You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Ghidrathon is a Ghidra extension that adds Python 3 scripting capabilities to Ghidra. Why? Ghidra natively supports scripting in Java and Jython. Unfortunately many open-source analysis tools, like [capa](https://github.com/mandiant/capa), [Unicorn Engine](https://github.com/unicorn-engine/unicorn), [angr](https://github.com/angr/angr), etc., are written in Python 3 making it difficult, and in some cases, impossible to use these tools in Ghidra. More so the security community has released several great plugins for other SRE frameworks like IDA Pro and Binary Ninja, but again, because many of these plugins use Python 3 it is difficult to port them to Ghidra. Ghidrathon helps you use existing and develop new Python 3 tooling in Ghidra and script Ghidra using modern Python in a way that tightly integrates with Ghidra's UI.
6
+
Ghidrathon is a Ghidra extension that adds Python 3 scripting capabilities to Ghidra. Why? Ghidra natively supports scripting in Java and Jython. Unfortunately, many open-source analysis tools, like [capa](https://github.com/mandiant/capa), [Unicorn Engine](https://github.com/unicorn-engine/unicorn), [angr](https://github.com/angr/angr), etc., are written in Python 3 making it difficult, and in some cases, impossible to use these tools in Ghidra. More so the security community has released several great plugins for other SRE frameworks like IDA Pro and Binary Ninja, but again, because many of these plugins use Python 3 it is difficult to port them to Ghidra. Ghidrathon helps you use existing and develop new Python 3 tooling in Ghidra and script Ghidra using modern Python in a way that tightly integrates with Ghidra's UI.
6
7
7
8
Check out:
8
9
@@ -54,7 +55,7 @@ INFO REPORT: Post-analysis succeeded for file: /example.o (HeadlessAnalyzer)
54
55
INFO REPORT: Save succeeded for processed file: /example.o (HeadlessAnalyzer)
55
56
```
56
57
57
-
For more information on running Ghidra in headless mode check out `<ghidra_install>/support/analyzeHeadlessREADME.html`.
58
+
For more information on running Ghidra in headless mode check out `<absolute_path_to_ghidra_install_dir>/support/analyzeHeadlessREADME.html`.
58
59
59
60
## Third-Party Python Modules
60
61
@@ -74,87 +75,44 @@ Ghidrathon links your local Python installation to Ghidra using the open-source
74
75
75
76
For more information on how Jep works to embed Python in Java see their documentation [here](https://github.com/ninia/jep/wiki/How-Jep-Works).
76
77
77
-
## OS Support
78
-
79
-
Ghidrathon supports the following operating systems:
80
-
81
-
* Linux
82
-
* Windows
83
-
* macOS (x86_64)
84
-
85
-
## Requirements
86
-
87
-
The following tools are needed to build, install, and run Ghidrathon:
Ghidrathon supports Python virtual environments. To use a Python virtual environment, simply build Ghidrathon inside your virtual environment **and** execute Ghidra inside the **same** virtual environment.
101
-
102
-
## Building Ghidrathon
103
-
104
-
**Note:** Review [Python Virtual Environments](#python-virtual-environments) before building if you would like to use a Python virtual environment for Ghidrathon.
105
-
106
-
**Note**: Building Ghidrathon requires building Jep. If you are running Windows, this requires installing the Microsoft C++ Build Tools found [here](https://visualstudio.microsoft.com/visual-cpp-build-tools/). See Jep's documentation [here](https://github.com/ninia/jep/wiki/Windows) for more information on installing Jep on Windows.
