Commit graph

48 commits

Author SHA1 Message Date
pinksawtooth
52fa034bb5 Migrate Ghidra import script to PyGhidra with enhanced stack variable… (#1190)
* Migrate Ghidra import script to PyGhidra with enhanced stack variable annotation

Updated the script for PyGhidra (Ghidra 12.0+) compatibility, migrating from
Jython (Python 2.7) to Python 3. The main improvement is enhanced local variable
commenting that now annotates both the stack variable definition and all
instruction references to it.

Key changes:
- Add PyGhidra compatibility for Ghidra 12.0+
- Implement find_stack_var_references() to track all references to stack variables
- Update append_lvar_comment() to add EOL comments at reference sites
- Refactor using template-based code generation for better maintainability
- Add type hints and comprehensive docstrings
- Support both Pydantic v1 and v2 for result parsing

This makes the generated script more effective at annotating stack strings
by showing decoded strings at the exact instructions where they are referenced,
rather than just at the function entry point.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

* Update scripts/render-ghidra-import-script.py

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

* style: format ghidra import script with black

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
2026-01-12 08:45:58 +00:00
Ana Maria Martinez Gomez
ab07022ff3
[copyright + license] Fix headers
Replace the header from source code files using the following script:
```Python
for dir_path, dir_names, file_names in os.walk("flare-floss"):
    for file_name in file_names:
        try:
            file_path = f"{dir_path}/{file_name}"
            f = open(file_path, "rb+")
            content = f.read()
            m = re.search(OLD_HEADER, content)
            if not m:
                continue
            print(f"{file_path}: {m.group('year')}")
            content = content.replace(m.group(0), NEW_HEADER % m.group("year"))
            f.seek(0)
            f.write(content)
        except:
            continue
```

Some files had the copyright headers inside a `"""` comment and needed
manual changes before applying the script.

The old header had the confusing sentence `All rights reserved`, which
does not make sense for an open source license. Replace the header by
the default Google header that corrects this issue and keep floss
consistent with other Google projects.
2025-01-14 17:52:22 +01:00
Aayush Goel
73020a427b
bump-pydantic from 1.10.9 to 2.6.0 (#954)
* bump-pydantic
2024-03-19 08:23:33 +01:00
Arker123
592d9958ef Updated Rust version db and scripts 2023-12-24 13:58:34 +05:30
Diego Romeo
79bad31ea2 update code style with appropriate isort options 2023-06-27 21:44:20 +02:00
Diego Romeo
ebbd349c5b use pathlib.Path instead of string path 2023-06-27 20:27:41 +02:00
Diego Romeo
2d634ca84e adjust code style 2023-06-27 16:43:03 +02:00
Diego Romeo
30b28134b1 change os.path to pathlib.Path 2023-06-26 20:02:10 +02:00
Willi Ballenthin
c2fb587584
idaplugin: better formatting with newlines
closes #777 

thanks @HongThatCong
2023-06-12 12:28:33 +02:00
Arker123
12062fccd5
Language Identification module for Rust #762 (#775)
* Language Identification module for Rust

* Added support for matching rustc/version

* Improved performance by detecting language after extracting static strings

* Added resource documenting file origin and regeneration instructions for database file

* Implemented extract_rust_hashes.py script and made miscellaneous improvements

* Update mmap handling for Linux and Windows compatibility

* Optimized algorithm and corrected spelling errors
2023-06-04 12:25:22 +02:00
Aayush Goel
bb8e30f6e0 Fix mypy 1.1.1 errors 2023-05-06 23:32:52 +05:30
symbolicvoid
617cff0202
Added docs for scripts in FLOSS (#677)
* Update README to mention scripts.

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
2023-04-04 13:40:22 +02:00
ooprathamm
be8771c8c7
Adds tightstrings to render/scripts (#665)
* Adds tightstrings to render/scripts

* removes unused ts_len

* removes ss_len,ts_len and uses len() wherever required

---------

Co-authored-by: Pratham Chauhan <Prathamchauhan2002@gmail.com>
2023-03-23 09:02:20 +01:00
Moritz Raabe
2a6dcde3e0 update ida scripts 2022-08-24 14:15:15 +02:00
Moritz Raabe
43afa36fa2 fix: cleanup TODOs 2022-06-03 12:16:22 +02:00
Moritz Raabe
eb9ef90d2a feat: update and add hooks 2022-05-24 14:04:17 +02:00
Moritz
e518c47c99
doc: update copyright header (#539)
* doc: update copyright header

* doc: update year
2022-05-17 09:43:21 +02:00
Moritz Raabe
de915fbbff unify lower case hex formatting 2022-03-18 20:29:35 +01:00
Moritz Raabe
42bc24a8a5 Merge remote-tracking branch 'upstream/master' into various-improvements 2022-03-11 22:14:23 +01:00
Moritz Raabe
ea5eab6ccf move decode_strings 2022-03-10 12:43:42 +01:00
Moritz Raabe
fe1934bf84 improve decoding and reorder stackstrings and decoded strings 2022-03-09 15:59:51 +01:00
Moritz Raabe
68b829eaf7 reformat 2022-03-03 20:55:44 +01:00
Harelon
55cd3f978c Change to ida7 and adjust to floss changing 2022-02-04 15:31:07 +02:00
Moritz Raabe
921b96ef6c cleanup and fixes 2022-02-03 14:18:39 +01:00
Moritz Raabe
3c7a4dd8d8 add tightloop string extraction 2021-10-22 16:51:49 +02:00
Moritz Raabe
8c59808ae6 s/fireeye/mandiant/ 2021-09-29 16:50:38 +02:00
Moritz Raabe
f05294382b enable FLIRT, add progress bar 2021-09-23 21:29:21 +02:00
Moritz Raabe
7e325080bd reorganize feature extraction and decoder function identification 2021-09-08 18:25:26 +02:00
William Ballenthin
e86fe0db13 *: mypy fixes 2021-08-03 10:22:46 -06:00
William Ballenthin
99698d0d85 move code to floss.results module 2021-08-02 09:14:52 -06:00
William Ballenthin
4b04a2cfb0 scripts: x64: don't sanitized json data 2021-07-22 15:37:29 -06:00
William Ballenthin
3cb0527a2b scripts: binja: use b64 serialization
ref: #401
2021-07-22 15:33:04 -06:00
William Ballenthin
9e54e16267 scripts: ghidra: use b64 for serialization
ref #401
2021-07-22 13:50:17 -06:00
William Ballenthin
c0050cd35e scripts: ida: cleanup b64 2021-07-22 09:22:14 -06:00
William Ballenthin
8bfd69a6b1 scripts: ida: serialize with base64
ref: #401
2021-07-22 09:15:00 -06:00
William Ballenthin
224a9ebb65 scripts: add render-r2-import-script.py
closes #392
2021-07-22 09:03:42 -06:00
William Ballenthin
7d17460041 scripts: add render-x64dbg-database.py
closes #390
2021-07-22 08:59:56 -06:00
William Ballenthin
5f6647b768 scripts: add render-binja-import-script.py
closes #393
2021-07-22 08:50:46 -06:00
William Ballenthin
b9a54db815 pep8 2021-07-22 08:48:58 -06:00
William Ballenthin
9917db2786 scripts: add render-ghidra-import-script.py
closes #394
2021-07-22 08:48:28 -06:00
William Ballenthin
7dc9bb7b5d pep8 2021-07-22 08:40:30 -06:00
William Ballenthin
33616a7386 scripts: render-ida-import-script: add doc 2021-07-22 08:40:12 -06:00
William Ballenthin
6213f50685 scripts: add render-ida-import-script.py
closes #391
2021-07-21 18:26:01 -06:00
William Ballenthin
08c854e3a6 *: factor result objects into their own namespace 2021-07-21 10:49:38 -06:00
Moritz Raabe
eae5bb0dcb remove plugins 2021-05-21 10:48:30 +02:00
Moritz Raabe
978a8f8f35 fix black code style 2020-11-03 21:16:38 +01:00
Moritz Raabe
e21752ec5e fix isort 2020-11-03 21:13:32 +01:00
Willi Ballenthin
66f67a49a3 scripts: add IDA script to run FLOSS and mark up the results. 2017-09-19 11:52:15 -04:00