AwesomeREA.org

Tool

Yagi

Airbus CERT plugin that embeds Ghidra's native decompiler in IDA Pro and IDA Free: pressing F3 on a function shows Ghidra's C output inside IDA, and edits made there, covering global symbols such as function prototypes and the names and types of stack and register variables, are saved to the IDA database. The README lists x86, x86-64, ARM, AArch64, PowerPC, MIPS, SPARC, AVR8, 6502, Z80 and eBPF as supported, while other Ghidra processors such as Dalvik, JVM, RISC-V and 68000 are not yet enabled.

Targets
Binary
Category
Native analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Inactive since its latest release, v1.5.0 (2022-08-04), which adds eBPF and IDA 7.7 support and ships Windows MSI installers for IDA 7.6, IDA 7.7 and IDA Freeware; the last Linux installers (.sh and .tar.gz for IDA 7.5, 7.6 and Freeware) are in v1.4.0 (2021-12-20). No builds for IDA 8 or later are published, and compatibility with current IDA releases was not tested. The default branch is main; an older master branch stops in 2021.
  • Source builds need a recursive clone, whose submodules are Airbus CERT's Ghidra fork on its fix-memory-access-violation branch (pinned at the Ghidra 10.1 release commit), eBPF-for-Ghidra and cylance/eBPF_processor. They also need CMake 3.11+, a C++ compiler (Visual Studio on Windows), flex and bison for the SLEIGH grammar, WiX for the Windows installer, and the Hex-Rays IDA SDK matching the user's IDA version, which the repository does not include.
  • The workflows build on a self-hosted Windows runner against a locally installed IDA 7.6 SDK. Their googletest unit tests decompile machine-code byte arrays written into the test sources for x86 (16-, 32- and 64-bit), ARM, MIPS, PowerPC, SPARC, 6502 and Z80, using mocked IDA loader, symbol and type interfaces. README TODOs include enum types, AArch64 function-end rules and changing constant types.
  • Apache-2.0; Ghidra's decompiler keeps its own Apache-2.0 terms, and IDA and its SDK are Hex-Rays products under their own licenses. Nothing was built or run in this review; the reviewed sources establish no REA connection.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · airbus-cert/Yagi · Revision 6fc4787
  2. CHANGELOG.md GitHub · airbus-cert/Yagi · Revision 6fc4787
  3. .gitmodules GitHub · airbus-cert/Yagi · Revision 6fc4787
  4. CMakeLists.txt GitHub · airbus-cert/Yagi · Revision 6fc4787
  5. tests GitHub · airbus-cert/Yagi · Revision 6fc4787
  6. .github/workflows/unittests.yml GitHub · airbus-cert/Yagi · Revision 6fc4787
  7. LICENSE GitHub · airbus-cert/Yagi · Revision 6fc4787
  8. https://github.com/airbus-cert/Yagi/releases/tag/v1.5.0
  9. https://github.com/airbus-cert/Yagi/releases/tag/v1.4.0

More in Native binaries

All 158 entries in Native binaries