- Ghidra scripts
- Installing scripts
- External references search
- Set entry points in selection
- Remove all references
- FindMultipleLabels
- FindNeededFunctions
- BasicBlockModelExample
- Example of parsing PE header
- Printing ASM/PCode/PCodeHigh/C
- Printing PCode
- Set default calling convention for functions in Selection
- Find references of the field of a structure
- Rename functions in the Selection
Please read ${GHIDRA_HOME}/docs/GhidraClass/Intermediate/Scripting_withNotes.html
and Ghidra Script Manager section of Help.
ℹ️ | Source file |
---|
Script finds all references to the functions and data from all external programs (shared libraries), then creates additional memory blocks and transfer all info about functions (name, signature, additional info) and data (name, also create comment with value and annotation with link to external program). A source type of symbols will be IMPORTED
, a source type of parameters will be IMPORTED
, if parameters of the original function don't have DEFAULT
source type, otherwise a source type will be DEFAULT
too.
-
Import binary file.
-
Analyze it.
-
Add needed external programs (see Figure 1):
Window → External Programs
Add External Program Name
Set External Name Association
Figure 1. Added External Programs
-
Run the script (choose memory blocks if needed, see Figure 2).
Figure 2. Choose needed memory blocks
Before | After |
---|---|
![]() |
![]() |
Figure 3. Before and after running the script
ℹ️ | You can run the script multiple times. |
---|
-
script will not change user-defined symbols (you should delete user-defined symbols, if you want to import information from external symbols);
-
you should look symbols with
Global
namespace (not external) for finding xrefs to external functions and data (see Figure 4).
Figure 4. Symbol with
Global
Namespace have true references
ℹ️ | Source file |
---|
Script set all labels (functions) in selection as Entry Point.
- Select required functions through Functions window.
- Run the script.
Use for clearing of the analysis results.
ℹ️ | Source file |
---|
ℹ️ | Source file |
---|
- Select addresses or set the cursor to one address.
- Run the script.
Print all symbols (and their addresses) with multiple labels. Maybe useful for Version Tracking session.
ℹ️ | Source file |
---|
- Run the script.
ℹ️ | Source file |
---|
Find all functions with parameters, which will be dereferenced.
- Run the script.
ℹ️ | Source file |
---|
Prints all basic blocks of the program (change the source code for printing an interesting information) with sources and destinations information (other basic blocks).
- Run the script.
ℹ️ | Source file |
---|
The script parses PE header and print an entry point address (address of a valid function) from optional header.
- Run the script.
ℹ️ | Source file |
---|
The script should be used in headless mode. May be useful for debugging of a decompiler and writing Sleigh code. The script can print ASM code, PCode, PCodeHigh, decompiling C code (use arguments).
- the script can damage the target project, you should to watch the arguments for GhidraHeadless.
See comments in the script file.
ℹ️ | Source file |
---|
The script prints high PCode to console. May be useful for debugging of a decompiler. You should know, that the AST of high PCode and the AST of any varnode may be different in a scope of the same function.
- Run the script.
ℹ️ | Source file |
---|
The script set default convention (see Language ID) for all functions in the selection.
-
Select needed functions. I recommend do it through Functions window, where you can sort and filter functions.
-
Run the script.
ℹ️ | Source file |
---|
The script finds all references to the field of a structure.
- Set cursor at the field of a structure in the Decompiler window.
- Run the script.
ℹ️ | Source file |
---|
The script rename all functions in the selection to one name.
- Select all needed functions (bytes) for renaming.
- Run the script.