Skip to content

Some Ghidra scripts to automate my reverse-engineering tasks

License

Notifications You must be signed in to change notification settings

kohnakagawa/ghidra_scripts

Repository files navigation

Ghidra scripts

This repository contains some Ghidra scripts to automate my reverse-engineering tasks.

About scripts in this repo

This script calculates the Cyclomatic complexities for all functions of the current program. It can be used for finding the complex functions.

This script shows the frequently-called functions.

This script searches the function call passing a specific value.

For example, consider the case where you want to look for the function call of RtlpImageDirectoryEntryToDataEx() whose third argument is IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT (0xd).

By using this script, you can search such a call site by typing RtlpImageDirectoryEntryToDataEx(_, _, 0xd, _, _)

Input for searching

input

Search results

result

This script is for testing Ghidra SymbolicPropagator. Note that it only works for the analysis of KernelBase.dll

This scripts finds the potential vulnerable sscanf function call patterns via a P-Code analysis. Insipred by this ZDI blog post.

IDE setup

Python scripting

I think the best way to develop a Ghidra Python script is to use PyCharm because all type completions work fine. Please follow here for more details.

Since the ghidra-pyi-generator does not provide the .pyi type stubs for Ghidra 9.2, I have newly created the .pyi type stubs for Ghidra 9.2. If you are using the Ghidra 9.2, please use these stubs.

Java scripting

I think it is better to use Eclipse with GhidraDev plugin when using Java. Please follow the Ghidra official documentation.

Author

Koh M. Nakagawa

License

MIT License

About

Some Ghidra scripts to automate my reverse-engineering tasks

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages