66dc70a775
* ghidra: init commit switch to PyGhidra * update CHANGELOG and PyGhidra version requirements * Update capa/features/extractors/ghidra/helpers.py Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> * fix black errors * support Ghidra v12 * remove deprecated APIs * refactor outdated code * fix pyinstaller, code refactoring * address PR feedback * add back capa_explorer.py * beef up capa_explorer.py script * refactor README * refactor README * fix #2747 * add sha256 check for workflows * add sha256 check for workflows * add sha256 check for workflows --------- Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
3.4 KiB
capa explorer for Ghidra
capa explorer for Ghidra brings capa’s detection capabilities directly to Ghidra’s user interface helping speed up your reverse engineering tasks by identifying what parts of a program suggest interesting behavior, such as setting a registry value. You can execute (via PyGhidra) the script capa_explorer.py using Ghidra’s Script Manager window to run capa’s analysis and view the results in Ghidra.
ui integration
capa_explorer.py renders capa results in Ghidra's UI to help you quickly navigate them. This includes adding matched functions to Ghidra’s Symbol Tree and Bookmarks windows and adding comments to functions that indicate matched capabilities and features. You can execute this script using Ghidra’s Script Manager window.
symbol tree window
Matched functions are added to Ghidra's Symbol Tree window under a custom namespace that maps to the capabilities' capa namespace.
comments
Comments are added at the beginning of matched functions indicating matched capabilities and inline comments are added to functions indicating matched features. You can view these comments in Ghidra’s Disassembly Listing and Decompile windows.
bookmarks
Bookmarks are added to functions that matched a capability that is mapped to a MITRE ATT&CK and/or Malware Behavior Catalog (MBC) technique. You can view these bookmarks in Ghidra's Bookmarks window.
getting started
requirements
- Ghidra >= 12.0 must be installed.
- flare-capa >= 10.0 must be installed (virtual environment recommended) with the
ghidraextra (e.g.,pip install "flare-capa[ghidra]"). - capa rules must be downloaded for the version of capa you are using.
execution
1. run Ghidra with PyGhidra
You must start Ghidra using the pyghidraRun script provided in the support directory of your Ghidra installation to ensure the Python environment is correctly loaded. You should execute pyghidraRun from within the Python environment that you used to install capa.
<ghidra_install>/support/pyghidraRun
2. run capa_explorer.py
- Open your Ghidra project and CodeBrowser.
- Open the Script Manager.
- Add capa_explorer.py to the script directories.
- Filter for capa and run the script.
- When prompted, select the directory containing the downloaded capa rules.