python 用 pyhidra 调用 Ghidra 执行二进制 static analysis

1
from helper import FAIL
2
import traceback
3
import atexit
4
from config import GHIDRA_BASE
5

6
# this file is a modified version pyhidra.core.open_program and pyhidra.core._setup_project
7
# original credit for pyhidra
8

9
import contextlib
10
from pathlib import Path
11
from typing import Union, ContextManager
12
from pyhidra.core import _analyze_program, _get_compiler_spec, _get_language
13
from pyhidra.converters import *  # pylint: disable=wildcard-import, unused-wildcard-import
14
from ghidra.base.project import GhidraProject
15
from typing import Union, Tuple, ContextManager
16
from ghidra.program.model.listing import Program
17

18
_project: GhidraProject | None = None
19
_program_pool: dict[str, "Program"] = {}
20

21
def _setup_project2(
22
        binary_path: Union[str, Path],
23
        language: str | None = None,
24
        compiler: str | None = None
25
) -> Tuple["GhidraProject", "Program"]:
26
    from java.io import IOException
27
    global _project
28
    assert _project is not None
29
    if binary_path is not None:
30
        binary_path = Path(binary_path)
31

32
    # Open/Create project
33
    program: "Program" | None = None
34
    project = _project
35
    if binary_path is not None:
36
        # if project.getRootFolder().getFile(binary_path.name): # since this not works
37
        try:
38
            program = project.openProgram("/", binary_path.name, False)
39
        except IOException:
40
            program = None
41
            pass
42

43
    if binary_path is not None and program is None:
44
        if language is None:
45
            program = project.importProgram(binary_path) # type: ignore
46
            if program is None:
47
                raise RuntimeError(f"Ghidra failed to import '{binary_path}'. Try providing a language manually.")
48
        else:
49
            lang = _get_language(language)
50
            comp = _get_compiler_spec(lang, compiler) # type: ignore
51
            program = project.importProgram(binary_path, lang, comp) # type: ignore
52
            if program is None:
53
                message = f"Ghidra failed to import '{binary_path}'. "
54
                if compiler:
55
                    message += f"The provided language/compiler pair ({language} / {compiler}) may be invalid."
56
                else:
57
                    message += f"The provided language ({language}) may be invalid."
58
                raise ValueError(message)
59
        project.saveAs(program, "/", binary_path.name, False) # True to False
60
    assert program is not None
61
    return program # type: ignore
62

63
def _setup_project(
64
        binary_path: Union[str, Path],
65
        project_location: Union[str, Path] = None,
66
        project_name: str = None,
67
        language: str = None,
68
        compiler: str = None
69
) -> Tuple["GhidraProject", "Program"]:
70
    from ghidra.base.project import GhidraProject
71
    from java.io import IOException
72
    if binary_path is not None:
73
        binary_path = Path(binary_path)
74
    if project_location:
75
        project_location = Path(project_location)
76
    else:
77
        project_location = binary_path.parent
78
    if not project_name:
79
        project_name = f"{binary_path.name}_ghidra"
80
    project_location = project_location / project_name
81
    project_location.mkdir(exist_ok=True, parents=True)
82

83
    # Open/Create project
84
    program: "Program" = None
85
    try:
86
        project = GhidraProject.openProject(project_location, project_name, True)
87
        if binary_path is not None:
88
            # if project.getRootFolder().getFile(binary_path.name): # since this not works
89
            program = project.openProgram("/", binary_path.name, False)
90
    except IOException:
91
        project = GhidraProject.createProject(project_location, project_name, False)
92

93
    if binary_path is not None and program is None:
94
        if language is None:
95
            program = project.importProgram(binary_path)
96
            if program is None:
97
                raise RuntimeError(f"Ghidra failed to import '{binary_path}'. Try providing a language manually.")
98
        else:
99
            lang = _get_language(language)
100
            comp = _get_compiler_spec(lang, compiler)
101
            program = project.importProgram(binary_path, lang, comp)
102
            if program is None:
103
                message = f"Ghidra failed to import '{binary_path}'. "
104
                if compiler:
105
                    message += f"The provided language/compiler pair ({language} / {compiler}) may be invalid."
106
                else:
107
                    message += f"The provided language ({language}) may be invalid."
108
                raise ValueError(message)
109
        project.saveAs(program, "/", binary_path.name, False) # True to False
110

111
    return project, program
112

113

114
@contextlib.contextmanager
115
def open_program(
116
        binary_path: Path,
117
        project_location: Union[str, Path] = None,
118
        project_name: str = None,
119
        analyze=True,
120
        language: str = None,
121
        compiler: str = None,
122
) -> ContextManager["FlatProgramAPI"]:
123
    """
124
    Opens given binary path in Ghidra and returns FlatProgramAPI object.
125

126
    :param binary_path: Path to binary file, may be None.
127
    :param project_location: Location of Ghidra project to open/create.
128
        (Defaults to same directory as binary file)
129
    :param project_name: Name of Ghidra project to open/create.
130
        (Defaults to name of binary file suffixed with "_ghidra")
131
    :param analyze: Whether to run analysis before returning.
132
    :param language: The LanguageID to use for the program.
133
        (Defaults to Ghidra's detected LanguageID)
134
    :param compiler: The CompilerSpecID to use for the program. Requires a provided language.
135
        (Defaults to the Language's default compiler)
136
    :return: A Ghidra FlatProgramAPI object.
137
    :raises ValueError: If the provided language or compiler is invalid.
138
    """
139
    global _project, _program_pool
140

