new: [ghidra-function] Added object

Author: rdmmf

objects/ghidra-function/definition.json

@@ -0,0 +1,122 @@
+{
+  "attributes": {
+    "function-name":{
+      "description": "function name",
+      "misp-attribute": "text",
+      "ui-priority": 1,
+      "disable_correlation": true
+    },
+    "label": {
+      "description": "ghidra symbol label(s) associated with the function",
+      "misp-attribute": "text",
+      "ui-priority": 0,
+      "disable_correlation": true,
+      "multiple": true
+    },
+    "function-scope": {
+      "description": "ghidra function scope (export, import, internal)",
+      "misp-attribute": "text",
+      "ui-priority": 0,
+      "disable_correlation": true,
+      "sane_default": [
+        "export",
+        "import",
+        "internal"
+      ]
+    },
+    "is-thunk": {
+      "description": "identifies a thunk function",
+      "misp-attribute": "boolean",
+      "ui-priority": 0,
+      "disable_correlation": true
+    },
+    "external-library": {
+      "description": "external library name if the function is an import",
+      "misp-attribute": "text",
+      "ui-priority": 0,
+      "disable_correlation": true
+    },
+    "entrypoint-address": {
+      "description": "function entrypoint address (integer in a text for consistency with the entrypoint-address in ELF/PE/Mach-O Objects)",
+      "misp-attribute": "text",
+      "ui-priority": 0,
+      "disable_correlation": true
+    },
+    "instruction-count": {
+      "description": "Instruction count",
+      "misp-attribute": "integer",
+      "ui-priority": 0,
+      "disable_correlation": true
+    },
+    "bsim-vector": {
+      "description": "comma separated BSIM Feature Vector",
+      "misp-attribute": "text",
+      "ui-priority": 0
+    },
+    "bsim-signature": {
+      "description": "BSIM signature of the vector",
+      "misp-attribute": "hex",
+      "ui-priority": 0
+    },
+    "fid-fh-hash": {
+      "description": "Function ID FH Function hash",
+      "misp-attribute": "hex",
+      "ui-priority": 0
+    },
+    "fid-fx-hash": {
+      "description": "Function ID FX Extended hash",
+      "misp-attribute": "hex",
+      "ui-priority": 0
+    },
+    "flirt-hash": {
+      "description": "IDA pro FLIRT hash",
+      "misp-attribute": "hex",
+      "ui-priority": 0
+    },
+    "decompiled-function": {
+      "description": "Ghidra decompiled function",
+      "misp-attribute": "text",
+      "ui-priority": 0,
+      "disable_correlation": true
+    },
+    "function-signature": {
+      "description": "Function signature",
+      "misp-attribute": "text",
+      "ui-priority": 0,
+      "disable_correlation": true
+    },
+    "return-type": {
+      "description": "The data type returned by the function",
+      "misp-attribute": "text",
+      "ui-priority": 0,
+      "disable_correlation": true
+    },
+      "calling-convention": {
+      "description": "The calling convention used by the function (e.g., cdecl, stdcall)",
+      "misp-attribute": "text",
+      "ui-priority": 0,
+      "disable_correlation": true
+    },
+      "language-id": {
+      "description": "Language id of the program (architecture, compiler, etc.)",
+      "misp-attribute": "text",
+      "ui-priority": 0,
+      "disable_correlation": true
+    },
+    "decompiler-id": {
+      "description": "ghidra's decompiler version used to generate the FID and BSIM hashes.",
+      "misp-attribute": "text",
+      "ui-priority": 0,
+      "disable_correlation": true
+    }
+  },
+  "description": "ghidra function",
+  "meta-category": "ghidra",
+  "name": "ghidra-function",
+  "required": [
+    "function-name",
+    "decompiler-id"
+  ],
+  "uuid": "4679fa5b-a9b4-463a-aaec-1ca563abedde",
+  "version": 1
+}