search

dod-cyber-crime-center / pyhidra

Pyhidra is a Python library that provides direct access to the Ghidra API within a native CPython interpreter using jpype.
Other
153 stars 14 forks source link

Is there a more detailed tutorial on how to use the interface? #29

Closed leeswan closed 5 months ago

dc3-tsd commented 1 year ago

The readme currently contains a section usage which explains the different ways pyhidra can be used to enable Python 3 in Ghidra. We recommend consulting Ghidra's API documentation for specific things you would like to do within Ghidra.

However, please let us know if there is anything you have found confusing or missing that could be better explained.

leeswan commented 1 year ago

Thanks for the reply! I have a few questions. 1. How do I use pyhidra to obtain the string table of binary files? 2. When I get all the functions using the getFunctionManger().getFunctions(True) method, how do I get the basic blocks in each function?

dc3-tsd commented 6 months ago

Getting function basic blocks requires passing the function's address set (function.getBody()) into BasicBlockModel's getCodeBlocksContaining()

from ghidra.program.model.block import BasicBlockModel
from ghidra.util.task import TaskMonitor

def iterate(java_iterator):
  while java_iterator.hasNext():
    yield java_iterator.next()

basic_block_model = BasicBlockModel(currentProgram)

address_set = function.getBody()

iterator = basic_block_model.getCodeBlocksContaining(address_set, TaskMonitor.DUMMY)

for block in iterate(iterator):
  # analyze CodeBlock object

You may want to also check out using dragodis to help simplify this.

import dragodis

with dragodis.Ghidra("input.exe") as dis:
  for func in dis.functions():
    for block in func.flowchart.blocks:
      print(block.start, block.end)