Ghidra 11.3.2 Change History (April 2025)

Improvements

Demangler. Updated GNU Demangler text replacement to not replace some common namespace prefixes because in some cases doing so resulted in merging two unique namespaces into one. (GP-5503)
Processors. Corrected several AARCH64 floating point comparisons. (GP-5402, Issue #7479, #7855)
Project. In preparation for future project file types, project data error handling improvements have been made. This will help to reduce project browsing issues when unsupported files types are encountered (locally or on newer server). This may occur if newer file types are added to a project or shared repository and subsequently opened with an older version of Ghidra. (GP-5519)
Scripting. Updated the RecoverClassesFromRTTIScript to correctly handle case when there are two valid vftable symbols on the same address. (GP-5461, Issue #7876)
Scripting. Improved RecoverClassesFromRTTIScript ability to recognize the existence of RTTI in GCC binaries. (GP-5487, Issue #7904)
Scripting. Added check to RecoverClassesFromRTTIScript to make sure vftable addresses are contained in valid memory blocks. (GP-5500, Issue #7927)
Scripting. Improved RecoverClassesFromRTTIScript to do a better job validating GCC typeinfo structures by making sure there is space in memory before applying a typeinfo structure. (GP-5501)
Scripting. Improved RecoverClassesFromRTTIScript to do a better job prevalidating GCC typeinfo structures by making sure the typeinfo-name member points to a string. (GP-5502)
Scripting. Improved RecoverClassesFromRTTIScript's use of LowCodeBitMode addresses when validating virtual function starts. (GP-5505)
Scripting. pyghidra.open_program() now accepts a program_name parameter, which can be used to override the program name derived from the binary_path parameter. (GP-5521)

Bugs

Analysis. Added population of SetThunkFunction dialog to the computed thunk location. Also added thunk function pattern for Powerpc .plt table linkage. (GP-5411)
Analysis. Fixed issue where in some cases two vftable symbols (one plain and one with 's) were accidentally created at the same address. When running the RecoverClassesWithRTTIScript with the two symbols, this caused incorrect vftable structures to be applied. (GP-5422, Issue #7876)
Analysis. Default switch case flow references have been removed from the switch instruction as they are reached normally by a conditional branch. In addition, default case labels are now placed at the correct location. (GP-5583)
Basic Infrastructure. Fixed an issue with external Ghidra extension classpath priority. (GP-5569, Issue #7977)
Data Types. Corrected transaction error which could occur within Structure Editor when creating another structure from selected components. (GP-5412, Issue #7853)
Data Types. Corrected a bug which caused an exception when typing into the Bitfield Editor datatype. (GP-5431, Issue #7865)
Data Types. Added an optional Ordinal column to the Union Editor. (GP-5485)
Data Types. Corrected transaction error which can occur when launching the Structure Editor and one or more component-level datatype Settings have been previously applied. (GP-5556)
Data Types. Corrected various issues within Structure Editor which prevented the Save, Undo, Redo buttons and status text from updating correctly. (GP-5557)
Data Types. Corrected Union Editor shift up/down action bug which caused component datatype to be lost. (GP-5580, Issue #7994)
Debugger:Objects. Fixed issue re-arranging columns in Elements table of Model panel when Plot column was disabled. (GP-4915)
Debugger:Watches. Fixed issue where Watches didn't update on register changes. (GP-5383)
Debugger:Watches. Fixed issue where watches referring to registers would cause errors when previous coordinates had no thread. (GP-5394)
Emulator. Fixed issue with StructuredSleigh where empty (nop) program caused compilation error. (GP-5459)
Emulator. Fixed issue when branching from injected p-code in the emulator. (GP-5460)
Function. Corrected Function parameter custom storage error which could occur when adding stack storage entries. (GP-5479, Issue #7900)
Importer. Fixed a ClassCastException that could occur when extracting Mach-O files from a dyld_shared_cache. The exception was due to the Mach-O having very large symbol table offsets. (GP-5371, Issue #7436)
Importer:ELF. Corrected ELF MIPS import failure of DWARF debug file which could fail on processing of .reginfo section. (GP-5406)
Importer:ELF. Fixed Tricore relocation 24REL handling. (GP-5449, Issue #7868)
Importer:Mach-O. Fixed an issue with processing Mach-O stub functions that could result in the wrong symbol being associated with a stub. (GP-5482, Issue #7899)
Importer:PE. Fixed an exception that could occur when importing PE files with exactly eleven data directories. (GP-5558, Issue #7973, #7974)
MachineLearning. Upgraded the MachineLearning extension's protobuf-java jar to 3.21.8 to avoid potential classpath conflicts with the Debugger. (GP-5534, Issue #7977)
Processors. Fixed ARM vselgt conditional instruction semantics. (GP-4648, Issue #6531)
Processors. Fixed ARM vdup instruction semantics. (GP-4649, Issue #5669, #6542)
Processors. Fixed stack operand sizing for x86 ENTER, LEAVE, IRETQ, and RETF instructions. (GP-5011, Issue #6923)
Processors. Fixed issue with MIPS16 processor using incorrect relative addresses on delayslot instructions. (GP-5131, Issue #862)
Processors. Fixed invalid x86 pop instruction macros for some instruction variants. (GP-5299, Issue #7326)
Processors. Fixed 6x09 COM instruction pcode. (GP-5305, Issue #5767, #6336)
Processors. Fixed ARM Thumb missing the strt instruction. (GP-5386, Issue #7514)
Scripting. Added RecoverClassesFromRTTIScript check to make sure GCC VMI typeinfo structures have valid number of bases in structure. (GP-5389, Issue #7516)
Scripting. PyGhidra open_program() now handles locked projects better. (GP-5444, Issue #7536)
Search. Corrected a problem with the Memory Search dialog which could prevent proper search of selected memory regions. (GP-5395)
SourceMatching. Corrected parsing of certain DWARF source file paths. (GP-5561, Issue #7963)
Terminal. Fixed issue with obtrusive scrolling when selecting text. (GP-5416)
Version Tracking. Fixed NullPointerException that occured when clicking on Version Tracking match where either source or destination address was not in current program memory. (GP-5549, Issue #7964)

