-
-
Save johndpope/add694bcc04f0df134aa9938c12f72ce to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
To load a registry map into Ghidra using Python, you can utilize the Ghidra Python API. Here's an example of how you can achieve this: | |
python | |
Copy code | |
from ghidra.program.model.lang import LanguageID | |
from ghidra.app.script import GhidraScript | |
from ghidra.program.model.symbol import SourceType | |
class LoadRegistryMap(GhidraScript): | |
def run(self, args): | |
if len(args) != 1: | |
print("Usage: LoadRegistryMap <path_to_registry_map>") | |
return | |
registry_map_path = args[0] | |
# Get the current program | |
program = getCurrentProgram() | |
# Get the language ID of the program | |
language_id = program.getLanguageID() | |
# Load the registry map | |
symbol_table = program.getSymbolTable() | |
success = symbol_table.loadRegistryMap(language_id, registry_map_path, SourceType.USER_DEFINED) | |
if success: | |
print("Registry map loaded successfully.") | |
else: | |
print("Failed to load registry map.") | |
Explanation: | |
We define a Ghidra script class named LoadRegistryMap that extends GhidraScript. | |
In the run method, we check if the script is provided with exactly one argument, which should be the path to the registry map file. If the argument is missing, we print a usage message and return. | |
We retrieve the current program using getCurrentProgram(). This assumes that you have a program open in Ghidra. | |
We get the language ID of the program using program.getLanguageID(). The language ID represents the processor architecture and endianness of the program. | |
We obtain the symbol table of the program using program.getSymbolTable(). The symbol table is where the registry map will be loaded. | |
We call the loadRegistryMap method on the symbol table, passing the language ID, the path to the registry map file, and the source type (SourceType.USER_DEFINED in this case, indicating that the registry map is user-defined). | |
The loadRegistryMap method returns a boolean value indicating whether the registry map was loaded successfully. We print a corresponding message based on the success status. | |
To use this script: | |
Save the script with a .py extension (e.g., LoadRegistryMap.py) in your Ghidra scripts directory. | |
Open the program in Ghidra for which you want to load the registry map. | |
In the Ghidra Python console or script manager, run the script with the path to the registry map file as an argument. For example: | |
Copy code | |
LoadRegistryMap("/path/to/registry/map.rmap") | |
The script will load the registry map into the current program, and you will see the mapped register names in the disassembled code. | |
Note: Make sure you have the necessary permissions to access and modify the program in Ghidra. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
from ghidra.program.model.lang import LanguageID | |
from ghidra.app.script import GhidraScript | |
from ghidra.program.model.symbol import SourceType | |
class LoadRegistryMap(GhidraScript): | |
def run(self, args): | |
if len(args) != 1: | |
print("Usage: LoadRegistryMap <path_to_registry_map>") | |
return | |
registry_map_path = args[0] | |
# Get the current program | |
program = getCurrentProgram() | |
# Get the language ID of the program | |
language_id = program.getLanguageID() | |
# Load the registry map | |
symbol_table = program.getSymbolTable() | |
success = symbol_table.loadRegistryMap(language_id, registry_map_path, SourceType.USER_DEFINED) | |
if success: | |
print("Registry map loaded successfully.") | |
else: | |
print("Failed to load registry map.") |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment