This is a cheatsheet I use for Ghidra scripting.
NOTE: Some of these functions use each other 😄
1
| askFile('Title', 'Okay').toString()
|
Get Python Bytes from Address
1
2
| def get_bytes(address, size):
return bytes(map(lambda b: b & 0xff, getBytes(address, size)))
|
Get Section Bytes (Program Tree)
1
2
3
| def get_section_bytes(section_name):
section = getMemoryBlock(section_name)
return get_bytes(section.getStart(), section.getSize())
|
Get Executable Path
1
| currentProgram.getExecutablePath()
|
Get Program Start Address
1
| currentProgram.getMinAddress()
|
Get Program End Address
1
| currentProgram.getMaxAddress()
|
1
2
3
4
5
6
7
8
9
10
| from ghidra.program.model.listing import CodeUnit
cu = currentProgram.getListing().getCodeUnitAt(addr)
cu.getComment(CodeUnit.EOL_COMMENT)
cu.setComment(CodeUnit.EOL_COMMENT, "Comment text")
def set_comment_eol(address, text, debug=False):
cu = currentProgram.getListing().getCodeUnitAt(address)
if debug is False: cu.setComment(CodeUnit.EOL_COMMENT, text)
if debug is True: print(str(address) + ' | ' + text)
|
Bookmarks
1
| createBookmark(addr, 'category', 'description')
|
Functions
1
2
3
4
5
6
7
8
| from ghidra.program.model.symbol import SourceType
fm = currentProgram.getFunctionManager()
f = fm.getFunctionAt(currentAddress)
f = fm.getFunctionContaining(currentAddress)
f.setName("test", SourceType.USER_DEFINED)
def get_xrefs(address: int):
return [x.getFromAddress() for x in getReferencesTo(get_address(address))]
|
Addresses
1
2
3
4
5
| def get_address(address: int):
return currentProgram.getAddressFactory().getAddress(str(hex(address)))
address = get_address(0x400000)
next_address = address.add(5)
current_address = currentLocation.getAddress()
|
Labels
1
2
3
4
| def get_label(address):
result = currentProgram.getListing().getCodeUnitAt(address)
if result is None: return None
return result.getLabel()
|
Listing
1
2
3
4
5
6
7
| def get_codeunit(address):
return currentProgram.getListing().getCodeUnitAt(address)
codeunit = get_codeunit(address)
mnemonic = codeunit.getMnemonicString()
number_operands = codeunit.getNumOperands()
next_codeunit = codeunit.getNext()
prev_codeunit = codeunit.getPrev()
|
Common Imports
1
2
3
4
5
| from pprint import pprint
from hexdump import hexdump
from ghidra.program.model.lang import OperandType
from ghidra.program.model.listing import CodeUnit
from ghidra.program.flatapi import FlatProgramAPI
|
Load Pickled Object
1
2
| import pickle
data = pickle.load(open('example.pickle', 'rb'))
|
Searching Patterns
1
2
3
4
5
6
7
8
| from ghidra.program.flatapi import FlatProgramAPI
def search_memory(string, max_results=128):
fpi = FlatProgramAPI(getCurrentProgram())
return fpi.findBytes(currentProgram.getMinAddress(), ''.join(['.' if '?' in x else f'\\x{x}' for x in string.split()]), max_results)
addresses = search_memory('55 8b ec 83 ec 20 8b 4? ?? 33')
for address in addresses: print(address)
|
Get Current Program DataTypes
1
2
3
| def get_currentprogram_datatypes():
dataTypeManager = currentProgram.getDataTypeManager()
return dataTypeManager.getAllDataTypes()
|
Enums
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
| from ghidra.program.model.data import EnumDataType
def get_enums():
dataTypeManager = getCurrentProgram().getDataTypeManager()
dts = dataTypeManager.getAllDataTypes()
return [dt for dt in dts if isinstance(dt, EnumDB)]
def enums_to_dict(enums):
r = []
for enum in enums:
d = {}
names = enum.getNames()
for name in names:
d[name] = enum.getValue(name)
r.append(
{
'name': enum.getName(),
'values': d
}
)
return r
enum = EnumDataType("EnumName", length)
enum.add("One", 1)
enum.add("Two", 2)
enum.add("Three", 3)
dataTypeManager.addDataType(enum, None)
|