Ghidra sBPF Processor Module

Ghidra Processor Module

sBPF

A Ghidra processor module providing support for Solana eBPF.

This module is built on top of the Ghidra eBPF Processor Module and adds support for SIMD-0173 and SIMD-0174.

Installation

Copy the sBPF directory to the /Ghidra/Processors/ directory to install the module.

---

Ghidra Scripts for sBPF

ghidra_scripts/sBPFReloc.py

Fixes relocation issues related to sBPF system calls.

It is recommended to run this script before performing analysis.

---

ghidra_scripts/IDLGuesser.py

Automatically recovers IDL information from closed-source Solana programs built with Anchor.

The core algorithm is based on IDLGuesser.

---

Script Installation

Copy the scripts to the ~/ghidra_scripts directory to complete the installation.

---

Screenshots

---

References

• Ghidra eBPF Processor Module
• Radare2 sBPF plugin
• Firedancer
• IDLGuesser
• SIMD-0173: SBPF instruction encoding improvements
• SIMD-0174: SBPF arithmetics improvements