Understanding the Ghidra extension skeleton
A third section from the new book from Packt
Is this your brand on Milled? Claim it.
In the In this section, we’ll discuss the different types of plugin extensions by overviewing their skeletons. Those skeletons are available from Eclipse. We’ll create an extension by using a skeleton in the Developing a Ghidra extension section. AnalyzersAnalyzers allow us to extend the Ghidra code analysis functionality. The skeleton to develop analyzers is available in the The analyzer skeleton consists of the following elements: • A constructor, which indicates the analyzer’s name, its description, and the analyzer’s type. In addition, you can call to
The analyzer’s type can be • The • The • If you want to let the user set some options for your analyzer, then you can override the • Finally, when things are added to the program, the added method will be called to perform the analysis. Analyzer tipsDon’t let Analyzers can be useful when you’re analyzing a C++ program to obtain object-oriented programming information, for instance. FilesystemsFilesystems allow us to extend Ghidra to support archive files. Examples of archive files are APK, ZIP, and RAR. The skeleton to develop filesystems is available in the SkeletonFileSystem.java file, which extends from GFileSystem. The filesystem skeleton consists of the following elements: • A constructor. As a parameter, it receives the root of the filesystem as the Filesystem Resource Locator (FSRL) and the filesystem provider. • A filesystem implementation is complex. It consists of the mount, close, PluginsPlugins allow us to extend Ghidra in a lot of ways by accessing the GUI and the event notification systems. The skeleton to develop plugins is available in the SkeletonPlugin.java file, which extends from The plugin skeleton consists of the following elements: • A constructor. It receives PluginTool as a parameter and allows us to customize or remove both the provider and the help of the plugin. • An init method. This allows us to acquire services if needed. • It also includes an example of a provider extending from ComponentProvider, allowing us to customize the GUI and its actions. Plugin tipsIf you want to see the complete list of services, please search for As you can imagine, plugin extensions are very versatile. ExportersExporters allow us to extend Ghidra by implementing the ability to export parts of a program available in Ghidra’s program database. The skeleton to develop exporters is available in the SkeletonExporter.java file. The exporter skeleton consists of the following elements: • A constructor. It allows us to set the name of the exporter and also associate a file extension with it. • A getOptions method is also available to define custom options if required. • A setOptions method to assign custom options, if they exist, to the exporter. • An export method where the export operation must be implemented. This returns a Boolean value indicating whether the operation was successful or not. Some examples of preinstalled Ghidra exporters are LoadersLoaders allow us to extend Ghidra by adding support to new binary code formats. Examples of binary code formats include Portable Executable (PE), Executable Linkable Format (ELF), Common Object File Format (COFF), Mach Object File Format (Mach O), and Dalvik Executable File(DEX). The skeleton to develop a loader is available in the The loader skeleton consists of the following elements: • A • A • A load method where the bulk of the implementation takes place. It loads the bytes from the provider into the program. • If the loader has custom options, then you must define them in the In this section, we went over the skeletons for every type of Ghidra extension. Go ahead and modify any skeleton so that it may help you in development. In the next section, we’ll cover what Ghidra extension skeletons look like in Eclipse. And you can read that next section in the book Ghidra Software Reverse Engineering for Beginners. Click the link to buy your own copy! You're currently a free subscriber to Packt SecPro . For the full experience, upgrade your subscription. |

