ghidra_scripts

KO | EN

gitlite — search

#javascript #hacktoberfest #ai #golang #go #android #machine-learning #rust #docker #java #cli #pytorch #ios #openai

(★ 26)

My scripts for Ghidra.

ghidra_scripts Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Ghidra scripts

- [Ghidra scripts](#ghidra-scripts)
  - [Installing scripts](#installing-scripts)
  - [External references search](#external-references-search)
    - [Instructions](#instructions)
  - [Find Local XRefs in Decompiler's window](#find-local-xrefs-in-decompilers-window)
    - [Instructions](#instructions-1)
  - [Set entry points in selection](#set-entry-points-in-selection)
    - [Instructions](#instructions-2)
  - [Remove all references](#remove-all-references)
    - [From address](#from-address)
    - [To address](#to-address)
    - [Instructions](#instructions-3)
  - [FindMultipleLabels](#findmultiplelabels)
    - [Instructions](#instructions-4)
  - [FindNeededFunctions](#findneededfunctions)
    - [Instructions](#instructions-5)
  - [BasicBlockModelExample](#basicblockmodelexample)
    - [Instructions](#instructions-6)
  - [Example of parsing PE header](#example-of-parsing-pe-header)
    - [Instructions](#instructions-7)
  - [Printing ASM/PCode/PCodeHigh/C](#printing-asmpcodepcodehighc)
    - [Instructions](#instructions-8)
  - [Printing PCode](#printing-pcode)
    - [Instructions](#instructions-9)
  - [Set default calling convention for functions in Selection](#set-default-calling-convention-for-functions-in-selection)
    - [Instructions](#instructions-10)
  - [Find references of the field of a structure](#find-references-of-the-field-of-a-structure)
    - [Instructions](#instructions-11)
  - [Rename functions in the Selection](#rename-functions-in-the-selection)
    - [Instructions](#instructions-12)
  - [Function Renaming (names are taken from a file)](#function-renaming-names-are-taken-from-a-file)
    - [Instructions](#instructions-13)

## Installing scripts

Please read `${GHIDRA_HOME}/docs/GhidraClass/Intermediate/Scripting_withNotes.html` and *Ghidra Script Manager* section of Help.

## External references search

| :information_source: | [Source file](./FindExternalReferences.java) |
| -------------------- | -------------------------------------------- |

Script finds all references to the functions and data from all external programs (shared libraries), then creates additional memory blocks and transfer all info about functions (name, signature, additional info) and data (name, also create comment with value and annotation with link to external program). A source type of symbols will be `IMPORTED`, a source type of parameters will be `IMPORTED`, if parameters of the original function don't have `DEFAULT` source type, otherwise a source type will be `DEFAULT` too.

### Instructions

1. Import binary file.
2. Analyze it.
3. Add needed external programs (see Figure 1):
    - `Window → External Programs`
    - `Add External Program Name`
    - `Set External Name Association`

![External programs](https://raw.githubusercontent.com/saruman9/ghidra_scripts/master/images/external_programs.png)
    > Figure 1. Added External Programs

4. Run the script (choose memory blocks if needed, see Figure 2).

![Choose segments](https://raw.githubusercontent.com/saruman9/ghidra_scripts/master/images/choose_segments.png)
    > Figure 2. Choose needed memory blocks

| Before                         | After                        |
| ------------------------------ | ---------------------------- |
| ![Before](https://raw.githubusercontent.com/saruman9/ghidra_scripts/master/images/before.png) | ![After](https://raw.githubusercontent.com/saruman9/ghidra_scripts/master/images/after.png) |
> Figure 3. Before and after running the script

| :information_source: | You can run the script multiple times. |
| -------------------- | -------------------------------------- |

:warning: **Warning:**

>>>

- script will not change user-defined symbols (you should delete user-defined symbols, if you want to import information from external symbols);

- you should look symbols with `Global` namespace (not external) for finding xrefs to external functions and data (see Figure 4).

>>>

![In memory located symbols](https://raw.githubusercontent.com/saruman9/ghidra_scripts/master/images/in_memory_located_symbols.png)
> Figure 4. Symbol with `Global` Namespace have true references

## Find Local XRefs in Decompiler's window

| :information_source: | [Source file](./FindLocalXRefs.java) |
| -------------------- | ------------------------------------ |

The script try to find all references for local variables in Decompiler's window like in IDA Pro or Binary Ninja.

