Tutorials

Ghidra Script Mastery – Managing And Automating With GhidraScripts For Golang

Scripts to run within Ghidra, maintained by the Trellix ARC team. Ghidra, the open-source software reverse engineering tool, is known for its flexibility and extensibility.

In this article, we delve into the world of GhidraScripts, providing you with insights on how to effectively manage and utilize these scripts for Golang-related tasks.

Whether you’re a seasoned Ghidra user or just getting started, this guide will help you harness the full potential of GhidraScripts to streamline your reverse engineering workflow and maximize your Golang analysis capabilities.

How To Use Ghidra Scripts

When Ghidra’s CodeBrowser is open, the green play button in the icon row opens the Script Manager, as can be seen in the screenshot below. Alternatively, one can open the Window tool strip menu item, and select Script Manager.

Once open, one can manage the script directories with the hamburger menu in the top right corner of the Script Manager.

Within that menu, one can click on the green plus to add a folder to the list of locations where scripts are fetched from. Once added, press the two green arrows to refresh the list.

Once the refresh action has completed, the script should be in the list, and can be searched for using the textbox next to the filter label. To execute a script, simply double click it, or press the green play button within the Script Manager.

Simply run the scripts and observe the output in the Console Log. Error messages are indicative of what went wrong (i.e. a non supported file format, or an issue finding a specific data structure).

Non-error messages are indicative of what the script has changed and updated.

Sharem.java

Configure SHAREM to run headless, and edit the script to contain the correct path to both Python and SHAREM’s main Python file.

Additionally, ensure the correct parameter for the shellcode’s bitness is used, along with the correct path to the shellcode sample. Once all is configured, simply run the Ghidra script and wait until SHAREM finishes its execution.

There is no progress bar for SHAREM’s execution. Once it is done, the code will load the JSON file and start annotating the given offsets in Ghidra, which will be visible in the Console Log.

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

WID_LoadLibrary : The Intricacies Of DLL Management In Windows

WID_LoadLibrary is a custom implementation inspired by the Windows API function LoadLibrary, which is used…

14 hours ago

Locksmith : A Tool For Securing Active Directory Certificate Services

Locksmith is a specialized tool designed to identify and remediate vulnerabilities in Active Directory Certificate…

14 hours ago

Uscrapper Vanta : A Cutting-Edge OSINT Tool For Advanced Data Extraction

Uscrapper Vanta is a powerful open-source intelligence (OSINT) tool designed to revolutionize web scraping and…

14 hours ago

Pake : Transforming Webpages Into Desktop Applications

Pake is an innovative tool designed to convert any webpage into a desktop application with…

19 hours ago

Bevy : Exploring The Frontier Of Game Development With Rust

Bevy is an open-source, data-driven game engine built in Rust, designed to simplify game development…

19 hours ago

AppFlowy Cloud : Enhancing Collaboration With Secure Cloud Infrastructure

AppFlowy Cloud is a robust component of the AppFlowy ecosystem, designed to provide secure user…

2 days ago