Skip to content

Instantly share code, notes, and snippets.

@daniellimws
Created August 2, 2020 04:39
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save daniellimws/eb0739e4bac6b5c7972d29b4bc6e2f7d to your computer and use it in GitHub Desktop.
Save daniellimws/eb0739e4bac6b5c7972d29b4bc6e2f7d to your computer and use it in GitHub Desktop.
Ghidra script to demangle Rust symbols
# Demangle swift function names
# A script can be easily created in the Script Manager window
# Make sure https://github.com/luser/rustfilt is installed on your system
#@author Daniel Lim
#@category Demangler.Rust
#@keybinding
#@menupath
#@toolbar
from subprocess import Popen, PIPE
from ghidra.program.model.symbol import SourceType
from ghidra.program.model.listing import CodeUnit
functionManager = currentProgram.getFunctionManager()
# Get functions in ascending order
fns = functionManager.getFunctions(True)
for f in fns:
f_name = f.getName()
# Is it a mangled name?
if not (f_name.startswith("_ZN") or f_name.startswith("_R")):
continue
previous_comment = f.getComment()
if not previous_comment:
previous_comment = ""
rustfilt = Popen(['rustfilt'], stdin=PIPE, stdout=PIPE)
signature = rustfilt.communicate(input=f_name)[0]
# Replace characters we can't have in our name
signature = signature.split("(")[0]
signature = signature.replace(" ", "_")
f.setName(signature, SourceType.ANALYSIS)
@andylizi
Copy link

With progress bar support:

-- snip --

# Get functions in ascending order
monitor.initialize(functionManager.getFunctionCount())
fns = functionManager.getFunctions(True)
for f in fns:
    monitor.incrementProgress(1)
    f_name = f.getName()

-- snip --

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment