AwesomeREA.org

Documentation

MIPS ELF analysis through Ghidra

Documents REA’s Ghidra lane for MIPS ELF executables, relocatable objects and MIPS16 shared images, including a pinned 32-bit language for recordless legacy firmware executables that Ghidra would otherwise import as 64-bit. Admission is bounded by declared header and ABI-record facts, and verification compares source-owned fixtures with independent readelf output rather than executing or rehosting firmware.

Requirements and limitations

  • Needs a caller-installed Ghidra and compatible JDK on a supported Linux or macOS host; Windows Ghidra P0 does not admit MIPS, and Hopper/IDA gain no MIPS support. The lane does not execute MIPS code or rehost firmware. The standard profile admits ELF32 executables and relocatable objects declaring o32 and MIPS32r2; MIPS16 shared images have a separate bounded profile. ELF64, n32/n64, microMIPS, machine variants, FP64, NAN2008 and PSP PRX are refused.
  • Merged PR #1898, for issue #1620, admits recordless legacy ELF32 executables with EF_MIPS_ARCH_32 or 32R2, an unspecified ABI field and an inspected absence of ABI-flags records. It pins MIPS:<LE|BE>:32:default and checks the language Ghidra reports after import. o32 is recorded as an analysis assumption, not a declared fact, and floating-point ABI semantics stay unverified.
  • Optional real-provider lanes need caller-supplied Clang with MIPS targets, LLD, GNU readelf or MIPS cross-binutils, and Ghidra. They build source-owned fixtures in both byte orders without executing them, comparing instruction bytes, symbols, languages and relocations with independent readelf facts. The guide states that pseudocode presence and decoding agreement do not establish runtime, delay-slot or complete floating-point semantics.
  • The issue author reports gating a local patch on four real MIPS32 LE firmware ELFs whose function entries matched separate 32-bit Ghidra exports, and 400 of 5,250 functions lost on one image under auto-selection; those files are not public. A PR reviewer tested header-edited OpenWrt kernels and BusyBox builds with Capstone cross-checks and found no unedited public recordless file. No device model, firmware change or runtime behavior is established.
  • REA declares MIT. Ghidra, compilers, binutils and analysed firmware keep their own terms, and the firmware behind the author’s results is not supplied. This collection reviewed the issue, PR thread and pinned sources without running REA, Ghidra or any target.

About this entry

Type
Documentation
Category
Official REA: investigation guides
Relationship
Official REA documentation
Targets
Binary · Firmware

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. docs/ghidra-mips.md GitHub · morluto/rea · Revision c12d9ed
  2. https://github.com/morluto/rea/issues/1620
  3. https://github.com/morluto/rea/pull/1898
  4. scripts/verify-real-ghidra-mips.mjs GitHub · morluto/rea · Revision c12d9ed
  5. tests/conformance/ghidra/mips-fixture.mjs GitHub · morluto/rea · Revision c12d9ed
  6. src/ghidra/GhidraMipsProfile.ts GitHub · morluto/rea · Revision c12d9ed
  7. LICENSE GitHub · morluto/rea · Revision c12d9ed