diff --git a/capa/ghidra/README.md b/capa/ghidra/README.md index e675132c..31a9ab2d 100644 --- a/capa/ghidra/README.md +++ b/capa/ghidra/README.md @@ -29,20 +29,39 @@ OR $ capa --version ``` -3. Copy `capa_ghidra.py`, found [here](/capa/ghidra/capa_ghidra.py), to your Ghidra user scripts directory OR manually add `` to the Ghidra Script Manager. +3. Copy `capa_ghidra.py`, found [here](/capa/ghidra/capa_ghidra.py), to your `$USER_HOME/ghidra_scripts` directory OR manually add `` to the Ghidra Script Manager. 1. This entrypoint script is located in `capa_install_dir/capa/ghidra/` -Once Ghidrathon is configured, you may now invoke capa from within Ghidra in three different ways. Each method suits different use cases of capa, and they include Ghidra's `headlessAnalyzer`, `Scripting Console`, and `Script Manger`. +Once Ghidrathon is configured, you may now invoke capa from within Ghidra in two different ways. These include Ghidra's Headless Analyzer and Script Manager. ## Running capa with the Ghidra feature extractor +### Ghidra's Script Manager + +To invoke capa from the `Ghidra Script Manager`, open your Ghidra Project's Code Browser and open the `Script Manager` window by navigating to `Window -> Script Manager`. Select `capa_ghidra.py` and run the script. capa will then prompt you to choose a `rules` directory and specify the output verbosity level. +> **Note:** In order for the Script Manager to recognize `capa_ghidra.py` you must either copy it to your `$USER_HOME/ghidra_scripts` directory or update the Script Manager search path to include the directory that contains it. + +
+ + + +
+ ### Ghidra's Headless Analyzer -To invoke capa headlessly (i.e. without the Ghidra user interface), we must call the `analyzeHeadless` script provided in your `$GHIDRA_INSTALL_DIR/support` and point it towards capa's `capa_ghidra.py`. One thing to note is that capa runs as a `PostScript`, as in post-analysis script, so we need to provide `analyzeHeadless` with the path and script to run against our project. The preferred method for the Ghidra feature extractor is the entrypoint script, `/capa/ghidra/capa_ghidra.py`. Additional capa command line arguments must be provided in a single, space-delimited string i.e. `"/path/to/rules -v"`. To display the help & usage statement, the keyword `help` must be used instead of the typical `-h or --help`. +To invoke capa using the Ghidra Headless Analyzer, you can use Ghidra's `analyzeHeadless` script, located in your `$GHIDRA_INSTALL_DIR/support` directory. + +`analyzeHeadless` requires these arguments to invoke capa: +1. `/path/to/ghidra/project ghidra_project_name` +2. `-process sample.exe_` OR `-Import /path/to/sample/sample.exe_` +3. `-ScriptPath /path/to/capa_ghidra/` +4. `-PostScript capa_ghidra.py` +5. `"/path/to/rules/ "` +> `"/path/to/rules/ "` must be provided in a single, space-delimited string. The help statement, normally accessed via `-h or --help`, must be accessed via the keyword `help` instead. The syntax is as so: ```bash -./$GHIDRA_INSTALL_DIR/support/analyzeHeadless /path/to/gpr_dir/ gpr_name -process sample_name.exe_ -ScriptPath /path/to/capa_ghidra.py/ -PostScript capa_ghidra.py "/path/to/capa/rules/" +./$GHIDRA_INSTALL_DIR/support/analyzeHeadless /path/to/ghidra/project/ ghidra_project_name -process sample.exe_ -ScriptPath /path/to/capa_ghidra/ -PostScript capa_ghidra.py "/path/to/rules/ -vv" ``` > **Note:** You may add the `$GHIDRA_INSTALL_DIR/support` to your `$PATH` in order to call `analyzeHeadless` as a standalone program. @@ -50,9 +69,14 @@ If you do not have an existing Ghidra project, you may also create one with the The syntax to both import a new file and run capa against it is: ```bash -./$GHIDRA_INSTALL_DIR/support/analyzeHeadless /path/to/gpr_dir/ gpr_name -Import /path/to/sample_name.exe_ -ScriptPath /path/to/capa_install/capa/ghidra -PostScript capa_ghidra.py "/path/to/rules/" +./$GHIDRA_INSTALL_DIR/support/analyzeHeadless /path/to/ghidra/project/ ghidra_project_name -Import /path/to/sample/sample.exe_ -ScriptPath /path/to/capa_ghidra/ -PostScript capa_ghidra.py "/path/to/rules/" +``` +> **Note:** The `/path/to/ghidra/project/` must exist before importing a new project into it. + +To view the usage and help statement, the syntax is: +```bash +./$GHIDRA_INSTALL_DIR/support/analyzeHeadless /path/to/ghidra/project/ ghidra_project_name -process sample.exe_ -ScriptPath /path/to/capa_ghidra/ -PostScript capa_ghidra.py "help" ``` -> **Note:** The `/path/to/gpr_dir/` must exist before importing a new project into it. **Example Output - very verbose flag:** ``` @@ -130,34 +154,3 @@ INFO ANALYZING changes made by post scripts: /Practical Malware Analysis Lab 01 [...] ``` - -### Ghidra's Script Manager - -To invoke capa from the `Ghidra Script Manager`, open your Ghidra Project's Code Browser and open the `Script Manager` window by navigating to `Window -> Script Manager`. Select `capa_ghidra.py` and run the script. capa will then prompt you to choose a `rules` directory and specify the output verbosity level. -> **Note:** In order for the Script Manager to recognize `capa_ghidra.py` you must either copy it to your Ghidra user scripts directory or update the Script Manager search path to include the directory that contains it. - - -
- - - -
- -### Ghidrathon's Script Console - -To invoke capa from Ghidrathon's Script Console, open your Ghidra project's Code Browser and open the `Ghidrathon` window by navigating to `Window -> Ghidrathon`. - -You must import capa into the console and run it via: - -```python3 ->>> import capa ->>> from capa.ghidra import capa_ghidra ->>> capa_ghidra.main() -``` - -Similarly to the Ghidra Script Manager, you will be prompted to choose a capa rules directory and specify output verbosity: - -
- -
- diff --git a/doc/img/ghidra_console_output.png b/doc/img/ghidra_console_output.png deleted file mode 100755 index c40d8811..00000000 Binary files a/doc/img/ghidra_console_output.png and /dev/null differ