Last active
January 12, 2020 13:57
-
-
Save jcalabres/4eac2e3e7facf7c1463e42849367f7d5 to your computer and use it in GitHub Desktop.
Ghidra functions and strings backtracing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#by jcalabres | |
import ghidra.framework.Platform | |
fileinput=open("/root/ghidra_scripts/functions.txt","r") | |
fileoutput=open("/root/ghidra_scripts/functions_out.txt","w") | |
separator = "*" | |
def printAndWrite(line): | |
print(line) | |
fileoutput.write(line+"\n") | |
def readFunctions(): | |
return fileinput.read().split() | |
def recursiveRef(depth, references): | |
depth += 1 | |
for i in range(len(references)): | |
refaddr=references[i].getFromAddress() | |
if references[i].getReferenceType().getName()=="UNCONDITIONAL_CALL": | |
references2=getReferencesTo(getFunctionBefore(refaddr).getEntryPoint()) | |
if references2 != None: | |
printAndWrite((depth+1)*separator+str(getFunctionBefore(refaddr))) | |
recursiveRef(depth, references2) | |
else: | |
depth -=1 | |
return | |
def run(name,addr): | |
printAndWrite("*"+name) | |
references=getReferencesTo(addr) | |
recursiveRef(0,references) | |
if __name__ == "__main__": | |
iterator = currentProgram.getFunctionManager().getFunctions(True) | |
functions=readFunctions() | |
for function in iterator: | |
name = function.getName() | |
if name in functions: | |
run(name,function.getEntryPoint()) | |
fileinput.close() | |
fileoutput.close() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#by jcalabres | |
import ghidra.framework.Platform | |
from ghidra.program.util import DefinedDataIterator | |
fileinput=open("/root/ghidra_scripts/strings.txt","r") | |
fileoutput=open("/root/ghidra_scripts/strings_out.txt","w") | |
separator = "*" | |
def printAndWrite(line): | |
print(line) | |
fileoutput.write(line+"\n") | |
def readStrings(): | |
return fileinput.read().split() | |
def recursiveRef(depth, references, funcFrom): | |
depth += 1 | |
for i in range(len(references)): | |
refaddr=references[i].getFromAddress() | |
if references[i].getReferenceType().getName()=="DATA": | |
references2=getReferencesTo(getFunctionBefore(refaddr).getEntryPoint()) | |
if references2 != None: | |
if str(funcFrom)!=str(getFunctionBefore(refaddr)): | |
printAndWrite((depth+1)*separator+str(getFunctionBefore(refaddr))) | |
function=getFunctionBefore(refaddr) | |
recursiveRef(depth, references2, function) | |
else: | |
break | |
else: | |
depth-=1 | |
return | |
def run(name,addr): | |
printAndWrite("*"+name) | |
references=getReferencesTo(addr) | |
recursiveRef(0,references, None) | |
if __name__ == "__main__": | |
iterator = DefinedDataIterator.definedStrings(currentProgram,None) | |
strings=readStrings() | |
for string in iterator: | |
value=string.value | |
if value in strings: | |
run(value,string.address) | |
fileinput.close() | |
fileoutput.close() |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment