-
-
[转帖]ghidra2frida
-
发表于: 2021-11-21 08:38 23750
-
ghidra2frida
ghidra2frida is a Ghidra Extension that, working as a bridge between Ghidra and Frida, lets you create powerful Ghidra scripts that take advantage of Frida's dynamic analysis engine to improve Ghidra statical analysis features. It supports all platforms supported by Frida (Windows, macOS, Linux, iOS, Android, and QNX).
The plugin is based on Brida idea (and code). ghidra2frida itself is a extension that adds to Ghidra a control panel with all the instruments necessary to create the bridge between Ghidra and Frida. When the bridge is up, a service is offered to Ghidra scripts and extensions that with a couple of lines of code can use dynamical instrumentation powerful features of Frida for everything you need.
Some examples:
Demangle SWIFT function names while analyzing iOS binaries (supplied as example)
Write a Ghidra analyzer that analyze a binary using also dynamic information obtained through Frida during one or more run of the binary itself
Decrypt encrypted portion of a binary (strings, etc.) calling the decryption function used by the target binary runing on target platform
A tutorial of the tool can be found in our company blog.
https://github.com/federicodotta/ghidra2frida