Ghidra - Headless Scripts (Python)

Headless Scripts for Ghidra's Headless Analyzer written in Python 2 for Automated Analysis (Decompilation and Disassembly).

Legend

Before jumping into the commands, it is important to explain what are the arguments passed to analyzeHeadless:

Argument	Type	Description
<PROJECT_PATH>	Mandatory	Path where the new Ghidra Project will be created.
<PROJECT_NAME>	Mandatory	Name of the new Project to create in the previous path.
-import <FILE_TO_ANALYZE>	Mandatory	Path to the binary that you want to analyze with Ghidra. Here you can use -import or -process depending on your needs. For more information, check Ghidra Documentation.
-scriptPath <PATH_TO_YOUR_SCRIPTS_FOLDER>	Mandatory	Path to your scripts folder.
-postScript <SCRIPT_FILENAME>	Mandatory	Filename of the script you want to execute with Ghidra's Headless Analyzer.
[OUTPUT_FILENAME]	Optional	Filename of the output file that will be generated by Headless Scripts. If this argument is not passed, decompiler.py and disassembler.py will create a file with the following structure: <FILE_TO_ANALYZE>_decompiled.c and <FILE_TO_ANALYZE>.asm respectively. For decompile_simple.py the output filename will always be decompiled_output.c

Decompile Simple

decompile_simple.py decompiles all the functions recognized by Ghidra, and writes them into an output file (Pseudo C). It does exactly the same as decompiler.py but with a simplified code, recommended for beginners.

Usage:

$ analyzeHeadless <PROJECT_PATH> <PROJECT_NAME> -import <FILE_TO_ANALYZE> -scriptPath <PATH_TO_YOUR_SCRIPTS_FOLDER> -postScript <SCRIPT_FILENAME>

Example:

$ analyzeHeadless /home/galoget/ HeadlessAnalysis -import /home/galoget/malware-sample.exe -scriptPath /home/galoget/ghidra-headless-scripts/ -postscript decompile_simple.py

By default the script will create an output file in the path where the command was executed, the output file will be named: output_malware.c

Decompiler

decompiler.py decompiles all the functions recognized by Ghidra, and writes them into an output file (Pseudo C).

Usage:

$ analyzeHeadless <PROJECT_PATH> <PROJECT_NAME> -process <TARGET_FILENAME> -scriptPath <PATH_TO_YOUR_SCRIPT> -postScript <SCRIPT_FILENAME> <OUTPUT_FILENAME>

Example:

$ analyzeHeadless /home/galoget/ HeadlessAnalysis -import /home/galoget/malware-sample.exe -scriptPath /home/galoget/ghidra-headless-scripts/ -postscript decompiler.py decompiled_malware_sample.c

Disassembler

disassembler.py disassembles all the functions recognized by Ghidra, and writes them into an output file (ASM).

Usage:

$ analyzeHeadless <PROJECT_PATH> <PROJECT_NAME> -process <TARGET_FILENAME> -scriptPath <PATH_TO_YOUR_SCRIPT> -postScript <SCRIPT_FILENAME> <OUTPUT_FILENAME>

Example:

$ analyzeHeadless /home/galoget/ HeadlessAnalysis -import /home/galoget/malware-sample.exe -scriptPath /home/galoget/ghidra-headless-scripts/ -postscript disassembler.py.py disass_malware_sample.asm