Scripting Ghidra with Python

This post shortly gives a few examples to get started with scripting Ghidra using Python.

Where to get help

  • look at the online API
  • use the Python interpreter directly available in Ghidra (Window -> Python) and use help(...)
  • hit F1 inside the Python interpreter

How to run a script

Open the script manager (Window -> Script Manager) and create a new Python script. If developping your script outside of Ghidra, make sure to hit the refresh button before re-running the script in Ghidra.

How to code

Some available objects:

  • currentProgram: the current active program
  • currentAddress: the address where the cursor is
  • monitor: a task monitor to allow user to interact with the script

Below are a few snippets that could be helpful for getting started in Ghidra scripting with Python.

Find function's entry point from an address

value = 0x7ff7cf42b901

## transform to a Ghidra Address object
addr = toAddr(value)

## get the containing function
fn = getFunctionContaining(addr)

## get the function's entry point
entry = fn.getEntryPoint()


Find callers and callees for function

## let fn be a function
callers = fn.getCallingFunctions(monitor)

callees = fn.getCalledFunctions(monitor)

Get decompiled C code from a function (see decompileFunction api)

import as decomp

## let addr be a valid Address
fn = getFunctionContaining(addr)

## get the decompiler interface
iface = decomp.DecompInterface()

## decompile the function
d = iface.decompileFunction(fn, 5, monitor)

## get the C code as string
if not d.decompileCompleted():
    code = d.getDecompiledFunction()
    ccode = code.getC()

Add custom bookmarks (see createBookmark api) - check the bookmarks in Ghidra in Window -> Bookmarks

## let fn be a function
pos1 = fn.getEntryPoint()

addr = 0x7ff7cf32b901
pos2 = toAddr(addr)

## add bookmarks
category = 'my-bookmark'
createBookmark(pos1, category, 'addr-{}'.format(pos1.toString()))
createBookmark(pos2, category, 'addr-{}'.format(pos2.toString()))