DISASSEMBLER/GHIDRA SCRIPTING
as a reverse engineer this is immensely valuable as it can automate repetitive tasks. below are some tasks that are useful in reverse engineering automation
scanning a program for vulnerable functions (software exploitation)
figuring the context of de-obfuscated byte patterns from an obfuscated malware (malware analysis)
disassembler scripting (ghidra)
this is immensely useful for sre for repetitive tasks such as vulnerable functions...
this also applies to apis
#step 1: figure out where to put the user-defined scripts - this
ghidra > script manager (green play button)
* when starting to write script for an API, look at ghidra examples located in "Script Manager > Scripts > Examples"
- this will show how ghidra scripts are constructed, its important pieces, common layout, frequently used functions, etc
ghidra > script manager > bundle manager (hamburger icon)
* this shows all the directories for all the scripts for ghidra
* the one specific for ghidra is $USER_HOME/ghidra_scripts
- add this directory if it is missing then refresh. its normally located in the HOME directory "~/ghidra_scripts" in linux
#step 2: baseline script format - use vscode or nano with an example python format from ghidra
ghidra > script manager > Scripts > Examples > Python > python_basics.py
...
#TODO write a description for this script
#@author
#@category Functions
#@keybinding
#@menupath
#@toolbar
#TODO Add User Code here
* review the format!
- the # is used for commenting and script description
- the @category is used for folder location
- example @category Functions
- this will be displayed in the GUI on the left-hand side under "script manager > scripts > examples > Functions
- this will also show up in the category column!
- the @keybinding is used for keyboard shortcuts and is case sensitive
- [ctrl][alt][shift][A-Z, )-9, F1-F12]
- @keybinding ctrl alt shift F1 COMMA //this is an example key sequence to execute a script
- the @menupath is used to add script into one fo the menus
- @menupath File.Run.My Script
- the @toolbar is used to pull image from script directory and add it to the UI
- @toolbar myScriptImage.gif
root@sre:~$ nano ~/ghidra_scripts/vulnFuncs.py
#find known vulnerable C functions (not handling memory appropriately such as bounds checking) - gets, strcpy
#@author SRazon
#@category Functions //it'll be cool if Vulnerability is on the list
#test output to confirm that the script is working
print("Hello, CNODP!")
* save the script
#test whether the script is working within ghidra
ghidra > import file > lab06.exe
* the file to be scanned by the script MUST be loaded in ghidra before anything else!
ghidra > script manager > scripts > functions > refresh > double-click vulnFuncs.py
Console - Scripting
vulnFuncs.py> Running...
Hello, CNODP!
vulnFuncs.py> Finished!
* refresh the script manager listing view to see the new script!
root@sre:~$ nano ~/ghidra_scripts/vulnFuncs.py
#find known vulnerable C functions (not handling memory appropriately such as bounds checking) - gets, strcpy
#@author SRazon
#@category Functions //it'll be cool if Vulnerability is on the list
#test output to confirm that the script is working
print("Hello, CNODP!")
#PSEUDOCODE (this is just the game plan on what need to be accomplished, but not how - the how is the actual code implementation)
#1.define a listing of common vulnerable functions
#2.find the first function in the binary //once this is found, it'll give us a reference point to start looping through things including every single function within the file/program
#loop through every function that exists in the binary, find names and entry points - this assumes that there is debug symbol applied in the program
# check against the list of vuln funcs
# once found print the vulnerable function name and address of the function
# then add comment and change the background color
ghidra > script manager > scripting documentation (RED PLUS BUTTON)
search: getFirstFunction
select: ghidra.program.flatapi.FlatProgramAP
- once selected it'll show the usage of the function getFirstFunction
* ghidra's local script documentation can be viewed from the script manager by clicking on the RED PLUS button
- this script documentation is used in advanced scripting
- always use the "FlatProgramAPI" class first! "ghidra.program.flatapi.FlatProgramAPI" when building your scripts!
root@sre:~$ nano ~/ghidra_scripts/vulnFuncs.py
#find known vulnerable C functions (not handling memory appropriately such as bounds checking) - gets, strcpy
#@author SRazon
#@category Functions //it'll be cool if Vulnerability is on the list
#test output to confirm that the script is working
print("Hello, CNODP!")
#PSEUDOCODE (this is just the game plan on what need to be accomplished, but not how - the how is the actual code implementation)
#1.define a listing of common vulnerable functions
#2.find the first function in the binary //once this is found, it'll give us a reference point to start looping through things including every single function within the file/program
function = getFirstFunction()
funcName = function.getName()
funcEntry = function.getEntryPoint()
print("First function - %s at %s" % (funcName, funcEntry))
getFunctionAfter()
#loop through every function that exists in the binary, find names and entry points - this assumes that there is debug symbol applied in the program
# check against the list of vuln funcs
# once found print the vulnerable function name and address of the function
# then add comment and change the background colorLast updated