141
    from pyhidra.launcher import PyhidraLauncher, HeadlessPyhidraLauncher
142

143
    if not PyhidraLauncher.has_launched():
144
        HeadlessPyhidraLauncher().start()
145

146
    from ghidra.app.script import GhidraScriptUtil
147
    from ghidra.program.flatapi import FlatProgramAPI
148

149
    program =  _program_pool.get(binary_path.name, None)
150
    if program == None:
151
        if _project == None:
152
            project, program = _setup_project(
153
                binary_path,
154
                project_location,
155
                project_name,
156
                language,
157
                compiler
158
            )
159
            _project = project
160
            # _project.setDeleteOnClose(True)
161
            atexit.register(_project.close)
162
        else:
163
            program = _setup_project2(
164
                binary_path,
165
                language,
166
                compiler
167
            )
168
        _program_pool[binary_path.name] = program
169
    GhidraScriptUtil.acquireBundleHostReference()
170

171
    try:
172
        flat_api = FlatProgramAPI(program)
173

174
        if analyze:
175
            _analyze_program(flat_api, program)
176

177
        # change base address
178
        base_addr = flat_api.toAddr(GHIDRA_BASE)
179
        if flat_api.currentProgram.getImageBase() != base_addr:
180
            flat_api.currentProgram.setImageBase(base_addr, False)
181
        assert flat_api.currentProgram.getImageBase() == base_addr
182

183
        yield flat_api
184
    except Exception as e:
185
        FAIL("--- Error while opening program:", e)
186
        FAIL(f"binary {binary_path} in {project_location}")
187
        traceback.print_exc()
188
    finally:
189
        GhidraScriptUtil.releaseBundleHostReference()
190
        # project.save(program)
191
        # project.close()

1
import pyhidra
2
pyhidra.start()
3
from typing import TYPE_CHECKING
4
if TYPE_CHECKING:
5
    import ghidra
6
from pathlib import Path
7
from ghidra.app.decompiler.flatapi import FlatDecompilerAPI
8
from ghidra.program.flatapi import FlatProgramAPI
9

10
DATASET_PATH = Path(".")
11
GHIDRA_DIR = Path(".") # Ghidra project location
12
GHIDRA_PROJECT_NAME = "test" # Ghidra project name
13
GHIDRA_BASE = 0x400000 # Ghidra base address, used in open_program
14
FUNC_ADDRS: set[str] = set() # function addresses in binary (base addr is 0x0 in default)
15
with open_program(DATASET_PATH / "test.so", GHIDRA_DIR, GHIDRA_PROJECT_NAME) as f_api:
16
    f_api: FlatProgramAPI = f_api
17
    decomp_api = FlatDecompilerAPI(f_api)
18
    listing = f_api.currentProgram.getListing()
19
    for target in FUNC_ADDRS:
20
        func = f_api.getFunctionAt(f_api.toAddr(hex(int(target.addr, 16) + GHIDRA_BASE)))
21
        acode = [] # assembly code
22
        for i in listing.getCodeUnits(func.getBody(), True):
23
            acode.append(i.toString())
24
        panic_if_not(func is not None, f"[-] function not found at {target.addr} in {bin_name}")
25
        dcode = decomp_api.decompile(func, 0).strip() # decompiled code
26
        acode = "\n".join(acode)
27
        print(dcode, acode, sep="\n")

1
from pathlib import Path
2
from binary_search.pyhidra_helper import open_program
3
from config import GHIDRA_DIR, GHIDRA_PROJECT_NAME, GHIDRA_BASE
4
from helper import INFO, panic_if_not, WARNING, OK
5
from ghidra.program.flatapi import FlatProgramAPI
6
from ghidra.util.task import ConsoleTaskMonitor
7
from ghidra.program.model.listing import Function
8
from tqdm import tqdm
9
from copy import copy
10

11
def search_deps(function_addrs: set[str], elf: Path) -> set[tuple[str, str]]:
12
    '''
13
    Search for dependencies of given functions in given binary.
14
    :param function_addrs: set of function addresses in Ghidra in hex string
15
    :param elf: path to binary
16
    :return: set of function addresses in Ghidra in hex string
17
    '''
18
    known_addrs: str[] = []
19
    INFO(f"[+] binary searching for deps for {len(function_addrs)} functions in {elf}")
20
    panic_if_not(elf.exists(), f"[-] {elf} not found")
21
    funcs: set[tuple[str, str]] = set()
22
    monitor = ConsoleTaskMonitor()
23
    with open_program(elf, GHIDRA_DIR, GHIDRA_PROJECT_NAME) as f_api:
24
        f_api: FlatProgramAPI = f_api # for type hint
25
        for addr in tqdm(function_addrs):
26
            # panic_if_not(int(addr, 16) > GHIDRA_BASE, f"[-] invalid address for Ghidra base {addr} < {hex(GHIDRA_BASE)}")
27
            func = f_api.getFunctionAt(f_api.toAddr(addr))
28
            if func is None:
29
                WARNING(f"[-] function not found at {addr} in {elf}")
30
                continue
31
            # find CFG
32
            called_funcs: set[Function] = func.getCalledFunctions(monitor)
33
            for f in called_funcs:
34
                addr: str = f.getEntryPoint().toString() # type: ignore
35
                if addr in known_addrs:
36
                    continue
37
                known_addrs.add(addr)
38
                funcs.add((f.getName(), addr)) # type: ignore
39
        OK(f"[+] found {len(funcs)} functions as deps in {elf}")
40
    return funcs