Notable API Changes

Debugger:Emulator. (GP-5517) Added Stack and Frames to the pure emulation trace object schema.
Debugger:Trace. (GP-5522) LifeSet.spans() now returns a NavigableSet.
SourceMatching. (GP-5561) SourceFileUtils.fixDwarfRelativePath has been renamed to SourceFileUtils.normalizeDwarfPath.

Ghidra 11.3.1 Change History (February 2025)

Improvements

Multi-User. Allow a repository without an Admin in the ACL to instantiate during server startup. The svrAdmin -grant command line tool may be used to assign a new Admin to a repository. Currently, when a user is removed from the server they are removed from all repository ACLs which could leave a repository without an Admin which will fail on server startup. (GP-5368)

Bugs

Basic Infrastructure. Fixed a bug that prevented Ghidra from remembering the last-used JDK when the JAVA_HOME environment variable was set. (GP-5381, Issue #7503)
Debugger:LLDB. Fixed an issue with local-lldb.bat. (GP-5347, Issue #4977)
Importer:ELF. Packed relocations in MIPS 64-bit binaries are now applied correctly. Previously, packed relocations would reference address 0x0. (GP-5365)
Importer:ELF. Corrected ELF Import bug which failed to pin absolute symbols and reported an Object Deleted error. (GP-5374)
Multi-User. Corrected regression bug which would prevent Ghidra Server users from specifying a different login username. (GP-5362, Issue #7454)
Processors. Added implementation for ARM vld4 and vst4 instructions. (GP-5268)
Scripting. PyGhidra can now find modules that live in directories specified by the Bundle Manager. (GP-5298)
Scripting. Fixed a PyGhidra issue that prevented accessing Java getters/setters as properties on non-public classes. (GP-5348, Issue #7450)
Scripting. PyGhidra now respects the application.settingsdir property set in Ghidra's launch.properties. (GP-5372, Issue #7481)
SourceMatching. Corrected implementation of DWARF source line DW_LNS_const_add_pc instruction. (GP-5353)

Notable API Changes

Multi-User. (GP-5362) Revised PasswordDialog constructors to simplify those used for password-only entry.

Ghidra 11.3 Change History (February 2025)

New Features

Analysis. Added new logic to export facts and source/sink logic to Datalog. (GP-3443)
Data Types. Added string translation option to use LibreTranslate to translate strings found in a binary. NOTE: This plugin is not enabled by default; the user needs to configure tool to include it if they want to use it. (GP-4877)
Debugger. Added TraceRMI connector for JDI (Java/Dalvik targets). (GP-4760)
Debugger. TraceRMI now supports debugging Java/Dalvik on Android. (GP-4893)
Debugger:Agents. The deprecated Debugger plugins and connectors (e.g., IN-VM) have been removed. (GP-1978)
Debugger:LLDB. Added support for debugging macOS kernels with lldb. (GP-5209)
Debugger:Targets. Added support for local and eXDI-mode kernel debugging (dbgeng/dbgmodel). (GP-5185)
Emulator. Added a high-performance p-code emulator using Just-in-Time translation to bytecode. (GP-4643)
Graphing. Added two new Flow Chart layouts for the function graph. These layouts organize code blocks into a tree structure and use orthogonal edge routing. One centers the parent block over the children and the other keeps the parent left aligned with its left most child. (GP-4988, Issue #1406)
GUI. Updated the File chooser to allow users to edit the path field. (GP-3492, Issue #5291, #7150)
Importer. Added a Load Libraries action that allows the user to load libraries after a program has already been imported. (GP-4919, Issue #396)
Scripting. Integrated the DoD Cyber Crime Center's Pyhidra tool (renamed to PyGhidra) to provide a native CPython 3 interface to Ghidra. (GP-4816, Issue #6900)
Scripting. Added a new button to the Script Manager that allows the user to edit scripts in Visual Studio Code. Additionally, added a new action to the CodeBrowser under Tools -> Create VSCode Module Project... that replaces the old VSCodeProjectScript.java script. (GP-5148)
Search. Added an action to allow users to search Decompiled text from Search -> Decompiled Text.... (GP-4839, Issue #6795)
SourceMatching. Added manager for source code and line number information to the Ghidra database. (GP-3883)
SourceMatching. Added SourceFilesTablePlugin for viewing source file information and managing local paths. (GP-4190)

