This repository contains some Ghidra scripts to automate my reverse-engineering tasks.
This script calculates the Cyclomatic complexities for all functions of the current program. It can be used for finding the complex functions.
This script shows the frequently-called functions.
This script searches the function call passing a specific value.
For example, consider the case where you want to look for the function call of RtlpImageDirectoryEntryToDataEx() whose third argument is IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT (0xd).
By using this script, you can search such a call site by typing RtlpImageDirectoryEntryToDataEx(_, _, 0xd, _, _)
Input for searching
Search results
This script is for testing Ghidra SymbolicPropagator.
Note that it only works for the analysis of KernelBase.dll
This scripts finds the potential vulnerable sscanf function call patterns via a P-Code analysis.
Insipred by this ZDI blog post.
I think the best way to develop a Ghidra Python script is to use PyCharm because all type completions work fine. Please follow here for more details.
Since the ghidra-pyi-generator does not provide the .pyi type stubs for Ghidra 9.2,
I have newly created the .pyi type stubs for Ghidra 9.2.
If you are using the Ghidra 9.2, please use these stubs.
I think it is better to use Eclipse with GhidraDev plugin when using Java. Please follow the Ghidra official documentation.
Koh M. Nakagawa