Skip to content

Instantly share code, notes, and snippets.

@v-p-b
Created October 4, 2020 18:49
Show Gist options
  • Save v-p-b/46e452eaabe73f36959fcdb558f17401 to your computer and use it in GitHub Desktop.
Save v-p-b/46e452eaabe73f36959fcdb558f17401 to your computer and use it in GitHub Desktop.
Stupid little Ghidra script to find identifiable strings referenced from a function or its descendants
#Stupid little script to find identifiable strings referenced from a function or its descendants
#@author buherator
#@category Test
#@keybinding
#@menupath
#@toolbar
from ghidra.util.task import TaskMonitor
from docking.widgets import OptionDialog
from ghidra.program.model.symbol import RefType
VISITED=set()
def func_refs(f):
body=f.getBody()
instr=getInstructionAt(f.getEntryPoint())
while instr.getMinAddress().compareTo(body.getMaxAddress()) < 0:
refs=ref_mgr.getReferencesFrom(instr.getMinAddress())
for r in refs:
if r.getReferenceType() == RefType.DATA:
data=getDataAt(r.getToAddress())
if data is not None:
print(f, instr, data.getValue())
instr=instr.getNext()
for ff in first_func.getCalledFunctions(TaskMonitor.DUMMY):
if ff.getEntryPoint().getOffset() not in VISITED:
VISITED.add(ff.getEntryPoint().getOffset())
func_refs(ff)
af=currentProgram.getAddressFactory()
function_addr = af.getAddress("0x%x" % int(OptionDialog.showInputSingleLineDialog(None, "Function address","Function address","0x13370000"),16))
ref_mgr=currentProgram.getReferenceManager()
first_func=getFunctionAt(function_addr)
func_refs(first_func)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment