PAL: PyGhidra-based executable-to-Python state-machine recovery

[oldwalls]

PAL is a pre-alpha binary reconstruction project built on Ghidra and PyGhidra. It consumes Ghidra HighFunction p-code, CFG, SSA, ABI and machine-code evidence, freezes each recovered function into an evidence-linked "Icecube" and emits both readable and executable Python projections.

On a controlled eight-program C/ELF regression corpus, the published Python state machines currently converge on the native programs’ observed results. The covered ground includes loops, branches, switch fallthrough, fixed-width signed/unsigned arithmetic, internal calls, ABI transport and limited memory behavior.

This is not a claim of general binary compatibility. The corpus is still small, external/runtime coverage is limited, and the next stage is deliberately aimed at finding where the reconstruction model fails.

Repository:

I would particularly value feedback from people working with PyGhidra, HighFunction p-code, CFG recovery and executable semantic lifting.

[ryanmkurtz]

Did you mean to provide a link to your repository?

[oldwalls]

@ryanmkurtz

here it is : https://github.com/oldwalls/pyghidra-PAL/tree/main

[oldwalls]

PALTermUI neptune v0.23r released

I’ve published PALTermUI neptune, an opt-in pre-alpha interface for pyghidra-PAL. Its core is a synchronized PHI–ASM–Python static debugger: search or highlight a Python state, jump to the owning machine-code block, inspect its PHI custody chain, and walk branch history while all panes remain linked. During testing against both existing and newly generated PAL data, it exposed a real lifting defect—a while True: loop whose missing condition was immediately visible in the adjacent ASM. No known crashes remain from current human testing; neptune is isolated from the default UI and available as a preview for inspection and feedback.

Repository: https://github.com/oldwalls/pyghidra-PAL/tree/main/neptune

[oldwalls]

PAL has matured: please find latest release of PAL with enhanced and checked functionality:

Python Abstract Layer - Alpha v0.24 (mars)