Package: pyhidra
pyhidraPyhidra is a Python library that provides direct access to the Ghidra API within a native CPython interpreter usingjpype. As well, Pyhidra contains some conveniences for setting up analysis on a given sample and running a Ghidra script locally. It also contains a Ghidra plugin to allow the use of CPython from the
Ghidra user interface.Pyhidra was initially developed for use with Dragodis and is designed to be installable without requiring Java or Ghidra. Due to this restriction, the Java plugin for Pyhidra is compiled and installed automatically during first use. The Java plugin is managed by Pyhidra and will automatically be rebuilt as necessary.InstallDownload and installGhidrato a desired location.Set theGHIDRA_INSTALL_DIRenvironment variable to point to the directory where Ghidra is installed.Install pyhidra.> pip install pyhidraEnabling the Ghidra User Interface PluginRunpyhidrawfrom a terminal of your choice.Open the Code Browser Tool.From theFiletoolbar menu, selectConfigure....From the menu in the image below selectconfigureunderExperimental.Check and enable Pyhidra as seen in the image below.Manual Plugin InstallationIf pyhidra is planned to be used in a multiprocessing deployed server, the following must be run to allow the Ghidra plugins to be compiled and installed before use.python -m pyhidra.install_pluginsManual Plugin UninstallationIf a plugin is misbehaving, the plugin can be manually uninstalled to allow recompilation on the next startup of pyhidra's launcher.python -m pyhidra.uninstall_plugin pyhidraUsageRaw ConnectionTo get just a raw connection to Ghidra use thestart()function.
This will setup a Jpype connection and initialize Ghidra in headless mode,
which will allow you to directly importghidraandjava.NOTE: No projects or programs get setup in this mode.importpyhidrapyhidra.start()importghidrafromghidra.app.util.headlessimportHeadlessAnalyzerfromghidra.program.flatapiimportFlatProgramAPIfromghidra.base.projectimportGhidraProjectfromjava.langimportString# do thingsCustomizing Java and Ghidra initializationJVM configuration for the classpath and vmargs may be done through aPyhidraLauncher.frompyhidra.launcherimportHeadlessPyhidraLauncherlauncher=HeadlessPyhidraLauncher()launcher.add_classpaths("log4j-core-2.17.1.jar","log4j-api-2.17.1.jar")launcher.add_vmargs("-Dlog4j2.formatMsgNoLookups=true")launcher.start()Registering an Entry PointThePyhidraLaunchercan also be configured through the use of a registered entry point on your own python project.
This is useful for installing your own Ghidra plugin which uses pyhidra and self-compiles.First create anentry_pointforpyhidra.setuppointing to a single argument function which accepts the launcher instance.# setup.pyfromsetuptoolsimportsetupsetup(# ...,entry_points={'pyhidra.setup':['acme_plugin = acme.ghidra_plugin.install:setup',]})Then we create the target function.
This function will be called every time a user starts a pyhidra launcher.
In the same fashion, another entry pointpyhidra.pre_launchmay be registered and will be called after Ghidra and all
plugins have been loaded.# acme/ghidra_plugin/install.pyfrompathlibimportPathimportpyhidradefsetup(launcher):"""Run by pyhidra launcher to install our plugin."""launcher.add_classpaths("log4j-core-2.17.1.jar","log4j-api-2.17.1.jar")launcher.add_vmargs("-Dlog4j2.formatMsgNoLookups=true")# Install our plugin.source_path=Path(__file__).parent/"java"/"plugin"# path to uncompiled .java codedetails=pyhidra.ExtensionDetails(name="acme_plugin",description="My Cool Plugin",author="acme",plugin_version="1.2",)launcher.install_plugin(source_path,details)# install plugin (if not already)Analyze a FileTo have pyhidra setup a binary file for you, use theopen_program()function.
This will setup a Ghidra project and import the given binary file as a program for you.Again, this will also allow you to importghidraandjavato perform more advanced processing.importpyhidrawithpyhidra.open_program("binary_file.exe")asflat_api:program=flat_api.getCurrentProgram()listing=program.getListing()print(listing.getCodeUnitAt(flat_api.toAddr(0x1234)))# We are also free to import ghidra while in this context to do more advanced things.fromghidra.app.decompiler.flatapiimportFlatDecompilerAPIdecomp_api=FlatDecompilerAPI(flat_api)# ...decomp_api.dispose()By default, pyhidra will run analysis for you. If you would like to do this yourself, setanalyzetoFalse.importpyhidrawithpyhidra.open_program("binary_file.exe",analyze=False)asflat_api:fromghidra.program.utilimportGhidraProgramUtilitiesprogram=flat_api.getCurrentProgram()ifGhidraProgramUtilities.shouldAskToAnalyze(program):flat_api.analyzeAll(program)Theopen_program()function can also accept optional arguments to control the project name and location that gets created.
(Helpful for opening up a sample in an already existing project.)importpyhidrawithpyhidra.open_program("binary_file.exe",project_name="EXAM_231",project_location=r"C:\exams\231")asflat_api:...Run a ScriptPyhidra can also be used to run an existing Ghidra Python script directly in your native python interpreter
using therun_script()command.
However, while you can technically run an existing Ghidra script unmodified, you may
run into issues due to differences between Jython 2 and CPython 3.
Therefore, some modification to the script may be needed.importpyhidrapyhidra.run_script(r"C:\input.exe",r"C:\some_ghidra_script.py")This can also be done on the command line usingpyhidra.> pyhidra C:\input.exe C:\some_ghidra_script.py <CLI ARGS PASSED TO SCRIPT>Ghidra User InterfaceGhidramustbe started viapyhidrawand the plugin must be enabled for the user interface features to be present. Once these prerequisites are met thepyhidramenu item will be available in theWindowtoolbar menu and all Python scripts outside of the Ghidra installation will automatically be run with CPython. Any Python script found within the Ghidra installation will be run using Jython to prevent causing issues with any analyzers or Ghidra internals that use them. Below is a screenshot of the standard Python interpreter in Ghidra which is using CPython instead of Jython. It will appear whenpyhidrais opened from theWindowtoolbar menu.Handling Package Name ConflictsThere may be some Python modules and Java packages with the same import path. When this occurs the Python module takes precedence.
While jpype has its own mechanism for handling this situation, pyhidra automatically makes the Java package accessible by allowing
it to be imported with an underscore appended to the package name.importpdb# imports Python's pdbimportpdb_# imports Ghidra's pdb