### Instructions

1. Make a highlight of needed variables (see Figure 5). You can use middle button of a mouse or other algorithms for highlighting, for example Def-Use, Forward Slice, etc.
2. Run the script or press Ctrl-X.

![XRefs for local variables](https://raw.githubusercontent.com/saruman9/ghidra_scripts/master/images/xrefs.gif)
> Figure 5. XRefs to local variables

## Set entry points in selection

| :information_source: | [Source file](./SetEntryPointsInSelection.java) |
| -------------------- | ----------------------------------------------- |

Script set all labels (functions) in selection as Entry Point.

### Instructions

1. Select required functions through Functions window.
2. Run the script.

## Remove all references

Use for clearing of the analysis results.

### From address

| :information_source: | [Source file](./RemoveAllReferencesFromAddress.java) |
| -------------------- | ---------------------------------------------------- |

### To address

| :information_source: | [Source file](./RemoveAllReferencesToAddress.java) |
| -------------------- | -------------------------------------------------- |

### Instructions

1. Select addresses or set the cursor to one address.
2. Run the script.

## FindMultipleLabels

Print all symbols (and their addresses) with multiple labels. Maybe useful for Version Tracking session.

| :information_source: | [Source file](./FindMultipleLabels.java) |
| -------------------- | ---------------------------------------- |

### Instructions

1. Run the script.

## FindNeededFunctions

| :information_source: | [Source file](./FindNeededFunctions.java) |
| -------------------- | ----------------------------------------- |

Find all functions with parameters, which will be dereferenced.

### Instructions

1. Run the script.

## BasicBlockModelExample

| :information_source: | [Source file](./BasicBlockModelExample.java) |
| -------------------- | -------------------------------------------- |

Prints all basic blocks of the program (change the source code for printing an interesting information) with sources and destinations information (other basic blocks).

### Instructions

1. Run the script.

## Example of parsing PE header

| :information_source: | [Source file](./GetEntryPoints.java) |
| -------------------- | ------------------------------------ |

The script parses PE header and print an entry point address (address of a valid function) from optional header.

### Instructions

1. Run the script.

## Printing ASM/PCode/PCodeHigh/C

| :information_source: | [Source file](./PrintCodeHeadless.java) |
| -------------------- | --------------------------------------- |

The script should be used in headless mode. May be useful for debugging of a decompiler and writing Sleigh code. The script can print ASM code, PCode, PCodeHigh, decompiling C code (use arguments).

:warning: **Warning:**

>>>

- the script can damage the target project, you should to watch the arguments for GhidraHeadless.

>>>

### Instructions

See comments in the script file.

## Printing PCode

| :information_source: | [Source file](./PrintPCode.java) |
| -------------------- | -------------------------------- |

The script prints high PCode to console. May be useful for debugging of a decompiler. You should know, that the AST of high PCode and the AST of any varnode may be different in a scope of the same function.

### Instructions

1. Run the script.

## Set default calling convention for functions in Selection

| :information_source: | [Source file](./SetDefaultCallingConvInSelection.java) |
| -------------------- | ------------------------------------------------------ |

The script set default convention (see Language ID) for all functions in the selection.

### Instructions

1. Select needed functions. I recommend do it through Functions window, where you can sort and filter functions.

1. Run the script.

## Find references of the field of a structure

| :information_source: | [Source file](./FindRefsField.java) |
| -------------------- | ----------------------------------- |

The script finds all references to the field of a structure.

### Instructions

1. Set cursor at the field of a structure in the Decompiler window.
1. Run the script.

## Rename functions in the Selection

| :information_source: | [Source file](./RenameFunctionsInSelection.java) |
| -------------------- | ------------------------------------------------ |

The script rename all functions in the selection to one name.

### Instructions

1. Select all needed functions (bytes) for renaming.
1. Run the script.

## Function Renaming (names are taken from a file)

| :information_source: | [Source file](./FunctionsRename.java) |
| -------------------- | ------------------------------------- |

This script renames all functions listed in a file using the following format:

```text
ADDRESS : FUNCTION_NAME
```

### Instructions

1. Run the script.
2. Select the file containing the function names to import.
3. Check the console for information about the renamed functions.

ghidra_scripts

ghidra_scripts Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

ghidra_scripts

ghidra_scripts Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README