Headless Ghidrathon extension installation

Question

Headless Ghidrathon extension installation

colton-gabertan opened this issue 2 years ago · 10 comments

After building the extension, Ghidra's documentation tells us to unzip it in the $GHIDRA_INSTALL_DIR/Extensions diretory; however, putting it in this directory only gives it visibility to perform the actual installation via the gui. To avoid having to configure the extension in the gui, we must extract the zip to ~/.ghidra/.ghidra_<version>/Extensions

note: The Extensions folder will not be present in the hidden directories (.ghidra*), so we must manually create it before/ during the extraction process

Invocation of the headlessAnalyzer should now be using Ghidrathon to process python scripts instead of the default Jython plugin.

Answer 1 · 2023-06-12T08:25:30.000Z

perhaps we should discuss this with upstream Ghidra devs to hear their input. the above sounds like it should work and probably won't often be broken; therefore, can we rely on it? can it be documented as part of Ghidra's behavior?

i dont think its really bad if its not documented yet still works - its just something we need to remember and document internally, in case things break later on.

Answer 2 · 2023-06-12T08:28:06.000Z

here's a link to the implementation of extension installation, and its just as you said:

https://github.com/NationalSecurityAgency/ghidra/blob/9ec89c37fb30d6228ed82d4cf1441b7a7aa0a3f1/Ghidra/Framework/Project/src/main/java/ghidra/framework/plugintool/dialog/ExtensionUtils.java#L788-L801

Answer 3 · 2023-06-13T15:54:11.000Z

I've found extracting to $GHIDRA_INSTALL_DIR/Ghidra/Extensions also works.

Answer 4 · 2023-06-15T18:14:36.000Z

I've found extracting to $GHIDRA_INSTALL_DIR/Ghidra/Extensions also works.

@rchtsang did you find that you could use Ghidrathon in Ghidra headless mode w/out first configuring the extension via Ghidra's UI?

Answer 5 · 2023-06-15T18:25:01.000Z

I'm not quite sure. I went through the full installation process once a while back, and after upgrading to Ghidra 10.3 tried to do it again. I did open the GUI after that, but found that I didn't need to set anything else up. ~~I can try this again and see if headless mode works without opening the GUI though.~~

UPDATE: It does appear to be the case. I uninstalled (and removed the .ghidra folder) and reinstalled Ghidra (via brew, i'm on Mac M1) and extracted the ghidrathon zip archive to the GHIDRA_INSTALL_DIR/Ghidra/Extensions directory and ran a headless script and it appears to work as expected.

Answer 6 · 2023-06-17T23:30:57.000Z

I've found extracting to $GHIDRA_INSTALL_DIR/Ghidra/Extensions also works.

@rchtsang did you find that you could use Ghidrathon in Ghidra headless mode w/out first configuring the extension via Ghidra's UI?

Also, in that case, what about disabling the jython support, should that work fine? I don't have an access to the GUI at all.

Answer 7 · 2023-06-18T01:26:52.000Z

That I’m not sure about, it’s possible there are some locally stored configurations that I’m unaware of, but I removed ~/.ghidra on uninstall and ghidrathon still worked on reinstall, so if there’s anything beyond that I should be removing for fresh install let me know and I can try it.

…

On Sat, Jun 17, 2023 at 4:31 PM Ruturaj Vaidya ***@***.***> wrote: I've found extracting to $GHIDRA_INSTALL_DIR/Ghidra/Extensions also works. @rchtsang <https://github.com/rchtsang> did you find that you could use Ghidrathon in Ghidra headless mode w/out first configuring the extension via Ghidra's UI? Also, in that case, what about disabling the jython support, should that work fine? I don't have an access to the GUI at all. — Reply to this email directly, view it on GitHub <#47 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ARLERGFZ6DH3XVLRZK76MIDXLY43ZANCNFSM6AAAAAAY7SGIYE> . You are receiving this because you were mentioned.Message ID: ***@***.***>

Answer 8 · 2023-06-18T01:31:09.000Z

Btw, I just tested that with my script and it works fine! Thanks for the great project! @rchtsang @williballenthin @mike-hunhoff @colton-gabertan

Answer 9 · 2023-09-05T13:41:49.000Z

I've found extracting to $GHIDRA_INSTALL_DIR/Ghidra/Extensions also works.

Apparently the difference between $GHIDRA_INSTALL_DIR/Extensions and $GHIDRA_INSTALL_DIR/Ghidra/Extensions matters here. The official document refers to the later on.

The <GhidraInstallDir>/Extensions are "by default uninstalled" according to the same manual a few lines above.

Answer 10 · 2023-09-05T19:36:42.000Z

Thanks all - I've update Ghidrathon's README to specify unzip to $GHIDRA_INSTALL_DIR/Ghidra/Extensions as the preferred method for installing Ghidrathon w/out using Ghidra's UI.