News for hackers. Stuff that matters.
Re:Ghidra by NSA by boricj on Monday February 16, 2026 @03:40PM (#47040052)
Might as well plug in my own extension: https://github.com/boricj/ghidra-delinker-extension

It's a relocatable object file exporter that supports x86/MIPS and ELF/COFF. In other words, it can delink any program selection and you can reuse the bits for various use-cases, including to make new programs Mad Max-style.

It carved itself a niche in the Windows decompilation community, used alongside objdiff or decomp.me.

Re:Ghidra by NSA by WalterGR on Monday February 16, 2026 @03:47PM (#47040126)
What is Mad Max-style?
Re:Ghidra by NSA by barfiure on Monday February 16, 2026 @03:52PM (#47040180)
I imagine PIE chunks that you can kludge into other programs to Frankenstein implementations? Kind of like how mad max cars are made of bits and pieces bolted together
Re:Ghidra by NSA by boricj on Monday February 16, 2026 @04:00PM (#47040277)
Indeed, you can kludge anything together into working chimeras, as long as you can mend the ABIs together.

I've done a case study where I've ported a Linux a.out program into a native Windows PE program without source code: https://boricj.net/atari-jaguar-sdk/2023/11/27/introduction....

Another case study was ripping the archive code from a PlayStation game and stuffing it into a Linux MIPS program to create an asset extractor: https://boricj.net/tenchu1/2024/03/18/part-6.html

Re:Ghidra by NSA by p0w3n3d on Monday February 16, 2026 @04:35PM (#47040646)
You sir are a true wizard!
Re:Ghidra by NSA by montymintypie on Monday February 16, 2026 @06:05PM (#47041573)
Easily one of the coolest RE projects out there, I've always looked on in awe.

> The relocation table synthesizer analyzer relies on a fully populated Ghidra database (with correctly declared symbols, data types and references) in order to work

It's a shame that this requirement exists (I am well aware that it's a functional necessity), because all the stuff I want to relink is far too big to make a full db!

Re:Ghidra by NSA by boricj on Monday February 16, 2026 @06:27PM (#47041736)
You only need a full DB if you want to fully delink your artifact. You can just clean up the subset you're interested in exporting (the fully populated disclaimer is just there because there's a lot you can get away with, as long as you know precisely what you are doing).

Even then, a full DB is quite achievable, even on large projects. The biggest public project using ghidra-delinker-extension out there is the FUEL decompilation: https://github.com/widberg/FUELDecompilation

The executable is 7 MiB, has over 30,000 functions and has more than 250,000 relocations spots. The user made the game relocatable in six weeks (with four of them debugging issues with my extension). They then managed to replace code in spite of the fact that the artifact was built with LTO by binary patching __usercall into MSVC.

There's a write-up about all of that that is well worth a read: https://github.com/widberg/fmtk/wiki/Decompilation

I've also had one user manage to fully delink the original Halo on the Xbox in one week. To be fair, they were completely nerd-sniped and worked non-stop on it, but it still counts.

Re:Ghidra by NSA by montymintypie on Tuesday February 17, 2026 @08:17AM (#47047187)
Whoah, that is super impressive. My target binary is 9MiB, seemingly only 10k relocations IIRC but 37k functions.

I might try a partial delink and see how it goes!

Re:Ghidra by NSA by evmar on Monday February 16, 2026 @07:53PM (#47042341)
Where can I learn more about the Windows decompilation community? (This is an area I kind of work in, and I am interested in participating!)
Re:Ghidra by NSA by boricj on Tuesday February 17, 2026 @01:30AM (#47044350)
Most of my known userbase hangs out in the decomp.me Discord server. Each project also tends to have its own dedicated Discord server.

The Windows decompilation community is far more fragmented than the console one, as it hasn't coalesced around a common set of tools like splat or decomp-toolkit.