Skip to content

Instantly share code, notes, and snippets.

View crashingstatic's full-sized avatar

Aaron Sawyer crashingstatic

View GitHub Profile
# Duct-tape Ghidra's PIE problem. Only tested with ELF.
#@category ELF Relocations
#@author CrashingStatic
if 'ELF' in currentProgram.getExecutableFormat():
min_addr_str = str(currentProgram.getImageBase())
if min_addr_str == '00010000':
currentProgram.setImageBase(currentProgram.getAddressFactory().getDefaultAddressSpace().getAddress(0), True)
@crashingstatic
crashingstatic / ModifyMainFunctionSignature.java
Last active May 14, 2025 02:50
Automatically corrects the signature for "main" in Ghidra
import ghidra.app.script.GhidraScript;
import ghidra.app.cmd.function.ApplyFunctionSignatureCmd;
import ghidra.program.model.data.Category;
import ghidra.program.model.data.CategoryPath;
import ghidra.program.model.data.DataType;
import ghidra.program.model.data.FunctionDefinitionDataType;
import ghidra.program.model.data.ProgramBasedDataTypeManager;
import ghidra.program.model.data.PointerDataType;
import ghidra.program.model.data.ParameterDefinition;
import ghidra.program.model.data.ParameterDefinitionImpl;
### Keybase proof
I hereby claim:
* I am crashingstatic on github.
* I am crashingstatic (https://keybase.io/crashingstatic) on keybase.
* I have a public key ASDOBWzPHLGC2VTbiCtyNaVCbSjGm-Gdb8yWqlxOX4c_-go
To claim this, I am signing this object: