forked from xpn/RpcEnum
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathrun_ghidra.py
48 lines (35 loc) · 1.29 KB
/
run_ghidra.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
import os
import subprocess
import json
# Input dir containing JSON files
dir = 'output'
ghidraHeadless = "~/Applications/ghidra_9.0.4/support/analyzeHeadless"
projectPath = "~/Project"
projectName = "Windows.gpr"
# Arguments to pass to Ghidra
args = [ghidraHeadless, projectPath, projectName, "-postScript", "post_script.py", "functionshere", "-process", "modulehere", "-noanalysis"]
modules = []
count = 0
# Traverse through each JSON file
for filename in os.listdir(dir):
with open(dir + "/" + filename) as f:
jsonData = f.read()
o = json.loads(jsonData)
for mod in o["modules"]:
funcList = ""
for func in mod["functions"]:
funcList += str(func["addr"] - mod["module_base"]) + ","
funcList = funcList[:-1]
# Pass function addresses as an argument
args[5] = funcList
# Pass the target module that our passed addresses exist within
args[7] = mod["module"].lower()
# Skip combase.dll
if mod["module"] == "combase.dll":
continue
# Make sure we aren't just passing an empty set of functions
if funcList == "":
continue
subprocess.call(args)
print "============== Working on module %d of %d ==============" % (count+1, len(os.listdir(dir)))
count += 1