1

I have a Motorola 68K binary file that contains a table of a few hundred function pointers. If I set their data type to Pointer32, Ghidra interprets them as pointers as shown:

00100000 01 20 96 94     addr       DAT_01209694
00100004 01 20 96 b2     addr       DAT_012096b2
00100008 01 20 96 d0     addr       DAT_012096d0

However, while the function pointers are stored as 32-bit values, they use a unique segment/address scheme:

AA SA AA AA (the segment in this project is always 2 and needs to be ignored when parsing the pointer address)

Essentially, I need to make a 32-bit pointer data type that "ignores" the S part of the address, such that the data would look like this if it was correct:

00100000 01 20 96 94     addr       DAT_00109694
00100004 01 20 96 b2     addr       DAT_001096b2
00100008 01 20 96 d0     addr       DAT_001096d0

I'm somewhat new to Ghidra, so any pointers (pun intended) to where I can read up on creating custom pointer types would be greatly appreciated!

Improve this question

1 Answer 1

Reset to default
0

I can't tell you how to create a custom datatype for this off the top of my head[0], but if for your purposes it's sufficient for the address to show up correctly, and then the process should be the same as dealing with relative addresses as described here:

You can always set it manually to the specific address from the reference dialog (available under R). There you can providing the correct address calculated [...]. If you have more than one, you can automate it via python script.

I've recorded a video detailing such situation in action https://www.youtube.com/watch?v=FvH7b_qLmbU

[0] I think this would probably only matter if you want type propagation algorithms to handle this, e.g. if some struct will have a pointer of this type.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.