Improvements

Analysis. Corrected a vftable naming issue in RTTI Analyzer where programs with PDB information were not naming vftables with associated class name correctly. (GP-4687)
BSim. Added a status command to bsim_ctl. (GP-5129, Issue #7102)
BSim. Added ability to specify user login info with postgres/elastic BSim URLs for the bsim command line tool and API. Updated BSim Server Manager GUI to allow user login name to be specified for postgres/elastic BSim server entries. (GP-5167)
BSim. Updated BSim bundled postgresql server to 15.10 to resolve incompatibility with openssl 3.2.2. (GP-5212, Issue #6115, #7084)
BSim. Tweaked BSim Dark Mode colors. (GP-5223, Issue #7312)
Build. Fixed a build issue with Gradle 8.12. (GP-5226)
CodeBrowser. Users can now apply bookmarks in the Listing to interior data of structures applied to memory. (GP-4820)
Data Types. The Decompiler now propagates and displays names for enumeration data-types that have been partially truncated. (GP-2470)
Debugger. Improved the behavior for Android targets. (GP-5034, Issue #6386)
Debugger:Agents. Removed raw gdb connector. Instead, just leave the Image option blank in the gdb connector. (GP-4906)
Debugger:Agents. Added Architecture and Endian options to several gdb launchers. (GP-5005)
Debugger:GDB. Added distinct launchers for qemu-system (vs. qemu-user). Windows only supports qemu-system. (GP-5051, Issue #7095)
Debugger:GDB. Added Pull all section mappings to the qemu + gdb debug launcher. (GP-5089, Issue #7118)
Debugger:Listing. Load Emulator from Programs has been removed from the Auto-Read Memory menus. It is now the default behavior for pure emulation, unless Do Not Read Memory is selected. (GP-5134)
Decompiler. Updated the Decompiler function name colors to match the Listing. (GP-5085, Issue #7053)
Decompiler. Improved the Decompiler's handling of signed integer comparisons in the presence of the AARCH64 ccmp instruction. (GP-5158)
Demangler. Added ability to process Microsoft C-style mangled function symbols. (GP-4898, Issue #1514)
Demangler. Improved processing of anonymous namespaces in vxtables. (GP-5101)
Demangler. The builtin int type in Swift binaries has been changed from 8 bytes to 4 bytes. The Swift Demangler now demangles the Swift.Int type to __int64 (or __int32 on 32-bit programs) to avoid conflicts with non-Swift structures and functions that may be found in the program. (GP-5182, Issue #6784)
Eclipse Integration. GhidraDev 5.0.0 has been released which supports creating and launching new Ghidra module and scripting projects with PyGhidra support (using the PyDev Eclipse plugin). (GP-5138)
FileSystems. Updated to dex2jar-2.4.24 and asm-9.7.1 libraries. (GP-5220)
Function. Now prevent function auto-storage assignment for DEFAULT (undefined) datatype. Changed Demangler to produce undefined-typedef in place of a DWORD-typedef when producing a default-named datatype. Demangler will still create an empty named Structure in many cases. Decompiler will no longer assign the undefined datatype to variables. (GP-4886)
Graphing. Added an action to toggle between the Listing and Function Graph views (Ctrl-Space). (GP-4947)
Graphing. Added options for which corner the Function Graph Satellite view is docked within the main Graph window. (GP-4996)
GUI. Updated theming to allow users to change the table's base font and monospaced fonts separately. (GP-4873, Issue #6853)
GUI. Changed the Linux default theme from Nimbus to Flat Light. (GP-4973)
GUI. Updated Key Binding assignment to allow users to choose Backspace and Enter. (GP-5007, Issue #6972)
GUI. Upgraded FlatLaf to 3.5.4. (GP-5027)
GUI. Added options to the Clear With Options... action to allow just clearing instructions or data instead of having to do both or neither. (GP-5084, Issue #7082)
GUI. Users can now pick a language by double-clicking in the Importer Dialog. (GP-5097, Issue #7135)
GUI. Updated the Flat Dark table inactive selection color. (GP-5108, Issue #7134)
GUI. Users can now press the Escape key to close windows that contain only a single component provider. (GP-5114, Issue #7136)
GUI. Updated table and tree filters to support Ctrl-F to place focus on the cursor. Also added an action to hide and show the filter. (GP-5115, Issue #7136)
GUI. The Function Call Tree plugin now distinguishes between call references and non-call references. (GP-5116)
GUI. Changed actions that show a component provider into toggle actions that hide the provider if already visible. (GP-5117, Issue #7136)
GUI. Added a Downloads folder to the File Chooser. (GP-5118, Issue #7121)
GUI. Added the Unresolved Reference color to the Theme Configuration. (GP-5157)
GUI. Added support for expressions in address input fields. (GP-5196, Issue #7227)
Importer. Fixed a performance issue when loading libraries on Windows. (GP-5208)
Importer:COFF. The MS Common Object File Format (COFF) loader now recognizes AARCH64 binaries. (GP-5153)
Importer:COFF. Added relocation handlers for ARM and AARCH64 COFF files. (GP-5154)
Importer:ELF. The ElfLoader imagebase option can now contain a leading 0x. (GP-4955, Issue #6912)
Languages. Added support for golang 1.23. (GP-4870)
Listing. Added ability to copy data values and referenced data values to the clipboard via the copy special action. (GP-5036)
Listing. Hovering on addresses in the Listing now show offsets in both decimal and hexadecimal. (GP-5176, Issue #7239)
Navigation. Improved GoTo Dialog to support full namespace paths with wildcards. (GP-4930)
PDB. Improved PDB composite reconstruction when padding components are required to facilitate proper packing. (GP-5037, Issue #1030)
PDB. Enabled the processing of some older PDB component versions by fixing up previously written code intended for processing them. (GP-5072, Issue #7100)
PDB. Improved searching for PDB files. (GP-5174, Issue #7200)
Processors. Made a number of improvements to the TI_MSP430 compiler spec. (GP-4202)
Scripting. GhidraScript.askFile() no longer throws an IllegalArgumentException in headless mode when passing in a valid path argument to a file that does not yet exist. (GP-5010, Issue #7025)
Scripting. Upgraded Jython to 2.7.4. (GP-5210)
Search. Added a button to the Instruction Pattern Search dialog that allows users to add more instructions to the current set of patterns. (GP-2418)
SourceMatching. Added source file mapping for golang. (GP-4196)
SourceMatching. Added OpenSourceFileAtLineInVSCodeScript.java and OpenSourceFileAtLineInEclipseScript.java for communicating source map information to vscode and eclipse. (GP-5217)
Terminal. Added keys to adjust font size. Fixed theme changes should take immediate effect. (GP-5003)

