{"componentChunkName":"component---src-templates-post-template-js","path":"/ghidra-ghidrascript-utils-en","result":{"data":{"markdownRemark":{"id":"46bb13c3-28de-52ee-8afc-ec8b57db4cf2","html":"
\n

This page has been machine-translated from the original page.

\n
\n

Originally, this was a collection of Ghidra Script samples that I had introduced in the article Solving a CTF Challenge with Your First Ghidra Script, but as the number of examples grew and because I plan to start using Ghidra more seriously from here on, I decided to split them out into a separate article.

\n

From the feel of using it, I think it might be better to write scripts in Java rather than Python (Jython), but for the time being I am creating scripts in Python.

\n

For the runtime, I am using Ghidra’s default one rather than Ghidrathon.

\n\n

Table of Contents

\n\n

\n

Get the Decompiler Output of a Function

\n

The following script outputs the decompiler result for the function currently selected in the Listing window.

\n
from ghidra.app.decompiler import DecompInterface\n\n# Decompile インターフェースを取得\ndecomp = DecompInterface()\ndecomp.openProgram(currentProgram)\n\n# currentAddress には、Listing で選択している行のアドレスが自動的に参照される\n# そのため、事前にターゲットになる関数のアドレスを選択しておく\nfunc = fpapi.getFunctionContaining(currentAddress)\ndecomp_results = decomp.decompileFunction(func, 30, monitor)\n\nif decomp_results.decompileCompleted():\n    pp = PrettyPrinter(fn, decomp_results.getCCodeMarkup())\n    code = pp.print(False).getC()\n    print(code)\nelse:\n    print(\"There was an error in decompilation!\")
\n

\n

Get the Function and Data for a Specific Address

\n

The following script lets you specify an offset to retrieve the function name for an arbitrary address, or retrieve the data at a specified address.

\n
# Listing 情報を取得(ghidra.program.database.ListingDB)\nlisting = currentProgram.getListing()\n\n# オフセットを指定して GenericAddress オブジェクトを取得\nfpapi = FlatProgramAPI(currentProgram)\naddr = fpapi.toAddr(0x1024aa)\n\n# 指定したアドレスを含む関数を取得\nfunc = fpapi.getFunctionContaining(addr)\nprint(func.getName()) # 関数名の表示\n\n# データを取得するアドレスを指定\naddr = fpapi.toAddr(0x102cd1)\n\n# 指定アドレスのデータを取得\ndata = listing.getDataAt(addr)\nprint(data.getValue()) # ghidra.program.model.scalar.Scalar\n\n# 指定 AddressSet の範囲で DataIterator オブジェクトを取得\n# 指定の範囲でbelow. AddressSet を取得する\nfrom ghidra.program.model.address import Address, AddressSet\nfactory = currentProgram.getAddressFactory()\n\n# 指定のオフセットから 0x100 分の範囲を指定\naddr_set = AddressSet()\naddr_set.add(addr, addr.add(0x100))\n\n# 指定の範囲のデータを先頭から取得\ndata_iterator = listing.getData(addr_set, True)\nfor data in data_iterator:\n    print(data.getValue())\n    \n# 特定のアドレスのオペコードとオペランドを取得\naddr = toAddr(0x1000000)\ninst = getInstructionAt(addr)\n# オペランドの取得\ninst.getDefaultOperandRepresentation(0)\ninst.getDefaultOperandRepesentation(1)\n# 次の行の情報を取得できる\ninst.getNext()\ninst.getDefaultOperandRepresentation(0)\ninst.getDefaultOperandRepesentation(1)
\n

\n

Enumerate Call Instructions Within a Function

\n

The following code enumerates Call instructions within a function.

\n

You need to use different retrieval methods depending on whether you want to preserve the call order.

\n
# currentAddress is ghidra.program.model.address.GenericAddress\n# currentAddress には、Listing で選択している行のアドレスが自動的に参照される\n\nfunc_mgr = currentProgram.getFunctionManager()\nfunc = func_mgr.getFunctionContaining(currentAddress)\n\n# Call order is not preserved here\ncalls = func.getCalledFunctions(monitor)\nfor c in calls:\n    print(c)\n\n# Listing 情報を取得(ghidra.program.database.ListingDB)\nlisting = currentProgram.getListing()\n\n# 関数内の Call 命令を順に列挙することで呼び出し順序を維持して出力する\nfor i in listing.getInstructions(func.body, True):\n    print(i)
\n

\n

Enumerate the Names of Functions Called by Call Instructions Executed Within a Specified Address Range

\n

The following script enumerates the symbol names of functions called by Call instructions executed within the specified address range.

\n

I used it in the following challenge.

\n

Reference: Cake CTF 2023 Writeup - nande

\n
from ghidra.program.flatapi import FlatProgramAPI\nfrom ghidra.program.model.address import AddressSet\n\nlisting = currentProgram.getListing()\nfpapi = FlatProgramAPI(currentProgram)\nstart_addr = fpapi.toAddr(0x1043c9)\nend_addr = fpapi.toAddr(0x104825)\n\naddr_set = AddressSet()\naddr_set.add(start_addr, end_addr)\n\nfor p in listing.getInstructions(addr_set, True):\ncode = p.toString()\nif \"CALL\" in code:\nfunc_addr = int(code.split(\" \")[1],16)\nfpapi.getFunctionContaining(fpapi.toAddr(func_addr)).getName()
\n

\n

Get a Sequence of Hard-Coded Byte Arrays from Disassembly

\n

The following code lets you extract operands sequentially from a series of assembly instructions.

\n
# 特定アドレスから 0x26 バイト分のオペランドを取得する\naddr = toAddr(0x109011)\ninst = getInstructionAt(addr)\nresult = []\nfor i in range(0x26):\n    result.append(inst.getDefaultOperandRepresentation(1))\n    inst = inst.getNext()\n\nprint(result)
\n

\n

Identify Structure Information at a Specific Address and Retrieve Its Values

\n

The following code identifies structure information at a specific address and retrieves its values.

\n

I used it in the following challenge.

\n

Reference: AmateursCTF 2023 Writeup - CSCE221-Data Structures and Algorithms

\n
from ghidra.app.script import GhidraScript\n\n# list の取得\nstart_address = toAddr(\"0x404000\")\ndata_section = currentProgram.getMemory().getBlock(start_address)\ndata_address = toAddr(\"0x404060\")\ndata_object = getDataAt(data_address)\n\n# 自作した list 構造体が解釈される\ndata_structure = data_object.dataType\ndata_component = data_structure.getComponent(0x0)\n# Get the relative offset, length and data type of the component\noffset = data_component.offset\nlength = data_component.length\ndata_type = data_component.dataType\n\n# list 構造体から int 分の値を取得\nbyte_array = getBytes(data_address.add(offset), length)\nprint(hex(byte_array[0]))\n\n# Get the address of the .data section\nstart_address = toAddr(\"0x404000\")\ndata_section = currentProgram.getMemory().getBlock(start_address)\n# list のアドレス\ndata_address = toAddr(\"0x404060\")\ndata_object = getDataAt(data_address)
\n

\n

Assign a Structure to a Specific Address and Retrieve Its Values

\n

This script lets you define data in an arbitrary address range as a structure and inspect its values.

\n

I used it in the following challenge.

\n

Reference: AmateursCTF 2023 Writeup - CSCE221-Data Structures and Algorithms

\n
# listnode の取\ndata_type_manager = currentProgram.getDataTypeManager()\nmy_structure = data_type_manager.getDataType(\"main.coredump/listnode\")\nstart_address = toAddr(\"0x405000\")\ndata_section = currentProgram.getMemory().getBlock(start_address)\n\nflag = \"\"\nlistnode_addr = 0x4052a0\n\n# listnode\ndata_address = toAddr(hex(listnode_addr))\ndata_object = createData(data_address, my_structure)\n\n# 自作した listnode 構造体が解釈される\ndata_structure = data_object.dataType\ndata_component = data_structure.getComponent(0x0)\n\n# Get the relative offset, length and data type of the component\noffset = data_component.offset\nlength = data_component.length\ndata_type = data_component.dataType\n\n# listnode 構造体から byte 分の値を取得\nbyte_array = getBytes(data_address.add(offset), length)\nflag += chr(byte_array[0])
\n

\n

Save Byte Data from an Arbitrary Address Range as a File

\n

This script is useful when a section contains embedded encrypted data or similar and copying it manually would be cumbersome.

\n

It simply retrieves the data from an arbitrary address range one byte at a time and writes it to a file.

\n
from ghidra.program.model.address import Address\nfrom ghidra.program.model.mem import MemoryAccessException\nimport struct\n\ndef save_bytes_to_file(start_address, end_address, filename):\n    currentProgram = getCurrentProgram()\n    memory = currentProgram.getMemory()\n    start_addr = toAddr(start_address)\n    end_addr = toAddr(end_address)\n    with open(filename, \"wb\") as file:\n        address = start_addr\n        while address <= end_addr:\n            try:\n                byte = memory.getByte(address)\n                file.write(struct.pack(\"B\", byte))\n                address = address.next()\n            except MemoryAccessException as e:\n                print(\"Error reading memory at address:\", address, e)\n                break\n\nstart_address = 0x403040\nend_address = 0x403000 + 0x1ce00 - 1\nfilename = \"C:\\\\Users\\\\Public\\\\output.bin\"\nsave_bytes_to_file(start_address, end_address, filename)
\n

\n

Summary

\n

I feel that there will be even more things you can do once you get comfortable with Ghidra Script.

\n

However, Ghidra’s default Jython is old, and overwhelmingly most published sample scripts are in Java, so if you want to use it seriously, it might be better to study Java.

","fields":{"slug":"/ghidra-ghidrascript-utils-en","tagSlugs":["/tag/reversing-en/","/tag/ghidra-en/","/tag/english/"]},"frontmatter":{"date":"2024-07-15","description":"A collection of Ghidra Script samples by use case","tags":["Reversing (en)","Ghidra (en)","English"],"title":"Ghidra Script Samples by Use Case","socialImage":{"publicURL":"/static/9da27646267266fe15d51cabfaa57fc2/ghidra-ghidrascript-utils.png"}}}},"pageContext":{"slug":"/ghidra-ghidrascript-utils-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}