4

I'm trying to verify the correctness of a custom processor module in Ghidra. The instruction that I am currently analyzing does some fancy stuff with its p-code. Specifically, it uses a bunch of tables that end up forming a p-code tree that is several levels deep when it disassembles that instruction. Since p-code trees are walked in a depth-first order, that means the p-code of the child nodes will be emitted first before their parents. This could result in the p-code of the instruction not working in the order that you might expect.

I would like to be able to have Ghidra (or SLEIGH, or whatever affiliated tool) spit out the full generated p-code after it has walked the tree so I can verify that things are happening in the order that I think they are.

Improve this question

2 Answers 2

Reset to default
6

For an individual instruction, yes, sure. See this recent blog post of mine and search for "Jenga". If you're talking about inspecting the pcode after the decompiler has done its business with it, there's a couple of scripts that user d-millar has repeatedly linked on the Ghidra GitHub that demontrate how to use that form of the pcode from the API, as well as providing some code for output.

Improve this answer
2
  • This worked for me. I'd like to ask that you update your answer a little before I mark it as the accepted answer. In addition to linking to your blog post, please add an excerpt from the relevant section of the post that describes the steps to display the PCode so that this answer will remain useful in case your blog is down or moved some time in the future. Also, it would be very nice if you included the screenshots from your blog that show how this is done.
    – A. Levy
    Commented May 10, 2019 at 15:36
  • 7
    Are you familiar with the English expression "beggars can't be choosers"? I don't intend to put any more effort into answering your question.
    – Rolf Rolles
    Commented May 10, 2019 at 20:57
3

As Rolf Rolles already mentioned there are two distinct kinds of P-Code that can be displayed and accessed.

The first kind is the lifted instruction information. You can display it by opening by clicking the "Edit the Listing Fields" button at the top of the Listing:

enter image description here

and then right click the PCode bar and Enable Field: enter image description here

Once this is enabled you can then also click on some PCode statement, and then run currentLocation in any kind of GhidraScript or shell to access the PCode object associated with it.

enter image description here

The second kind of PCode is the one returned by the decompiler. The easiest way to access this is by clicking on the token you are interested in inside the Decompile window, and then run currentLocation.token.pcodeOp inside a shell or script:

enter image description here

>>> currentLocation.token.pcodeOp
(register, 0x4000, 2) CALL (ram, 0x10031f898, 8) , (unique, 0x12580, 4)
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.