Kali Linux Tutorials

Scripts to run within Ghidra, maintained by the Trellix ARC team. Ghidra, the open-source software reverse engineering tool, is known for its flexibility and extensibility.

In this article, we delve into the world of GhidraScripts, providing you with insights on how to effectively manage and utilize these scripts for Golang-related tasks.

Whether you’re a seasoned Ghidra user or just getting started, this guide will help you harness the full potential of GhidraScripts to streamline your reverse engineering workflow and maximize your Golang analysis capabilities.

How To Use Ghidra Scripts

When Ghidra’s CodeBrowser is open, the green play button in the icon row opens the Script Manager, as can be seen in the screenshot below. Alternatively, one can open the Window tool strip menu item, and select Script Manager.

Once open, one can manage the script directories with the hamburger menu in the top right corner of the Script Manager.

Within that menu, one can click on the green plus to add a folder to the list of locations where scripts are fetched from. Once added, press the two green arrows to refresh the list.

Once the refresh action has completed, the script should be in the list, and can be searched for using the textbox next to the filter label. To execute a script, simply double click it, or press the green play button within the Script Manager.

Golang Related Scripts

Simply run the scripts and observe the output in the Console Log. Error messages are indicative of what went wrong (i.e. a non supported file format, or an issue finding a specific data structure).

Non-error messages are indicative of what the script has changed and updated.

Sharem.java

Configure SHAREM to run headless, and edit the script to contain the correct path to both Python and SHAREM’s main Python file.

Additionally, ensure the correct parameter for the shellcode’s bitness is used, along with the correct path to the shellcode sample. Once all is configured, simply run the Ghidra script and wait until SHAREM finishes its execution.

There is no progress bar for SHAREM’s execution. Once it is done, the code will load the JSON file and start annotating the given offsets in Ghidra, which will be visible in the Console Log.