Skip to content

Instantly share code, notes, and snippets.

@johndpope
Created April 13, 2024 22:36
Show Gist options
  • Save johndpope/add694bcc04f0df134aa9938c12f72ce to your computer and use it in GitHub Desktop.
Save johndpope/add694bcc04f0df134aa9938c12f72ce to your computer and use it in GitHub Desktop.
To load a registry map into Ghidra using Python, you can utilize the Ghidra Python API. Here's an example of how you can achieve this:
python
Copy code
from ghidra.program.model.lang import LanguageID
from ghidra.app.script import GhidraScript
from ghidra.program.model.symbol import SourceType
class LoadRegistryMap(GhidraScript):
def run(self, args):
if len(args) != 1:
print("Usage: LoadRegistryMap <path_to_registry_map>")
return
registry_map_path = args[0]
# Get the current program
program = getCurrentProgram()
# Get the language ID of the program
language_id = program.getLanguageID()
# Load the registry map
symbol_table = program.getSymbolTable()
success = symbol_table.loadRegistryMap(language_id, registry_map_path, SourceType.USER_DEFINED)
if success:
print("Registry map loaded successfully.")
else:
print("Failed to load registry map.")
Explanation:
We define a Ghidra script class named LoadRegistryMap that extends GhidraScript.
In the run method, we check if the script is provided with exactly one argument, which should be the path to the registry map file. If the argument is missing, we print a usage message and return.
We retrieve the current program using getCurrentProgram(). This assumes that you have a program open in Ghidra.
We get the language ID of the program using program.getLanguageID(). The language ID represents the processor architecture and endianness of the program.
We obtain the symbol table of the program using program.getSymbolTable(). The symbol table is where the registry map will be loaded.
We call the loadRegistryMap method on the symbol table, passing the language ID, the path to the registry map file, and the source type (SourceType.USER_DEFINED in this case, indicating that the registry map is user-defined).
The loadRegistryMap method returns a boolean value indicating whether the registry map was loaded successfully. We print a corresponding message based on the success status.
To use this script:
Save the script with a .py extension (e.g., LoadRegistryMap.py) in your Ghidra scripts directory.
Open the program in Ghidra for which you want to load the registry map.
In the Ghidra Python console or script manager, run the script with the path to the registry map file as an argument. For example:
Copy code
LoadRegistryMap("/path/to/registry/map.rmap")
The script will load the registry map into the current program, and you will see the mapped register names in the disassembled code.
Note: Make sure you have the necessary permissions to access and modify the program in Ghidra.
from ghidra.program.model.lang import LanguageID
from ghidra.app.script import GhidraScript
from ghidra.program.model.symbol import SourceType
class LoadRegistryMap(GhidraScript):
def run(self, args):
if len(args) != 1:
print("Usage: LoadRegistryMap <path_to_registry_map>")
return
registry_map_path = args[0]
# Get the current program
program = getCurrentProgram()
# Get the language ID of the program
language_id = program.getLanguageID()
# Load the registry map
symbol_table = program.getSymbolTable()
success = symbol_table.loadRegistryMap(language_id, registry_map_path, SourceType.USER_DEFINED)
if success:
print("Registry map loaded successfully.")
else:
print("Failed to load registry map.")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment