 8051.
Two new user-submitted processors, eBPF and BPF, add support for two variants of Berkeley Packet Filter binaries.
A user-submitted refactoring of X86 LOCK/UNLOCK decoding and semantics has been committed. There are currently some issues with the Decompiler re-arranging code outside of the LOCK/UNLOCK which will be addressed with an upcoming patch. If your analysis depends on the LOCK/UNLOCK semantics, please be aware of the issue.
A new leading zeroes count operator, called lzcount, has been added to p-code, and it can now be used by SLEIGH developers to model processor instructions. The Decompiler can simplify common code idioms using these instructions, and emulation is supported.
User Interface Improvements:
Diff can now be performed between two open programs which may include remote files previously opened via a Ghidra-URL.
GoLang 1.18 Support:
An importer, Analyzer, and Internal changes have been made to support GoLang. Currently, only version 1.18 is supported; however slightly older or newer versions may work. There are still some Decompiler issues with multiple return parameters to be worked out, however the implementation was thought complete enough for initial real use. Please consider the feature an evolving initial implementation.
Ghidra Startup:
Ghidra now remembers the last location of a program when it is closed. When that program is later re-opened, Ghidra will position the program to that location. Also, there are options for where Ghidra should start for new programs and optionally when Ghidra completes the initial analysis.
Template Simplification:
Ghidra now has options for simplifying the display of symbol names, in both the Listing and Decompiler, with complex template information embedded in them. The simplification should result in a much less busy display when dealing with templates.
Additional Bug Fixes and Enhancements:
Numerous other bug fixes and improvements are fully listed in the ChangeHistory file.

New Features:
Analysis. Initial Golang binary analysis for Go 1.18. (GP-2114, Issue #2327)
Debugger. Added breakpoint indicators to the Decompiler's margin, when used in the Debugger. (GP-1280)
Debugger. Added Debugger control actions to global toolbar. (GP-1595, Issue #3742)
Debugger. Created new independent launchers for Debugger agents. (GP-1999)
Debugger. Added ability to set node timeout. (GP-2502)
Debugger. Added class materials for the Debugger. (GP-2641)
Debugger. Added hover tooltips for variable values in the Static Listing, Decompiler, and Dynamic Listing. Added Unwind Stack action. (GP-2834, Issue #4732)
Debugger. Added ability to set initial directory and other parameters. (GP-2839, Issue #4732)
Debugger. Added a dedicated Emulator tool. (GP-3074, Issue #4931)
Debugger. Added ability to export/serve symbols and types as Volatility ISF JSON. (GP-3222)
Debugger:Emulator. Added Invalidate Emulator Cache action. (GP-2970)
Debugger:Emulator. Added Add Region and Delete Regions actions to the Regions window. (GP-3357)
Debugger:Objects. Added commands Advance to GDB, Step/Trace to Address to dbgeng/model, and Run to Address to LLDB in address context menus. (GP-1808, Issue #4056)
DWARF. Added support for some Apple-specific DWARF tags. (GP-3175)
GUI. Added theming support to Ghidra, including a dark theme. (GP-1981, Issue #4145)
GUI. By default, programs will now open to their location when last closed. (GP-2939, Issue #1196)
Pcode. Support for a new p-code operator lzcount has been introduced into SLEIGH, the Decompiler, emulation, etc. It returns the count of leading zero bits in its operand. (GP-3155, Issue #2810)
Processors. Added eBPF and BPF processors. (GP-2257, Issue #4258, #4378)
Project. Added Restore Previous Project option to the Front End Tool that controls whether or not the previously opened project is automatically restored on startup. (GP-2695, Issue #4650)
Scripting. Created AssociateExternalPELibrariesScript that associates imported library files for PE programs in order to fix up external references from the program to the libraries. This is useful for users who forgot to load the libraries on program import and want to fix up the references after the fact. (GP-3098)
Version Tracking. Updated the Version Tracking API to make extension of correlators easier. (GP-3199, Issue #4950)
Improvements:
Analysis. Added support for pointer Typedef values passed as parameters to functions. (GP-2160)
Analysis. Added identification and side-effect fixes for windows AARCH64 __security_push_cookie to fix poor Decompiler and stack reference results. (GP-3124, Issue #5018)
Analysis. Added support for processing PE MinGW pseudo-relocations during auto-analysis immediately after import. (GP-3236, Issue #5155)
API. Added ability to associate a specific program architecture with a datatype archive. This allows associated types to preserve proper type sizing and alignment characteristics based upon a designated architecture. Delivered archives will reflect the architecture they were created with instead of utilizing the default data organization. (GP-1633, Issue #4898)
API. Changed FunctionDefinition and FunctionSignature to use calling convention names as strings instead of being limited to GenericCallingConvention. Also added noreturn support to these interfaces. (GP-2308, Issue #3267, #4537)
API. Added methods to TaskMonitor to address spelling inconsistencies. (GP-2982, Issue #4870)
API. Revised program Relocation table to include status and a more accurate length of affected bytes when applied. (GP-3013)
API. Added by-name index method SymbolTable.scanSymbolsByName(String startName). This has been utilized by the assembler UI to resolve a hang on large programs. (GP-3015, Issue #2630)
Basic Infrastructure. Upgraded dependencies to guava 31.1-jre (from 19.0), baksmali 2.5.2 (from 1.4.0), and dex2jar 2.1 (from 2.0). (GP-3154)
Basic Infrastructure. Improved error handling of module directories not being readable during launch. (GP-3347, Issue #5244)
Build. Added support for building with Gradle 8. (GP-2476, Issue #3527, #5003)
Build. The build now enforces a maximum-supported Gradle version. The current supported versions are Gradle 7.3 or later. (GP-3111)
Build. Ghidra can now run from development/repository mode using Gradle's compiled jars, instead of just relying on Eclipse's compilation output. (GP-3140)
C Parsing. Provided GDT archives have been updated to include new ProgramArchitecture settings for processor, data organization, and endianess. (GP-1377)
CParser. Removed unnecessary -D defines related to wchar_t from CParser prf files and GDT parsing scripts. (GP-3294, Issue #5196)
Data Types. Function definitions can now be applied from selected Category instead of only from an entire Archive. (GP-199)
Data Types. Changed Structure/Union editor to show numbers in hex format by default. Also added Shift-H keybinding action for toggling hex/decimal view. (GP-2943)
Data Types. Improved DataTypeParser to handle type names which include the :: namespace delimiter. (GP-3003, Issue #4841)
Data Types. Changed Apply Data Archives analyzer to allow user to choose a data type archive to apply to their binary during analysis. (GP-3344, Issue #5184)
Debugger. Added option to memorize a program-module association when confirming mapped modules. (GP-1527, Issue #3641, #3675)
Debugger. Improved the Go To... dialog. It now accepts simple addresses or Sleigh expressions. (GP-1539)
Debugger. Removed Guava from Debugger's dependencies. (GP-1542)
Debugger. Replaced Guava's Cache. (GP-1545)
Debugger. Improvements to allow dbgmodel kernel debugging. (GP-1768)
Debugger. Upgraded protobuf to 3.21.8. (GP-2302, Issue #4415, #4540)
Debugger. Improved default connector selection, based on current program and last successful connection. (GP-2623)
Debugger. Added remote connectivity for LLDB. (GP-2709)
Debugger. Made modifications in support of iPhone work. (GP-2870)
Debugger. Better instructions for LLDB/Swig. (GP-3055, Issue #4774)
Debugger. Made LLDB-related improvements in support of iPhone work. (GP-3063)
Debugger. Changed refresh option from boolean to RefreshBehavior enum to allow opportunistic use of caches. (GP-3142)
Debugger. Providing convenience script for LLDB builds. (GP-3247, Issue #5061)
Debugger. Changed Go To Time action to use the Time selection dialog. (GP-3317)
Debugger:Agents. Limited debug agents to accept a single GADP connection and to terminate automatically when disconnected. (GP-1976)
Debugger:Agents. API: Removed TargetObject.add/removeListener() in favor of DebuggerObjectModel.add/removeModelListener(). (GP-2752)
Debugger:Agents. Enable opportunistic uses of caching. (GP-3162)
Debugger:Breakpoints. Breakpoints window can now interact with the integrated emulator. It also supports custom Sleigh injections or conditions. (GP-2676)
Debugger:Emulator. Dynamic views can now show (lazily) loaded bytes for pure emulation. (GP-2989)
Debugger:Emulator. Moved new Emulator into its own module. (GP-3071)
Debugger:Listing. Added visual indicator when PC (or other tracked location) is not located in the listing. (GP-2750)
Debugger:Registers. Changed Registers and Watches to use pointer typedefs. This allows a user to specify the target space of a pointer, especially in Harvard architectures. (GP-2653)
Debugger:Registers. Added consideration for aliases when matching target registers to Ghidra registers. (GP-2966)
Debugger:Threads. Changed Threads, Stack, and Time panes to require double-click to activate the selection in the rest of the UI. (GP-3018)
Debugger:Trace. Replaced Range<T> with Lifespan, ULongSpan, KeySpan, FieldSpan, etc. (GP-1543)
Decompiler. Compiler specification (cspec) files allow more flexibility when describing overlapping parameter-passing storage locations. (GP-2544, Issue #4568)
Decompiler. Decompiler analysis of functions with multiple switch statements is substantially faster in many cases. (GP-2560, Issue #4558)
Decompiler. The Decompiler can now split a copy operation that simultaneously moves multiple fields in a structure or multiple elements of an array. (GP-2563, Issue #3884)
Decompiler. The Decompiler propagates constants, in more situations, into blocks that are executed conditionally. (GP-2603, Issue #4527)
Decompiler. Added DecompilerStackProblemsFinderScript, which searches the decompiled code for certain local variables that can be indicators of stack analysis issues. (GP-2697)
Decompiler. Added Decompiler actions to convert constants to Double and Float. (GP-3001, Issue #3689)
Decompiler. The Decompiler's Rename actions now allow the user to reclaim an automatically generated name on another symbol. (GP-3224, Issue #4863)
Diff. Added ability to initiate a Program Diff with another program selected from a list of compatible open programs already open in the tool. (GP-2897)
DWARF. Added support for ELF-compressed sections. (GP-2363, Issue #3659, #4460)
Eclipse Integration. Eclipse now recognizes test source folders. (GP-3130)
ELF. Added support for tagging ELF informational sections. Added support for Golang metadata in ELF binaries. (GP-2111)
Exporter. The PE and ELF exporters have been replaced by a new Original File Exporter that will work on all programs that store original file bytes. The Original File Exporter has an option to export both user-modified bytes as well as original bytes. (GP-2770)
Graphing. Upgraded jungrapht-visualization and jungrapht-layout to version 1.4. (GP-3249, Issue #5156)
GUI. Improved support for Ghidra URLs and their use in comment annotations. (GP-2509)
GUI. Updated the Navigation History Plugin's maximum history limit. (GP-2843)
GUI. Improved table-sorting performance. (GP-2908, Issue #4782)
GUI. Updated the Structure Editor to maintain the table selection during external updates. (GP-2945, Issue #4820)
GUI. Added new feature where programs can automatically go to a newly discovered start symbol (e.g., "main") after analysis completes. If the user has navigated to another program location before analysis completes, a popup dialog will appear asking if the user would like to go to the new symbol. Both of these behaviors can be turned off via the Navigation tool options. (GP-3064)
GUI. Added ability for default tool launch (e.g., project file double-click) to reuse existing tool instead of always launching a new tool. This behavior controlled via Project Window Default Tool Launch Mode option. (GP-3080)
GUI. Updated the Memory Map table to use a fixed-width font for the Start, End, and Length columns. (GP-3103)
GUI. Updated Create Enums From Selection action to handle duplicate-named enum entries when merging selected enums together into a new enum. (GP-3204, Issue #5036)
GUI. Added a Front End tool option to disable application-wide tooltip popups. (GP-3254, Issue #5095)
GUI. Fixed several issues with enums and the GUI for editing them. The API supported both unsigned and signed enums, but the GUI only supported unsigned enums. Also added extra checking so that enums can't support negative values and large unsigned values at the same time. (GP-3255, Issue #3806)
GUI. Clicking a sound icon in the Listing will now stop any currently playing sound. (GP-3393, Issue #5278)
Importer. Headless Ghidra and the AutoImporter API now support loading more than one program, such as when importing a program results in additional libraries getting loaded. (GP-2877, Issue #4929)
Importer. The OMF Loader now handles LPUBDEF symbols. (GP-2976, Issue #4854)
Importer. The OMF Loader now handles unsupported/unknown record types more gracefully. (GP-2997, Issue #4856, #4857)
Importer. Improved GZF/GDT import and export to allow unforced upgrade of older files. This is particularly important when a user has a version-sensitive issue and needs to have the project file triaged. (GP-3034)
Importer. The OMF Loader now handles CEXTDEF symbols. Known functions are now also created by the OMF loader to improve analysis. (GP-3117, Issue #4912)
Importer. Made improvements to the OMF Loader's relocation handler. (GP-3141, Issue #4909)
Importer. Improved support for loading old-style DOS MZ binaries. (GP-3353, Issue #5229)
Importer:ELF. Eliminated the public mutability and writing of ELF Headers whose implementation is not well suited for this in the absence of any ELF Linker support or related processor extension API. (GP-3152)
Importer:Mach-O. Mach-O external libraries are now linked during analysis. (GP-2602)