Bugs

Analysis. Fixed issue in RTTIAnalyzer introduced with previous fix to incorrect anonymous PDB namespaces. Leaving the old name as a secondary label caused RTTI Script to assume two different classes with same Listing contents. (GP-5146, Issue #3213)
Analysis. Fixed issue where a TEB Analyzer failure reverts entire analysis. (GP-5338)
Assembler. Improved WildcardAssembler to have less stringent requirements for input contextreg values. (GP-5288, Issue #7195)
BSim. Corrected various bugs related to BSim elasticsearch use. (GP-1830)
BSim. Corrected various bugs affecting BSim Elasticsearch use. (GP-5207)
BSim. Corrected BSim apply signature when source calling convention is unknown (e.g., custom) to destination. (GP-5216, Issue #7310)
BSim. Corrected NullPointerException in BSimFeatureVisualizer. (GP-5252, Issue #7311)
Byte Viewer. Fixed bug that cleared the Byte Viewer Address column when changing fonts. (GP-4998)
CParser. Parsing header files with the CParser will now stop parsing when a #error directive is encountered. Numerous parsing errors involving comment parsing have been fixed. (GP-5025, Issue #7001)
CParser. Added CParser support for __vectorcall, __rustcall, and __pascal calling conventions. (GP-5150)
Debugger. Fixed issue toggling and deleting breakpoints and watchpoints in lldb. (GP-5271)
Debugger:dbgeng.dll. Provided fix for missing stack values for some variants of dbgmodel.dll. (GP-5195)
Debugger:GDB. Added a Refresh action for stack frames other than just the topmost one. (GP-5169)
Debugger:GDB. Fixed endianness of register value display in Model tree. (GP-5230)
Debugger:Listing. Fixed issue with obtrusive and spurious auto-seek events. (GP-5266)
Debugger:Mappings. Fixed issue with registers not displaying because of a conflict in language/compiler opinion between the back and front ends, particularly affecting gdb with Windows x64 targets. (GP-5232)
Debugger:Memory. Fixed an issue with manually adding a Region from the UI. (GP-5164, Issue #7176)
Debugger:Memory. Fixed Auto-Read memory when using Force Full View. (GP-5180, Issue #7176)
Debugger:Modules. Fixed NullPointerException from TraceModule.getBase().getAddressSpace() commonly seen when launching and mapping Windows targets. (GP-5102, Issue #7153)
Debugger:Objects. Fixed issue where Model tree pane didn't update after editing a register in the CLI. (GP-5229)
Debugger:Registers. Fixed issue where registers could not be edited. (GP-5213)
Debugger:Trace. Fixed unflushed object stream in Saveable TracePropertyMap. (GP-5121)
Decompiler. Fixed occurrence of "Unable to create datatype associated with symbol" exceptions when using the Override Signature action. (GP-5006, Issue #3694)
Decompiler. Fixed a bug where the Decompiler failed to resolve references into structures that were recursively defined. (GP-5038)
Decompiler. Fixed a Decompiler bug encountered when renaming a token that caused middle-mouse highlights to persists. (GP-5040, Issue #7077)
Decompiler. Fixed possible infinite loop when inlining recursive functions in the Decompiler. (GP-5073, Issue #5824)
Decompiler. Fixed crash in the Decompiler triggered while recovering a heap string written at a negative offset relative to the pointer. (GP-5130)
Decompiler. Fixed infinite loop in the Decompiler triggered by data-types with a nested structure containing an array. (GP-5184, Issue #7212)
Diff. Fixed missing parameters in the Diff Tool Listing view. (GP-5155)
Eclipse Integration. Fixed an issue with the GhidraDev Eclipse plugin's Import Ghidra Module Source feature that prevented the module's extension points from being discovered by Ghidra when launched with the project's run/debug configuration. (GP-5125, Issue #7047)
Framework. Fixed an exception that occurred when closing the Front End tool. (GP-4962, Issue #6937)
Function. Corrected Function custom storage editor's handling of compound storage checking for big-endian programs. (GP-5198)
Function Compare. Fixed bug in LocalBsimQueryScript where showing new function comparison windows would stop working after you closed the comparison window the first time. (GP-5329)
GUI. Corrected Function custom storage editor datatype selection which failed to properly clone datatype to program's data organization. (GP-4913)
GUI. Updated the Ghidra Script table so all columns are resizable. (GP-4983, Issue #6918)
GUI. Fixed table selection bug in the Memory Map provider when a table filter is applied. (GP-4984)
GUI. Fixed fast scrolling behavior sometimes seen when using the Flat Light or Dark themes. (GP-4993, Issue #6952)
GUI. Fixed entropy legend labels to be visible in all themes. (GP-5103)
GUI. Fixed a bug that caused the table Column Filter Dialog to not update when new columns were added. (GP-5289, Issue #7175)
GUI. Fixed the Escape key sometimes not working in Tree and Table cell editors. (GP-5313, Issue #7241)
Importer:PE. Provided a fix related to an incorrect length for Windows PE IMAGE_DEBUG_MISC processing. (GP-5199, Issue #7285)
Importer:PE. Fixed a NullPointerException that could occur when processing debug COFF symbol information. (GP-5321, Issue #7411)
Multi-User. Corrected Ghidra versioning bug where server may not be updated with latest checkout details following a checkout update. This could allow file versions to be deleted from the repository when they still have corresponding checkout(s). To correct existing checkout data, all project files should be checked-in, without keeping checked-out, then re-checkout if necessary to correct the repository metadata. (GP-5123)
Multi-User. Corrected Ghidra Server concurrent modification error which could occur during client repository disposal. Improved control of java path used by ghidraSvr script and other Ghidra launch scripts through the use of JAVA_HOME environment variable. (GP-5161)
Processors. Added EVEX writemask to pcode for x86 AVX-512 instructions. (GP-4660)
Processors. Corrected ARM VFPv2 instructions which were not disassembling correctly. (GP-5181, Issue #7259)
ProgramDB. Corrected issue related to locally stored Program user data that may not handle language version upgrades properly. (GP-5205)
ProgramTree. Fixed NullPointerException when restoring a program tree window in which a tab was previously closed. (GP-5279)

