search

dod-cyber-crime-center / pyhidra

Pyhidra is a Python library that provides direct access to the Ghidra API within a native CPython interpreter using jpype.
Other
153 stars 14 forks source link

add script folder to plugin #20

Closed goatshriek closed 1 year ago

goatshriek commented 1 year ago

Pyhidra is very useful for integrating other Python libraries into Ghidra tooling. However, I've found myself looking up some usage patterns in JPype documentation repeatedly, and believe that having an example script to directly reference in Ghidra would make things simpler and more accessible for myself and others. Other scripts that are determined to be useful/common that revolve around pyhidra could also be useful to include with the distribution in the future.

To that end, this change creates a ghidra_scripts folder that gets installed along with the extension. The only script included initially is a Pyhidra basics script that includes some common patterns, similar to the Jython basics script Ghidra comes with. These patterns have been useful for me, particularly the native Java array idioms, since Ghidra requires these in a few places to interact with its SDK.

Feedback is welcome! And of course, thanks a ton for this project, it is essential to Ghidra (in my opinion).

EDIT: force push to fix spelling error

dc3-tsd commented 1 year ago

Thank you for the examples. There are a few small changes requested.

goatshriek commented 1 year ago

Thank you for the review! I've pushed a change for the first two items listed above.

Regarding the move to the install function, this is actually where I had the code originally. The problem I encountered that made me move it was that the script directory for Pyhidra (and thus none of the included scripts) would not be available in Ghidra's Script Manager when launched via pyhidraw the first time. It would be present the second time though, with no action taken in between. You can replicate this by moving the line self._copy_script_dir() in start to directly above the install call (or after it, makes no difference), which displays this observed behavior. I suspect it has something to do with how Ghidra expects plugins and their script directories to be present during load, but I've done nothing to confirm that. So I just made sure that the script directory would be present upon first load (that is, before JVM invocation).

Do you know of an alternate fix to that problem? I agree, the code being where it is right now is not the best place for it logically, but I didn't see a less-intrusive way of avoiding that issue.

dc3-tsd commented 1 year ago

Thanks for the additional information, we'll go ahead and accept the pull request. We're looking into why it isn't present the first time it is loaded, and will see about resolving that in a future patch.