Importer:PE. The PE Loader has been updated to correctly recognize and mark the program compiler ID for MinGW programs. GNU Demangler has been updated to recognize and run on programs with GCC compiler option. (GP-1851, Issue #2208, #4513, #4514, #4520, #4906, #5155)
Importer:PE. The PE Loader can now load sections that extend beyond the end of the imported file without error. (GP-2826, Issue #4705)
Importer:PE. The PE Loader no longer rebases images to 0x10000 when the preferred image base is very large. (GP-2827, Issue #2361, #4710)
Importer:PE. Improved PE header parsing so binaries with corrupt symbol/string tables do not prevent Ghidra from recognizing them as PE. (GP-2973)
Jython. Improved Python interpreter code-completion behavior. (GP-2759, Issue #4678, #4699)
Languages. Reverted disassembly of x86 two-byte xchg ax,ax back to nop. (GP-3372)
Listing. Added Simplify Template Names option (on by default) to simplify symbol and datatype names with complex template info as part of their name. This only affects the Listing display and doesn't affect the actual symbol or datatype name. (GP-388)
Listing. Added options for the starting location of a program when it is opened, which will move the location to a specific function or label. See Preferred Symbol Name under the Navigation tool options. (GP-2141, Issue #4267)
Listing. Changed overlapping markers to blend rather than occlude. (GP-2723)
Multi-User. The Ghidra Server's temp directory can now be controlled by setting the WRAPPER_TMPDIR variable in ghidraSvr(.bat). (GP-3053, Issue #4925)
Multi-User. Upgraded YAJSW to 13.09. (GP-3119)
Processors. Corrected treatment of x86 LOCK prefix. (GP-2487, Issue #4336)
Processors. Added support for ARM v4T and v5T bl lr and blx lr pseudo-instructions. (GP-2872, Issue #4320)
Project. Added support for Ghidra-URL-linked project files and folders. Copy/Paste-Link actions are added to project file tree when copying from viewed repository or another project. (GP-2644)
Prototypes. PrototypeModel.getReturnAddress() now returns the default return address of the compiler spec when a prototype does not define its own. (GP-2612, Issue #4611)
Scripting. The RecoverClassesFromRTTIScript has been updated to recognize and process Windows PE programs compiled with GCC (i.e., MinGW, Cygwin programs). (GP-1856)
Scripting. The RecoverClassesFromRTTIScript has a few improvements for GCC-compiled programs. (GP-2679, Issue #4414)
Scripting. Added the RTTI Found RTTI Analyzer option to the program information, which is used to determine whether to rerun the analyzer and also to decide whether to run the RTTI script. (GP-3293)
Sleigh. Improved Sleigh compiler warning and error messages. (GP-2913, Issue #4595)
Bugs:
Analysis. Removed check for instruction falling into a location being considered for a shared return function. (GP-3044)
Analysis. Added support for stack parameter tracking, PointerTypedef parameters, restrictions of parameter values to known pointer parameters, and a prototype-setting for propagation of pointer parameter types to memory. (GP-3077)
Analysis. Fixed deadlock in Arm Analyzer waffling between overriding the return instruction as a return and branch. (GP-3150)
Analysis. Removed duplicate references placed on different operands of instructions. (GP-3214)
Analysis. Fixed issues related to analysis flag and how it affects asking the user to analyze a new program. (GP-3282)
Analysis. By default, pointer-to-pointer analysis is turned off for ARM binaries in the Operand and Data Reference analyzers. This can result in fewer references created, and can be turned back on if your binaries use pointer data in memory instead of offset values from the current PC. (GP-3335)
API. Fixed bug on pinned symbols when changing image base. (GP-3178, Issue #4290)
API. Revised ApplyFunctionSignatureCmd to allow use where function should not get renamed when signature applied. (GP-3350)
Byte Viewer. Fixed bug in Byte Viewer where the last byte in a block could not be selected if the field group size was larger than 1. (GP-1593)
CParser. Fixed parsing of Windows wdm.h header file with multi-line strings passed as arguments to a macro. (GP-2809, Issue #4690)
CParser. CParser.parse(String) method no longer throws an exception, and, when parsing a structure as a string, the return type will be the structure—not the last member of the structure. (GP-3183, Issue #4903)
CParser. Removed wchar_t as a keyword when parsing header files. wchar_t will always use the built-in wchar_t datatype even if defined with a typedef within a header file. (GP-3215, Issue #5108)
CParser. Fixed issue with CParser creating #define enum values if unsigned long is specified with parentheses around the value; for example, #define X (4ul). (GP-3216, Issue #5069)
CParser. Pressing Cancel during parsing of header files is now more responsive. (GP-3284, Issue #5181)
CParser. Enum constants are now created by the CParser when #define expressions ending in ULL, LLU, LL, and LU are found in parentheses. (GP-3285, Issue #5161)
CParser. Fixed expansion of #define statements embedded in #include files and parsing of constants with UL/LL size specifications. (GP-3310, Issue #5207)
CParser. Fixed CParser issues with forward-declared Enums and typedefs used within the body of functions. (GP-3371, Issue #3526, #5271)
CParser. Enum sizes are now set to the size of an int for the processor (formerly 4), and enums from #defines are set to the the smallest enum size that will fit the number (formerly 8). Future change will add packed enum sizes. (GP-3385)
Data. Corrected handling of zero-length components in the form of Listing DataComponent CodeUnits. These were incorrectly reporting a length of 0 instead 1; all Listing Data, including DataComponents, must report a positive non-zero length. (GP-3314)
Data Types. Automatically created class structures now respect the Preferred Root Namespace Category property. (GP-1123, Issue #3196)
Data Types. Added support for floating-point data types to parse decimal string representation. A significant refactor of FloatFormat and BigFloat was completed. BigFloat is now used as the value class for all float data types. Introduced DataType.getAlignedLength() method which was needed to differentiate between the raw encoding size and the aligned (i.e., padded) size used by a compiler when allocating storage (i.e., sizeof). Example: for x86-32 gcc, 80-bit float has an aligned-length of 12-bytes which reflects compiler's sizeof(long double). (GP-1379)
Data Types. Corrected 80-bit floating point support to include decode, encode, and computation via the FloatFormat and BigFloat support classes. (GP-3022, Issue #4853)
Debugger. Fixed issue with default renaming of traces when auto-saving with conflicting names. (GP-1484)
Debugger. Fixed bug in refresh logic. (GP-1884)
Debugger. Fixed various errors in breakpoint logic for dbgeng/model. (GP-2177)
Debugger. Fixed occasional stack trace in auto-saving traces when closing Debugger. (GP-2732)
Debugger. Miscellaneous fixes for LLDB agent. (GP-2781)
Debugger. Provided greater flexibility with library load error messages. (GP-3012)
Debugger. Emulate Program and Map Identically actions now exclude EXTERNAL block. (GP-3087)
Debugger. Removed Tool Options: Colors sections from Debugger help. (GP-3218)
Debugger:Agents. Fixed some issues with GADP agent no-dep jars. (GP-1007, Issue #3076)
Debugger:Agents. Fixed a NullPointerException in GadpValueUtils. (GP-2915, Issue #4791)
Debugger:Agents. Fixed GADP connectors to use the same JRE/JDK as Ghidra. (GP-2979)
Debugger:dbgeng.dll. A register modification now updates the Stack and other windows. (GP-2636)
Debugger:Emulator. The emulator will now halt when trying to decode an instruction from uninitialized memory. (GP-1529)
Debugger:Emulator. Fixed Emulator for processors that use crossbuild. (GP-1904)
Debugger:Emulator. Removed 4 unnecessary classes in emulator: RequireHasKnownTraceCachedWriteBytesPcodeExecutorState, RequireHasKnownTraceCachedWriteBytesPcodeExecutorStatePiece, RequireIsKnownTraceCachedWriteBytesPcodeExecutorState, and RequireIsKnownTraceCachedWriteBytesPcodeExecutorStatePiece. (GP-3280)
Debugger:GDB. Fixed missing stack frames when single-stepping. (GP-1470)
Debugger:GDB. Fixed unnecessary error popup when user rejects HostKey while connecting to GDB via SSH. (GP-1710)
Debugger:GDB. Fixed Erase In Line ANSI escape decoding issue for GDB on Windows. (GP-3135, Issue #3562, #5026)
Debugger:GDB. Fixed issue launching binaries in GDB with spaces in the path. (GP-3311, Issue #5203)
Debugger:Listing. Fixed a bug where closing a cloned Dynamic Listing resulted in an extraneous stale PC marker in the Static Listing. (GP-2991)
Debugger:Mappings. Map Identically and Map Manually actions will now refuse to overwrite existing mappings. (GP-3086)
Debugger:Trace. Fixed a bug that allowed the user to undo a trace's initial transaction. This would lead to a subsequent NullPointerException. (GP-3213)
Debugger:Trace. Fixed issue with Undo not being effective immediately. (GP-3358)
Decompiler. Fixed a Decompiler decoding error that occurred when a pre-comment contained a null character. (GP-3002, Issue #4836)
Decompiler. Line breaks in Decompiler output can no longer disable a comment annotation. (GP-3029)
Demangler. Fixed missing use of wchar_t, wchar16, and wchar32 primitives in Demanglers. (GP-3184, Issue #5080)
Documentation. Made minor fixes and improvements to the Advanced Ghidra training class documentation. (GP-2944)
ELF. Corrected ELF MIPS Relocation processing for R_MIPS_32. Added support for R_MIPS_PC21_S2 and R_MIPS_PC26_S2. (GP-3260, Issue #5160)
Exporter. Corrected operand formatting issues with ProgramTextWriter, which affected HTML/ASCII exports. (GP-1868, Issue #793)
Framework. Fixed an IllegalStateException that occurred while refreshing the Bundle Manager after the Code Browser tool had been closed. (GP-2711, Issue #4656)
Graphing. Changed default Call Graph action to always use the isolated entry block model, which will give the best results most of the time. (GP-3250, Issue #5157)
Graphing. Fixed stack trace when reusing graphs. (GP-3399)
GUI. Updated tables to correctly take focus when pressing F2 to start an edit. (GP-366)
GUI. Fixed issue where add/edit label dialog would grow ridiculously large. (GP-543)
GUI. Improved function-signature-parsing within Function Editor dialog to handled sized pointers. (GP-1100, Issue #3178)
GUI. Fixed bug where symbol tree category nodes could not be closed when there was a filter in place. (GP-2187)
GUI. Updated the Data Type Manager tree to maintain the tree selection when opening an archive for editing. (GP-2423)
GUI. Fixed the Enum Editor to allow sorting on the Comments column. (GP-2776, Issue #4693)
GUI. Updated the Equates Table to allow multiple selection. (GP-2887, Issue #4771)
GUI. Added rapid Ghidra Server timeout during initial connection to avoid lengthy connection delay when the server system is offline. (GP-2935)
GUI. Added support for HTML rendering in TableChooserDialog. (GP-2996, Issue #4880)
GUI. Fixed bug that prevented editing of function variable data types in the Edit Function dialog. (GP-3115, Issue #4970)
GUI. Updated the Function Signature dialog to allow editing the parameter table using only the keyboard. (GP-3173, Issue #3561)
GUI. Fixed bug where scroll bar didn't appear when the view size was just slightly smaller than the actual text to be displayed. This affected the Listing, Bytes, and Decompiler views. (GP-3202, Issue #3938)
GUI. Added the ability to copy details from the Missing Processor Manual dialog. (GP-3205, Issue #4218)
GUI. Fixed issue where opening multiple file datatype archives with the same name would not appear in the Datatypes tree. (GP-3281)
GUI. Changed function custom storage editor to permit larger storage to be specified. Undefined datatype size will expand to match storage size up to 8 bytes. (GP-3286, Issue #4983)
GUI. Fixed bug in Plate Comment that caused truncation during word wrapping. (GP-3403, Issue #5297, #5298)
Headless. Fixed a bug that caused a program to have an invalid Executable Location property when the program was imported headlessly from a relative path. (GP-3054)
Importer. The OMF Loader now parses COMMENT_CLASS_LIB correctly. (GP-3118, Issue #5016)
Importer. Fixed an issue that could cause the Importer to not respect the Load System Libraries From Disk and Load Local Libraries From Disk options if the Perform Library Ordinal Lookup option was used. (GP-3272, Issue #4849)
Importer:ELF. Corrected ELF Loader issue which could improperly set memory blocks as read-only. (GP-2730)
Importer:ELF. Added support for ELF X86-64 GOTPCREL relocation processing. Revised ELF relocation processing context API to utilize a single instance per import instead of one per relocation table. (GP-2984, Issue #4859)
Importer:ELF. Corrected ELF Loader issue with INIT/FINI array processing when entries have relocations applied. (GP-3176, Issue #5039)
Importer:ELF. Changed ELF relocation processing to avoid creating offset-pointers in memory blocks whch have execute permission or for section based relocations. (GP-3339, Issue #5238)
Importer:Mach-O. Fixed Mach-O external symbol namespace issues that prevented demangling. (GP-2511)
Importer:Mach-O. Fixed an exception that could occur while parsing DYLD chained fixups in some Mach-O binaries. (GP-3151)
Importer:Mach-O. Fixed a bug that prevented the Mach-O loader from finding and loading libraries that reside in a Universal Binary file. (GP-3167)
Importer:Mach-O. The Mach-O Loader now correctly handles DYLD_CHAINED_PTR_64_OFFSET fixups. (GP-3194, Issue #4986)
Importer:Mach-O. Fixed an exception that occurred when importing Mach-O PowerPC binaries with relocations. (GP-3259)
Importer:PE. Added a PE Loader Show Debug Line Number Comments option to show/hide debug line number comments. (GP-714, Issue #1184)
Importer:PE. Fixed some issues with parsing Windows Dialog resources. (GP-2821, Issue #3807, #3808)
Languages. Added the HALT instruction to the Coldfire processor. (GP-3326, Issue #5194)
Multi-User. Corrected issue where shared project creation would retain canonical server name instead of the original, specified hostname. (GP-3050, Issue #4924, #4928)
Multi-User. Corrected issue which disallowed Ghidra Server user IDs starting with a 0–9 digit. (GP-3121)
PDB. Overriding overzealous thunk detection on function creation when PDB knows better. (GP-3127)
PDB. Stubbed in some structures to represent class Member Pointers. Details need to be determined with future research. (GP-3171, Issue #5055)
PDB. A function is now created for a global label only if there are function indicators; otherwise, only a label is applied. Reverts the forced-function creation part of GP-2505. (GP-3200)
PDB. Fixed PDB handling of same-named __unnamed anonymous data types with different definitions used within a common structure. These could be emitted by VS 2005. (GP-3279)
Processors. Fixed issues with M68000 shift and rotate instruction behavior. (GP-2013, Issue #4217)
Processors. Added missing x87 FDESI, FENI, FNDESI, and FNENI instructions. (GP-2093, Issue #4262)
Processors. Added support for SuperH fsrra, fsca, and movua.l instructions. (GP-2374, Issue #4210)
Processors. Added extended floating point instructions to V850 processor. (GP-2565, Issue #4453, #4481)
Processors. Corrected 6809 and H6309 processors Jump address calculations and fixed issue with Extended Address bit-pattern disassembly. (GP-2650, Issue #4630)
Processors. Corrected addresses for ARM Cortex interrupt vectors. (GP-2706, Issue #4638)
Processors. Added support for MIPS DSP instructions. (GP-2775, Issue #4526)
Processors. Fixed operand ordering for M68000 abcd and sbcd instructions. (GP-2880, Issue #4183, #4189)
Processors. Fixed regression in x86 with disassembling the pause instruction. (GP-2892)
Processors. Corrected semantics for TriCore nor.t instruction. (GP-2895, Issue #4775)
Processors. Corrected issues in the SPARC language involving delay slots and ordering. (GP-2932, Issue #4805)
Processors. Corrected implementation of PowerPC fsel instruction. (GP-2937, Issue #4664)
Processors. Fixed semantics of 65C02 TRB and TSB instructions. (GP-3039, Issue #4921)
Processors. Fixed operand parsing of ARM Neon vld and vst instructions. (GP-3043, Issue #4814)
Processors. Corrected x86 MOV REX, MOFFS64 disassembly with address size prefix. (GP-3078, Issue #4942)
Processors. Corrected x86 FBLD instruction semantics. (GP-3079, Issue #2427)
Processors. Fixed ARM neon VMOV.U16 instruction decode. (GP-3096)
Processors. Fixed issue with ARM Thumb push {register_list} not disassembling when the last two registers in the list are r2 and r3. (GP-3132, Issue #5024)
Processors. Supplied additional register field support to AARCH64 MSR instruction. (GP-3156)
Processors. Fixed issue with ARM Thumb Neon vqdmull instruction not disassembling. (GP-3157, Issue #5053)
Processors. Fixed issue with HCS12 TSTA instruction not clearing carry flag. (GP-3169, Issue #5067)
Processors. Fixed issue with M68000 processor having a varnode of zero size. (GP-3187, Issue #5093, #5094)
Processors. Corrected RISC-V jal/jalr instructions to be a call instead of goto, when link register is T0. (GP-3217, Issue #5092)
Processors. Fixed PowerPC branch-conditional-and-link semantics for assigning LR register. (GP-3341, Issue #5218)
Processors. Fixed stack alignment in x86 far call instructions (GP-3398, Issue #1715, #1723)
Scripting. Fixed an issue that prevented the default script log file from getting used in the user's .ghidra directory. (GP-2936)
Scripting. Fixed a bug in FlatProgramAPI.getLastInstruction(). (GP-3198, Issue #5090)
Scripting. Improved how the interactive Python interpreter handles transactions. This fixed an uncaught exception that occurred when GhidraScript.openProgram() was called. (GP-3321, Issue #5215)
Search. Increased performance related to Search Results table markers. (GP-2828)
Search. Fixed exceptions in ReferenceUtils when searching for structure members with no size. (GP-3283)
Search. Fixed bug that caused search highlights to sometimes disappear from the Listing when the user moves the cursor. (GP-3329)
Sleigh. Addressed a bug in the SLEIGH compiler that allowed inconsistent exporting of sizeless varnodes. (GP-3186)

Improvements

Debugger:Listing. Refresh button in Debugger's Dynamic Listing and Memory Bytes views now operates without a selection and is more thorough with respect to cache invalidation. (GP-1930)
Bugs

Analysis. Fixed an exception that occurred when loading programs created in previous versions where the analysis option's type had changed (String to Long). (GP-1738)
Analysis. Constant reference propagation now uses pcode injection for segment and all userops. This affects 16-bit code and the HCS12 processor. (GP-1987, Issue #4252)
C Parsing. Added C-Parser support for static_assert and _Static_assert keywords. (GP-1958, Issue #4038)
C Parsing. Corrected C-Parser to parse sizeof structure members, both sizeof(ptr->member) and sizeof(struct.member). (GP-1964, Issue #4173)
Decompiler. Fixed bug causing the Decompiler to not label pointer references to the first parameter on the stack. (GP-2018)
GUI. Fixed bug that caused some edited functions to appear twice in the Functions window. (GP-2025)
GUI. Fixed potentially slow computer name lookup in the Error Dialog. (GP-2034)
