Ghidra scripts
This repository contains some Ghidra scripts to automate my reverse-engineering tasks.
About scripts in this repo
CalcCyclomaticForAllFunctions.py
This script calculates the Cyclomatic complexities for all functions of the current program. It can be used for finding the complex functions.
FindFrequentlyUsedFunctions.py
This script shows the frequently-called functions.
SearchFunctionCallPattern.py
This script searches the function call passing a specific value.
For example, consider the case where you want to look for the function call of RtlpImageDirectoryEntryToDataEx()
whose third argument is IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT
(0xd
).
By using this script, you can search such a call site by typing RtlpImageDirectoryEntryToDataEx(_, _, 0xd, _, _)
Input for searching
Search results
TestSymbolicPropagator.py
This script is for testing Ghidra SymbolicPropagator.
Note that it only works for the analysis of KernelBase.dll
SearchVulnSscanf.py
This scripts finds the potential vulnerable sscanf
function call patterns via a P-Code analysis.
Insipred by this ZDI blog post.
IDE setup
Python scripting
I think the best way to develop a Ghidra Python script is to use PyCharm because all type completions work fine. Please follow here for more details.
Since the ghidra-pyi-generator does not provide the .pyi
type stubs for Ghidra 9.2,
I have newly created the .pyi
type stubs for Ghidra 9.2.
If you are using the Ghidra 9.2, please use these stubs.
Java scripting
I think it is better to use Eclipse with GhidraDev plugin when using Java. Please follow the Ghidra official documentation.
Author
Koh M. Nakagawa