107
-
108
-
Use the following steps to build Ghidrathon for your environment:
109
-
110
-
* Install Ghidra using the documentation [here](https://htmlpreview.github.io/?https://github.com/NationalSecurityAgency/ghidra/blob/stable/GhidraDocs/InstallationGuide.html#InstallationNotes)
111
-
* Install Gradle from [here](https://gradle.org/releases)
112
-
* Download the latest Ghidrathon source release from [here](https://github.com/mandiant/Ghidrathon/releases)
113
-
* Run the following command from the Ghidrathon source directory:
114
-
***Note:** Ghidrathon defaults to the Python binary found in your path. You can specify a different Python binary by adding the optional argument `-PPYTHON_BIN=<absolute path to Python binary>` to the command below
115
-
***Note:** you may optionally set an environment variable named `GHIDRA_INSTALL_DIR` instead of specifying `-PGHIDRA_INSTALL_DIR`
89
+
Use the following steps to install Ghidrathon to your Ghidra environment:
116
90
91
+
1. Install Jep:
117
92
```
118
-
$ gradle -PGHIDRA_INSTALL_DIR=<absolute path to Ghidra install>
3. Download and unzip the latest Ghidrathon [release](https://github.com/mandiant/Ghidrathon/releases)
100
+
4. Install the Ghidrathon extension (`.zip`) into Ghidra:
101
+
* Using Ghidra's UI:
102
+
* Navigate to `File > Install Extensions...`
103
+
* Click the green `+` button
104
+
* Navigate to the Ghidrathon extension (`.zip`)
105
+
* Click `Ok`
106
+
* Using a limited environment:
107
+
* Extract the Ghidrathon extension (`.zip`) to `<absolute_path_to_ghidra_install_dir>\Ghidra\Extensions`
120
108
121
-
This command installs Jep, configures Ghidrathon with the necessary Jep binaries, and builds Ghidrathon. If successful, you will find a new directory in your Ghidrathon source directory named `dist` containing your Ghidrathon extension (`.zip`). Please open a new issue if you experience any issues building Ghidrathon.
122
-
123
-
## Installing Ghidrathon
124
-
125
-
Use the following steps to install your Ghidrathon extension using the Ghidra UI:
126
-
127
-
* Start Ghidra
128
-
* Navigate to `File > Install Extensions...`
129
-
* Click the green `+` button
130
-
* Navigate to your Ghidrathon extension built earlier (`.zip`)
131
-
* Click `Ok`
132
-
* Restart Ghidra
133
-
134
-
**OR**
135
-
136
-
Extract your Ghidrathon extension (`.zip`) directly to `<absolute path to Ghidra install>\Ghidra\Extensions` to automatically enable Ghidrathon the next time that Ghidra is started. This method works great if you do not have access to the Ghidra UI when installing Ghidrathon.
137
-
138
-
### Disabling Jython
139
-
140
-
Ghidrathon disables the built-in Jython script provider to avoid conflicts when Ghidra decides which provider should handle scripts with the `.py` file extension. This means existing Jython scripts cannot be executed with Ghidrathon installed. We recommend completely disabling the Jython extension.
141
-
142
-
Use the following steps to disable the Jython extension:
143
-
144
-
* Open a CodeBrowser window (*not the Project Manager window*)
145
-
* Navigate to `File > Configure...`
146
-
* Click `Ghidra Core`
147
-
* Un-check `PythonPlugin`
148
-
149
-
Use the following steps to enable the Jython extension:
109
+
### Switching Python Interpreters
150
110
151
-
* Uninstall Ghidrathon
152
-
* Enable the Jython extension using the steps outlined above
153
-
* Restart Ghidra
111
+
You can switch Ghidrathon to use a different Python interpreter by running `ghidrathon_configure.py` using the new Python interpreter.
154
112
155
-
##Using Ghidrathon
113
+
### Python Virtual Environments
156
114
157
-
See [Python 3 Interpreter Window](#python-3-interpreter-window), [Ghidra Script Manager Integration](#ghidra-script-manager-integration), and [Ghidra Headless Mode](#ghidra-headless-mode)for more information about using Ghidrathon.
115
+
Ghidrathon supports Python virtual environments. To use a Python virtual environment, complete steps `1`and `2` using the Python interpreter that is configured for your environment. Do the same when running `ghidrathon_configure.py` to switch the Ghidrathon to use a different interpreter.
1. Download the [supported Jep JAR release](https://github.com/ninia/jep/releases/download/v4.2.0/jep-4.2.0.jar) to `<absolute_path_to_ghidrathon_source_dir>\lib`
14
+
2. Execute gradle from `<absolute_path_to_ghidrathon_source_dir>`:
0 commit comments