Importer:COFF. Fixed importing of non-Microsoft COFF files when any section crosses address 0x80. COFF sections marked as data that won't fit into the default data address space will be loaded in the code address space. (GP-2045)

New Features:
Scripting. Created an example script which demonstrates how to use the FileBytes class to do a binary export of the current program. (GP-1157)
Improvements:
Data Types. When creating a substructure from existing components, the new structure will adopt the pack setting of the parent structure from which it was created. Note that a packed structure may still move based upon component alignment rules. (GP-1111, Issue #3193)
Decompiler. Added E key binding to the Decompiler's Equate action. (GP-1146, Issue #3195)
GUI. Added Apply button to analysis options dialog. Also added a last chance save/cancel dialog that is shown when a user cancels an options dialog that has unsaved changes. (GP-1169, Issue #3274)
Scripting. For stripped gcc binaries, improved prototype RecoverClassesFromRTTIScript identification of vtables and simple class data, constructors, and destructors. (GP-1055, Issue #3266)
Bugs:
Basic Infrastructure. Fixed regression that prevented Ghidra from launching on Windows when its path contained spaces. (GP-1113, Issue #3201, #3205)
Data Types. Fixed IllegalArgumentException error message when adding a duplicate enumerate name for EnumDataType. (GP-1173, Issue #3246)
Debugger. Changed diagnostics to write GDB.log to user directory, not installation. Clarified an error message. (GP-1133, Issue #3218)
Debugger. Improved error reporting when failing to start a Debugger GADP agent. (GP-1136, Issue #3175)
Debugger. Added system property to toggle alternative icons/colors for breakpoints. (GP-1139, Issue #3204)
Debugger. Applying a default everything memory map for GDB targets if info proc mappings fails or produces an empty list. (GP-1142, Issue #3071, #3074, #3161, #3169)
Debugger. Fixed issue with Debugger ignoring JAVA_HOME when launching child JVM. (GP-1143, Issue #3231)
Debugger. Fixed command-reply matching issue when using GDB via SSH. (GP-1153, Issue #3238)
Debugger:Emulator. Fixed bug in Trace Emulation causing ArrayIndexOutOfBoundsExceptions. (GP-1058)
Decompiler. Fixed issue causing Offset must be between... AddressOutOfBoundsException, when decompiling real-mode x86 programs. (GP-1163, Issue #239, #2948)
Decompiler. The decompiler now shows results when a HighGlobal has no associated symbol reference in the program. (GP-1184)
DWARF. Changed processing to ignore incomplete DWARF parameter lists in Rust binaries. (GP-1121, Issue #3060)
Exporter. The C/C++ Exporter now emits semicolons after function prototypes when using the Create Header File option. (GP-1145, Issue #1644)
Framework. Corrected address comparison for 64-bit signed address spaces (e.g., stack space, constant space) which could produce non-transitive comparison results. (GP-1178, Issue #3302)
Graphing. Corrected graph magnification behavior when using a high resolution mouse wheel. (GP-1181, Issue #3281, #3284)
GUI. Fixed NullPointerException when Hovering in Decompiler over a function that is not in memory. (GP-1131)
GUI. Fixed bug in Find References to search results that prevented '<' characters from being rendered. (GP-1137, Issue #3217)
GUI. Fixed issue where duplicate label names could cause the symbol tree to become unstable, evidenced by broken display and scrolling actions. Also, improved grouping algorithm. (GP-1159, Issue #3263)
GUI. Fixed Enter key in Set Equates dialog to choose the selected table row. Updated the Function Signature Editor dialog to allow the Cancel key to close the dialog when the focus is in the top text editor. (GP-1162, Issue #3235)
Headless. Fixed a regression in analyzeHeadless.bat that prevented the headless analyzer from running on Windows in some cases. (GP-1156, Issue #3261)
Importer. The MzLoader now populates the relocation table when relocations are performed. (GP-1160)
Importer:ELF. Corrected dynamic GOT/PLT markup problem for images which do not contain section headers. In cases where image does not define symbols within the PLT, analysis may be relied upon for its disassembly. ELF Importer's goal is to migrate symbols which may be defined within the PLT to the External symbol space. (GP-1110, Issue #3198)
Importer:Mach-O. The Mach-O importer now correctly interprets indirect symbols as references to symbols within another .dylib. (GP-1120)
Importer:PE. Improved ControlFlowGuard markup and creation of functions (GP-1179, Issue #1547, #1565)
Processors. Fixed bug in SuperH4 fmov.s pcode. (GP-1152)
Processors. The ARM instruction semantics for the mulitple-single-element forms of the vld1/vst1 vector instructions have been corrected. (GP-1167)
Sleigh. Fixed a string formatting error in the sleigh compiler. (GP-1124, Issue #3168)