ghidra2frida<\/strong> is a Ghidra extension that, working as a bridge between Ghidra and Frida, lets you create powerful scripts that take advantage of Frida’s dynamic analysis engine to improve Ghidra’s statical analysis features. It supports all platforms supported by Frida (Windows, macOS, Linux, iOS, Android, and QNX).<\/p>\n The extension adds a control panel to Ghidra with all the tools needed to create the bridge between Ghidra and Frida. When the bridge is up, a service is offered to all Ghidra scripts and extensions. Thanks to this service, Ghidra scripts and extensions can take advantage of the dynamic instrumentation features of Frida with a couple lines of code<\/strong>.<\/p>\n As with the other tools I’ve written, the idea came from practical needs, such as:<\/p>\n Let’s have a closer look of how it works: ghidra2frida is a Ghidra extension<\/strong> that can be imported from the “File” -> “Install Extensions” menu option. Once installed, ghidra2frida graphical pane can be opened from the “Window” -> “ghidra2frida” menu of Ghidra CodeBrowser and can be positioned anywhere, as any other Ghidra tool.<\/p>\n The interface is very similar to Brida’s interface. In the upper section of the “Configuration” tab it is necessary to fill in some configuration data used by ghidra2frida and in the lower section there are the buttons that control actions.<\/p>\n Like Brida, ghidra2frida uses a RPC library (Pyro4) to allow Ghidra to call Frida methods because unfortunately it is not possible to import Frida directly in a Ghidra extension (neither Java nor Python). A small Python server based on Pyro is executed on the supplied host and port and acts as a bridge between Ghidra and Frida.<\/p>\n Digging in more detail in the configuration options<\/strong>:<\/p>\n To show an example of how it works<\/strong>, let’s look at the SwiftDemangle<\/strong> script, based on Ghidra Ninja’s swift_demangles.py.<\/p>\n After properly configuring the tool, the Pyro server can be started by clicking on the “Start” button of the “Server” section. The first red light in the top-right section of the ghidra2frida pane will become green if the server starts correctly.<\/p>\n The “Check” button in the “Server” section can be used to verify if the ghidra2frida extension is able to contact the Pyro server. The output is printed in the Ghidra Console.<\/p>\n After that, the target application can be spawned or attached to. In this example, I inserted the PID of a running application and attached to it using the “Attach” button in the “Application” section. If the spawning\/attaching process works correctly, the second red light in the top-right section of the ghidra2frida pane will become green.<\/p>\n The “Check” button in the “Application” section can be used to verify if the script can talk properly with the target application using Frida. The output is printed in the Ghidra Console.<\/p>\n Now the bridge is up and we can use it from our Ghidra scripts or extensions. Taking as an example our SwiftDemangler script, we created a Frida exported function that demangles the function name supplied as argument on our iOS phone (we will skip now the body of the “demangle” function because it is not important for understanding ghidra2frida):<\/p>\n The exported function can be called by arbitrary Ghidra scripts and extensions but, before that, it is possible to try the function from the “Run export” tab of the ghidra2frida extension:<\/p>\n Then, our SwiftDemangler Java script can call the “demangle” exported function as follows:<\/p>\n This snippet contains the portion of code necessary to understand how to use ghidra2frida. The full SwiftDeamangle example can be found in my GitHub Ghidra scripts repository<\/a>. In this example, the output of the demangle function is inserted as comment to all Swift functions, in order to speed-up the reversing process.<\/p>\n As it can be seen, in the first line of the Java snippet of our Ghidra script, it is necessary to import the Ghidra2FridaService class offered by ghidra2frida extension because Ghidra services work this way. If the script is opened in Eclipse (or in another Java IDE), the IDE will show an exception<\/strong> because that class is missing. When the script will be executed in a Ghidra instance with the ghidra2frida extension installed, the script will work correctly without any error, but this IDE error can be annoying. To solve this little issue I found a couple of ways:<\/p>\n The following code snippet implements this second solution:<\/p>\n The Ghidra script can then be executed from the Ghidra Script Manager tool:<\/p>\n The script will process each function found in the binary and will call the “demangle” Frida exported function on all the Swift function names, writing the result as a plate comment to each function:<\/p>\n The same script can also be coded in Python. Our swift_demangler.py Python script can use ghidra2frida as follows:<\/p>\n ghidra2frida and the examples shown in this tutorial can be found on GitHub:<\/p>\n Cheers!<\/p>\n","protected":false},"excerpt":{"rendered":" Hi! Today I’m publishing a new Ghidra extension based on the same idea of Brida, a Burp Suite extension created […]<\/p>\n","protected":false},"author":4,"featured_media":159913,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[91,88],"tags":[83,85,87,93,94,95,96],"class_list":["post-391","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-articles","category-tools","tag-ghidra","tag-mobile","tag-reverse-engineering","tag-dynamic-analysis","tag-frida","tag-ghidra2frida","tag-static-analysis"],"acf":[],"yoast_head":"\n\n
![\"\"](\"https:\/\/hnsecurity.it\/wp-content\/uploads\/2021\/08\/screen1edit-1.png\")
<\/p>\n\n
![\"\"](\"https:\/\/hnsecurity.it\/wp-content\/uploads\/2021\/08\/screen2edit-1.png\")
<\/p>\n![\"\"](\"https:\/\/hnsecurity.it\/wp-content\/uploads\/2021\/08\/screen3edit-1.png\")
<\/p>\nrpc.exports = {\r\n \r\n \/\/ Export used by ghidra2frida to check if the application has been attached correctly\r\n ping: function() {\r\n return true;\r\n },\r\n\r\n \/\/ Demangle Swift function name\r\n demangle: function(name) {\r\n ...\r\n }\r\n}<\/pre>\n![\"\"](\"https:\/\/hnsecurity.it\/wp-content\/uploads\/2021\/08\/screen6-1.png\")
<\/p>\nimport ghidra2frida.Ghidra2FridaService;\r\n\r\npublic class SwiftDemangler extends GhidraScript {\r\n \r\n Ghidra2FridaService ghidra2FridaService;\r\n \r\n public String callGhidra2FridaFunction(String name, String[] parameters) throws Exception {\r\n if(ghidra2FridaService == null)\r\n ghidra2FridaService = state.getTool().getService(Ghidra2FridaService.class);\r\n return ghidra2FridaService.callExportedFunction(\"demangle\",parameters);\t\t\r\n }\r\n \r\n @Override\r\n protected void run() throws Exception {\r\n ...\r\n try {\r\n ...\r\n \/\/ f_name contains the name of the function to demangle using Frida\r\n String signature_full = callGhidra2FridaFunction(\"demangle\",new String[] {f_name});\r\n ...\t\t \r\n } catch(Exception e) {\r\n ...\t\t \t\r\n }\r\n }\t\t \r\n}\t\t\t\r\n<\/pre>\n\n
public class SwiftDemangler2 extends GhidraScript {\t\r\n \r\n Object ghidra2FridaService;\r\n \r\n public String callGhidra2FridaFunction(String name, String[] parameters) throws Exception {\r\n if(ghidra2FridaService == null) {\r\n PluginTool pluginTool = state.getTool();\r\n ghidra2FridaService = pluginTool.getService(Class.forName(\"ghidra2frida.Ghidra2FridaService\"));\r\n }\r\n Method ghidra2FridaCallExportedFunction = Class.forName(\"ghidra2frida.Ghidra2FridaService\").getMethod(\"callExportedFunction\", java.lang.String.class, java.lang.String[].class);\t\t\r\n return (String)ghidra2FridaCallExportedFunction.invoke(ghidra2FridaService, name, parameters);\r\n }\r\n \r\n @Override\r\n protected void run() throws Exception {\r\n ...\t\t\r\n try {\r\n String signature_full = callGhidra2FridaFunction(\"demangle\",new String[] {f_name});\r\n ...\t\t\t \r\n } catch(Exception e) {\r\n ...\r\n }\t\t \t\r\n }\r\n}<\/pre>\n![\"\"](\"https:\/\/hnsecurity.it\/wp-content\/uploads\/2021\/08\/screen4-1.png\")
<\/p>\n![\"\"](\"https:\/\/hnsecurity.it\/wp-content\/uploads\/2021\/08\/screen5-1.png\")
<\/p>\nfrom ghidra2frida import Ghidra2FridaService\r\n\r\nghidra2FridaService = None\r\n\r\ndef callGhidra2FridaFunction(name, parameters):\r\n global ghidra2FridaService\r\n if ghidra2FridaService is None:\r\n ghidra2FridaService = state.getTool().getService(Ghidra2FridaService)\r\n println(\"ghidra2FridaService initialized\")\r\n\r\n return ghidra2FridaService.callExportedFunction(name,parameters);\r\n\r\nfunctionManager = currentProgram.getFunctionManager()\r\n\r\nfns = functionManager.getFunctions(True)\r\nfor f in fns:\r\n [...]\r\n try:\r\n signature_full = callGhidra2FridaFunction(\"demangle\",[f_name]);\r\n [...] \r\n except Exception as exc:\r\n [...]<\/pre>\n
\n