Skip to content

Instantly share code, notes, and snippets.

@jcalabres
Last active January 12, 2020 13:57
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save jcalabres/4eac2e3e7facf7c1463e42849367f7d5 to your computer and use it in GitHub Desktop.
Save jcalabres/4eac2e3e7facf7c1463e42849367f7d5 to your computer and use it in GitHub Desktop.
Ghidra functions and strings backtracing
#by jcalabres
import ghidra.framework.Platform
fileinput=open("/root/ghidra_scripts/functions.txt","r")
fileoutput=open("/root/ghidra_scripts/functions_out.txt","w")
separator = "*"
def printAndWrite(line):
print(line)
fileoutput.write(line+"\n")
def readFunctions():
return fileinput.read().split()
def recursiveRef(depth, references):
depth += 1
for i in range(len(references)):
refaddr=references[i].getFromAddress()
if references[i].getReferenceType().getName()=="UNCONDITIONAL_CALL":
references2=getReferencesTo(getFunctionBefore(refaddr).getEntryPoint())
if references2 != None:
printAndWrite((depth+1)*separator+str(getFunctionBefore(refaddr)))
recursiveRef(depth, references2)
else:
depth -=1
return
def run(name,addr):
printAndWrite("*"+name)
references=getReferencesTo(addr)
recursiveRef(0,references)
if __name__ == "__main__":
iterator = currentProgram.getFunctionManager().getFunctions(True)
functions=readFunctions()
for function in iterator:
name = function.getName()
if name in functions:
run(name,function.getEntryPoint())
fileinput.close()
fileoutput.close()
#by jcalabres
import ghidra.framework.Platform
from ghidra.program.util import DefinedDataIterator
fileinput=open("/root/ghidra_scripts/strings.txt","r")
fileoutput=open("/root/ghidra_scripts/strings_out.txt","w")
separator = "*"
def printAndWrite(line):
print(line)
fileoutput.write(line+"\n")
def readStrings():
return fileinput.read().split()
def recursiveRef(depth, references, funcFrom):
depth += 1
for i in range(len(references)):
refaddr=references[i].getFromAddress()
if references[i].getReferenceType().getName()=="DATA":
references2=getReferencesTo(getFunctionBefore(refaddr).getEntryPoint())
if references2 != None:
if str(funcFrom)!=str(getFunctionBefore(refaddr)):
printAndWrite((depth+1)*separator+str(getFunctionBefore(refaddr)))
function=getFunctionBefore(refaddr)
recursiveRef(depth, references2, function)
else:
break
else:
depth-=1
return
def run(name,addr):
printAndWrite("*"+name)
references=getReferencesTo(addr)
recursiveRef(0,references, None)
if __name__ == "__main__":
iterator = DefinedDataIterator.definedStrings(currentProgram,None)
strings=readStrings()
for string in iterator:
value=string.value
if value in strings:
run(value,string.address)
fileinput.close()
fileoutput.close()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment