Ghidra Universal Signatures from text (ApplyUniversalSigs)

This Ghidra script parses .sig files (a simple text-based signature format) and automatically applies accurate function signatures (return types and parameters) to binaries in Ghidra.

Limitations & Alternatives

This script relies on matching function names. If your binary is fully stripped and Ghidra only sees FUN_12345, this script cannot magically guess what the function does. For stripped binaries, you should first use Function ID (FidDb) to identify and rename the functions based on byte-hashes, and then run this script to fix the parameters.

• ghidra-fidb-repo

---

Signature File Syntax (.sig)

The script loads all .sig files found in the signatures/ directory. You can organize them by language or library (e.g., c_std.sig, rust_std.sig, go_crypto.sig).

The format is a simple, space-separated text file. Each line represents one function:

function_name return_type param1_type param1_name param2_type param2_name ...

Rules:

• Lines starting with # are treated as comments and ignored.
• Blank lines are ignored.
• Return type is mandatory (use void or () if there is none).
• Parameters must come in pairs (type followed by name).

Examples:

C / C++:

# Basic C function with pointers
memcpy void* void* dest const_void* src size_t n

# Pointers to pointers
my_custom_c_func int size_t len const_char** str_array

Rust:

# Standard Rust function returning a Result
std::fs::read_to_string Result<String> &str path

# Vector manipulation
std::vec::Vec<T>::push void &mut_Vec<T> self T value

Go:

# Go strings and slices
fmt.Println int int n string text slice<interface> args

---

How to use it:

1. Open your binary in the Ghidra GUI.
2. Go to Window → Script Manager.
3. Click the "Manage Script Directories" button (the small list/folder icon in the top right).
4. Add the folder where you cloned this repository (or copy the contents into your ghidra_scripts folder).
5. Refresh the script list.
6. Find ApplyUniversalSigs.java and double-click to run it!

The script will iterate through all loaded .sig files and print out every function it successfully matched and updated in the Ghidra console.