A collection of pwn/CTF related utilities for Ghidra
This utility will attempt to replace known constants in functions with their human readable counterpart.
This utility will attempt to find and identify system calls (and arguments).
The correct workflow to convert displayed data in an operand is to right click
the value and select the conversion type under the
Convert submenu, however,
on request I have made a script to convert the display type of operands to
char so it can be used with a keyboard shortcut for convenience (IDA style).
To use it select the
In Tool option of the
ConvertCharacter.py script and
then select a numeric operand and hit
shift+r to convert to a string. You
can change the shortcut by editing the line that contains the comment with
keybinding in it at the top of the script.
Clone the repository or download and extract somewhere. In Ghidra, open
Script Manager (
Script Manager) click the
Script Directory buttom and add
pwndra/scripts to the list.
Once the script directory is added to Ghidra you can find the scripts in
Pwn category. You can run the scripts directly from the
Script Manager if you like but the scripts also have menus and keyboard shortcuts
for ease of use. In order to activate the menus and shortcuts you must
In Tool checkbox next to the scripts you wish to integrate
into the tool.
If you clicked
In Tool the menus will be under
any shortcuts for scripts are listed in the menu item that uses that
There are several frontends available:
- arm (oabi/eabi)
- mips (n32/o32/n64)
You can either run one of those frontend scripts directly (through the
Script Manager or if you clicked
In Tool you can access a menu;
There is an
Auto frontend that will automatically detect the current loaded
program for you. This can also be accessed with the keyboard shortcut which
is specified in the menu item for the tool.
The scripts have two modes of operation, the default is to operate globally,
the second is to only operate on a given selection. This is useful for those
times where you have two binary modes interlaced in the same code such as