jthuraisamy

GhostLoader Steps :)

1. Create C:\Tools
2. Copy Some .NET, any .NET binary to C:\Tools
3. In this example, we use FileHistory.exe, but any .NET app will do.
4. Ensure FileHistory.exe.config is in the same path
5. Execute C:\Tools\FileHistory.exe

jthuraisamy

#include <Windows.h>
#include <ImageHlp.h>
#include <strsafe.h>
#include "loaded_psp_drivers.h"

#include <set>
#include <string>
#include <algorithm>

#pragma comment(lib, "crypt32.lib")

jthuraisamy

#Recover function names from logger function calls.

#@author @Jackson_T
#@category _NEW_
#@keybinding
#@menupath
#@toolbar

import re
from ghidra.program.model.symbol import SourceType