Skip to content

Instantly share code, notes, and snippets.

@mogery
Created October 16, 2021 22:21
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save mogery/e277086d5b778e48921fa05788612913 to your computer and use it in GitHub Desktop.
Save mogery/e277086d5b778e48921fa05788612913 to your computer and use it in GitHub Desktop.
Ghidra script to import symbols from separate .debug files.
## ###
# IP: GHIDRA
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
##
# Imports a .debug elf file. See GDB's "Separate Debug Files" for more info: https://sourceware.org/gdb/onlinedocs/gdb/Separate-Debug-Files.html
# @author mogery <mo.geryy@gmail.com>; based on ImportSymbolsScript.py by unknown and matedealer <git@matedealer.de>
# @category Symbol
#
from ghidra.program.model.symbol.SourceType import *
import string
import subprocess
functionManager = currentProgram.getFunctionManager()
f = askFile("Give me a file to open", "Go baby go!")
objdump = subprocess.check_output(["objdump", "-t", f.absolutePath])
symbolLines = objdump.splitlines()[4:-3]
for line in symbolLines:
pieces = line.split("\t")
if "*" in pieces[0]: # dismiss *UND* and such
continue
name = pieces[1][17:]
if len(name) == 0: # dismiss empty-named symbols
continue
if " " in name: # edit weird symbols with spaces in their name
name = name.split()[-1]
address = toAddr(long("0x" + pieces[0][0:16], 16))
try:
function_or_label = "f" if pieces[0][23] == "F" else "l"
except IndexError:
function_or_label = "l"
if function_or_label == "f":
func = functionManager.getFunctionAt(address)
if func is not None:
old_name = func.getName()
func.setName(name, USER_DEFINED)
print("Renamed function {} to {} at address {}".format(old_name, name, address))
else:
func = createFunction(address, name)
print("Created function {} at address {}".format(name, address))
else:
print("Created label {} at address {}".format(name, address))
createLabel(address, name, False)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment