Contents

Ghidra Python Scripting Cheatsheet

This is a cheatsheet I use for Ghidra scripting.

NOTE: Some of these functions use each other 😄

User Input

1
askFile('Title', 'Okay').toString()

Get Python Bytes from Address

1
2
def get_bytes(address, size):
	return bytes(map(lambda b: b & 0xff, getBytes(address, size)))

Get Section Bytes (Program Tree)

1
2
3
def get_section_bytes(section_name):
	section = getMemoryBlock(section_name)
	return get_bytes(section.getStart(), section.getSize())

Get Executable Path

1
currentProgram.getExecutablePath()

Get Program Start Address

1
currentProgram.getMinAddress()

Get Program End Address

1
currentProgram.getMaxAddress()

Comments

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
from ghidra.program.model.listing import CodeUnit

cu = currentProgram.getListing().getCodeUnitAt(addr)
cu.getComment(CodeUnit.EOL_COMMENT)
cu.setComment(CodeUnit.EOL_COMMENT, "Comment text")

def set_comment_eol(address, text, debug=False):
    cu = currentProgram.getListing().getCodeUnitAt(address)
    if debug is False: cu.setComment(CodeUnit.EOL_COMMENT, text)
    if debug is True: print(str(address) + ' | ' + text)

Bookmarks

1
createBookmark(addr, 'category', 'description')

Functions

1
2
3
4
5
6
7
8
from ghidra.program.model.symbol import SourceType
fm = currentProgram.getFunctionManager()
f = fm.getFunctionAt(currentAddress)
f = fm.getFunctionContaining(currentAddress)
f.setName("test", SourceType.USER_DEFINED)

def get_xrefs(address: int):
    return [x.getFromAddress() for x in getReferencesTo(get_address(address))]

Addresses

1
2
3
4
5
def get_address(address: int):
	return currentProgram.getAddressFactory().getAddress(str(hex(address)))
address = get_address(0x400000)
next_address = address.add(5)
current_address = currentLocation.getAddress()

Labels

1
2
3
4
def get_label(address):
	result = currentProgram.getListing().getCodeUnitAt(address)
	if result is None: return None
	return result.getLabel()

Listing

1
2
3
4
5
6
7
def get_codeunit(address):
	return currentProgram.getListing().getCodeUnitAt(address)
codeunit = get_codeunit(address)
mnemonic = codeunit.getMnemonicString()
number_operands = codeunit.getNumOperands()
next_codeunit = codeunit.getNext()
prev_codeunit = codeunit.getPrev()

Common Imports

1
2
3
4
5
from pprint import pprint
from hexdump import hexdump
from ghidra.program.model.lang import OperandType
from ghidra.program.model.listing import CodeUnit
from ghidra.program.flatapi import FlatProgramAPI

Load Pickled Object

1
2
import pickle
data = pickle.load(open('example.pickle', 'rb'))

Searching Patterns

1
2
3
4
5
6
7
8
from ghidra.program.flatapi import FlatProgramAPI

def search_memory(string, max_results=128):
	fpi = FlatProgramAPI(getCurrentProgram())
	return fpi.findBytes(currentProgram.getMinAddress(), ''.join(['.' if '?' in x else f'\\x{x}' for x in string.split()]), max_results)

addresses = search_memory('55 8b ec 83 ec 20 8b 4? ?? 33')
for address in addresses: print(address)

Get Current Program DataTypes

1
2
3
def get_currentprogram_datatypes():
    dataTypeManager = currentProgram.getDataTypeManager()
    return dataTypeManager.getAllDataTypes()

Enums

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
from ghidra.program.model.data import EnumDataType

def get_enums():
    dataTypeManager = getCurrentProgram().getDataTypeManager()
    dts = dataTypeManager.getAllDataTypes()
    return [dt for dt in dts if isinstance(dt, EnumDB)]

def enums_to_dict(enums):
    r = []
    for enum in enums:
        d = {}
        names = enum.getNames()
        for name in names:
            d[name] = enum.getValue(name)
        r.append(
            {
                'name': enum.getName(),
                'values': d
            }
        )
    return r
enum = EnumDataType("EnumName", length)
enum.add("One", 1)
enum.add("Two", 2)
enum.add("Three", 3)
dataTypeManager.addDataType(enum, None)