0xdea/ghidra-scripts

A collection of my Ghidra scripts to facilitate reverse engineering and vulnerability research.

ghidra-scripts

"Humans are more suited to recognize food than to keep large graphs in their head."

-- Halvar Flake

A collection of my Ghidra scripts to facilitate reverse engineering and vulnerability research.

Blog post: https://security.humanativaspa.it/automating-binary-vulnerability-discovery-with-ghidra-and-semgrep/

See also: https://github.com/federicodotta/ghidra-scripts

VulnDev

• Rhabdomancer.java. This script locates all calls to potentially insecure functions.
• Haruspex.java. This script extracts all pseudo-code generated by the Ghidra decompiler.

iOS

• FOX_alpha.java. This script tries to fix Objective-C cross-references in iOS apps.

Analysis

• ResolveMipsN32LinuxSyscallsScript. This script resolves MIPS N32 syscalls.

ghidra-scripts's Issues

Comma missing on Rhabdomancer.java

A comma is missing on Rhabdomancer.java line 54

FOX-alpha issue in ghidra 10.4+

FOX-alpha.java:72: error: '{' expected
public class FOX-alpha extends GhidraScript 
                ^
skipping ghidra_scripts_dea/FOX-alpha.java

yara.py object has no attribute

Traceback (most recent call last):
File "ghidra_scripts/yara.py", line 53, in
add_bookmark_comment(vaddr, current_rule)
File "ghidra_scripts/yara.py", line 30, in add_bookmark_comment
cu.setComment(CodeUnit.EOL_COMMENT, text)
AttributeError: 'NoneType' object has no attribute 'setComment'