File size: 5,995 Bytes
ae8c826 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 | // Static Ghidra headless summary script for AgentRE.
// Usage from analyzeHeadless:
// -postScript AgentRESummary.java /path/to/output.txt
import ghidra.app.script.GhidraScript;
import ghidra.program.model.address.Address;
import ghidra.program.model.listing.Data;
import ghidra.program.model.listing.DataIterator;
import ghidra.program.model.listing.Function;
import ghidra.program.model.listing.FunctionIterator;
import ghidra.program.model.listing.Instruction;
import ghidra.program.model.listing.InstructionIterator;
import ghidra.program.model.listing.Listing;
import ghidra.program.model.mem.MemoryBlock;
import ghidra.program.model.symbol.Symbol;
import ghidra.program.model.symbol.SymbolIterator;
import java.io.File;
import java.io.FileWriter;
import java.io.PrintWriter;
public class AgentRESummary extends GhidraScript {
private String clean(String s) {
if (s == null) {
return "";
}
s = s.replace('\n', ' ').replace('\r', ' ');
if (s.length() > 240) {
return s.substring(0, 240) + "...";
}
return s;
}
public void run() throws Exception {
String[] args = getScriptArgs();
if (args.length < 1) {
println("AgentRESummary requires an output path argument");
return;
}
File outFile = new File(args[0]);
try (PrintWriter out = new PrintWriter(new FileWriter(outFile))) {
Listing listing = currentProgram.getListing();
out.println("== Program ==");
out.println("name: " + currentProgram.getName());
out.println("format: " + currentProgram.getExecutableFormat());
out.println("language: " + currentProgram.getLanguageID());
out.println("compiler: " + currentProgram.getCompilerSpec().getCompilerSpecID());
out.println("image_base: " + currentProgram.getImageBase());
out.println();
out.println("== Memory Blocks ==");
for (MemoryBlock block : currentProgram.getMemory().getBlocks()) {
out.println(block.getName()
+ " start=" + block.getStart()
+ " end=" + block.getEnd()
+ " size=" + block.getSize()
+ " r=" + block.isRead()
+ " w=" + block.isWrite()
+ " x=" + block.isExecute());
}
out.println();
out.println("== External Symbols / Imports ==");
int count = 0;
SymbolIterator symbols = currentProgram.getSymbolTable().getExternalSymbols();
while (symbols.hasNext() && count < 600) {
Symbol sym = symbols.next();
out.println(sym.getName(true));
count++;
}
if (count >= 600) {
out.println("[truncated imports at 600]");
}
out.println();
out.println("== Strings ==");
count = 0;
DataIterator data = listing.getDefinedData(true);
while (data.hasNext() && count < 500) {
Data d = data.next();
Object value = null;
try {
value = d.getValue();
} catch (Throwable ignored) {
value = null;
}
if (value instanceof String) {
String text = clean((String) value);
if (text.length() >= 4) {
out.println(d.getAddress() + " " + text);
count++;
}
}
}
if (count >= 500) {
out.println("[truncated strings at 500]");
}
out.println();
out.println("== Functions ==");
count = 0;
FunctionIterator funcs = listing.getFunctions(true);
while (funcs.hasNext() && count < 220) {
Function f = funcs.next();
out.println(f.getEntryPoint() + " " + f.getName(true));
count++;
}
if (count >= 220) {
out.println("[truncated functions at 220]");
}
out.println();
out.println("== Function Instruction Excerpts ==");
int funcsPrinted = 0;
funcs = listing.getFunctions(true);
while (funcs.hasNext() && funcsPrinted < 40) {
Function f = funcs.next();
String name = f.getName(true).toLowerCase();
boolean interesting = name.contains("main")
|| name.contains("connect")
|| name.contains("socket")
|| name.contains("send")
|| name.contains("recv")
|| name.contains("exec")
|| name.contains("crypt")
|| name.contains("decrypt")
|| name.contains("attack")
|| name.contains("scan")
|| name.contains("loader")
|| name.contains("start");
if (!interesting && funcsPrinted >= 12) {
continue;
}
out.println();
out.println("-- " + f.getEntryPoint() + " " + f.getName(true) + " --");
InstructionIterator instrs = listing.getInstructions(f.getBody(), true);
int insnCount = 0;
while (instrs.hasNext() && insnCount < 45) {
Instruction insn = instrs.next();
Address addr = insn.getAddress();
out.println(" " + addr + " " + insn.toString());
insnCount++;
}
funcsPrinted++;
}
}
println("AgentRE summary written to " + outFile.getAbsolutePath());
}
}
|