Notable API Changes

Debugger:Agents. (GP-1978) The entirety of DebuggerObjectModel and most of its related paraphernalia have been removed. Other parts have been refactored into other components. DebuggerObjectModel / TraceRecorder is replaced by TraceRmi / Target. TargetObject is replaced by TraceObject. Some TargetObject interfaces, e.g., TargetDeletable, do not have replacement TraceObject interfaces. Instead, they are implied by applicable RemoteMethods. Others, e.g., TargetAccessConditioned, are removed without replacement. DataType- and Symbol-related objects are removed. They have not been used. If needed later, the intent is to provide rmi-based access to the trace's symbol table and data type manager. TargetObjectSchema is replaced by TraceObjectSchema. TraceObjectKeyPath is renamed KeyPath. PathUtils and many uses of List<String> have been replaced by KeyPath. AnnotatedSchemaContext and related are removed. SshPtyFactory and related are removed.
Emulator. (GP-4643) Added JitPcodeEmulator and many, many related classes. PcodeArithmetic: changed modBeforeStore and modAfterLoad to include AddressSpace and PcodeOp parameters. SleighInstructionDecoder.decodeInstruction now returns a PseudoInstruction. PcodeExecutor: added getIntConst, getLoadStoreSpace, getLoadStoreOffset, getStoreValue, getBranchTarget, getConditionalBranchPredicate, getIndirectBranchTarget, getUseropName, getCallotherOpNumber.
BSim. (GP-5167) Changed BSim API to convey non-default username via the BSimServerInfo class or the userinfo field of postgres/elastic BSim URLs. The user argument has been dropped to the FunctionDatabase.changePassword method which will always change the password for the connected user. Renamed FunctionDatabase.Error class to FunctionDatabase.BSimError to avoid naming conflict with java.lang.Error.
Data Types. (GP-3625) Added FileDataTypeManager static methods for creating a Data Type Archive with a specific processor and compiler specification. Improved CParserUtils parse methods to separate the cases where parsing into an existing Data Type Manager versus parsing into a new Data Type Archive where a processor and compiler specification may specified.
Debugger:Listing. (GP-5134) DebuggerListingProvider#setAutoReadMemorySpec and related no longer accept LoadEmulatorAutoReadMemorySpec. Added AutoReadMemorySpec#getEffective.
Decompiler. (GP-5085) Updated DecompileOptions to remove the getFunctionColor() method. There is no replacement for this method as the function color is now being set in the Listing Settings menu and is coordinated across the Listing and Decompile panes.
Demangler. (GP-4898) Within the Demangler interface, Ghidra 9.2-deprecated methods were removed, Ghidra 11.3-deprecations were set on other methods, and new methods were created. The new methods and much of the Demangler fabric now makes use of a MangledContext in place of a String. This allows greater flexibility in controlling how symbols get demangled. These changes have been reflected in abstract and non-abstract methods in AbstractDemanglerAnalzyer. Users of deprecated methods within Demangler and DemanglerUtil should migrate to newer methods (see javadoc).
GUI. (GP-5007) Added a new widget, the docking.KeyEntryPanel, as a drop-in replacement for clients using the docking.KeyEntryTextField. This is not a required change.
GUI. (GP-5196) The static method evaluateToLong(String s) in AddressEvaluator has been moved to a new class called ExpressionEvaluator. Also, the AddressInput field component has been changed to accept Programs instead of just an AddressFactory (which is still supported) so that any dialog using an AddressInput component can now accept symbol names, memory block names, and mathematical expressions.
Importer. (GP-5208) GFileSystems now need to implement lookup(path, comparator). Classes that fail to provide an implementation will fall back to using lookup(path), and an error will be logged.
Search. (GP-4911) The API script method findBytes() no longer supports finding matches that span gaps in the memory blocks. The internal classes for performing memory searches were completely re-written in Ghidra release 11.2. In release 11.3, the old classes were removed and uses of them in the findBytes() method were replaced with the new memory search code. The new search API currently does not support matches that span non-contiguous memory and it isn't clear if that is actually useful; so for now, that method was deprecated and no longer finds matches in gaps even if the boolean is true. In the unlikely event someone actually uses this, please contact the Ghidra team.
Assembler. (GP-5288) Added AssemblyResolvedPatterns.withContext. Added ContextCommit.getWordIndex and getMask.
BSim. (GP-1830) Dropped use of json-simple library in favor of gson.
Debugger. (GP-5271) Added TraceBreakpoint.isAlive(long snap). Deprecated TraceBreakpoint.getLifespan(). Added TraceObject.isAlive(long snap).
Debugger:Listing. (GP-5266) Renamed DebuggerCoordinates.equalsIgnoreRecorderAndView to equalsIgnoreTargetAndView. Added DebuggerCoordinates.differsOnlyByPatch. Added TraceSchedule.differsOnlyByPatch. Added Sequence.differsOnlyByPatch.
Debugger:Memory. (GP-5164) Renamed DebuggerAddRegionDialog#setName to setPath.