vee1e/flare-floss
1
0
Fork 0
mirror of https://github.com/vee1e/flare-floss.git synced 2026-09-01 17:57:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
flare-floss/scripts
History
Exact
pinksawtooth 52fa034bb5 Migrate Ghidra import script to PyGhidra with enhanced stack variable… (#1190) 
* Migrate Ghidra import script to PyGhidra with enhanced stack variable annotation

Updated the script for PyGhidra (Ghidra 12.0+) compatibility, migrating from
Jython (Python 2.7) to Python 3. The main improvement is enhanced local variable
commenting that now annotates both the stack variable definition and all
instruction references to it.

Key changes:
- Add PyGhidra compatibility for Ghidra 12.0+
- Implement find_stack_var_references() to track all references to stack variables
- Update append_lvar_comment() to add EOL comments at reference sites
- Refactor using template-based code generation for better maintainability
- Add type hints and comprehensive docstrings
- Support both Pydantic v1 and v2 for result parsing

This makes the generated script more effective at annotating stack strings
by showing decoded strings at the exact instructions where they are referenced,
rather than just at the function entry point.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

* Update scripts/render-ghidra-import-script.py

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

* style: format ghidra import script with black

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
2026-01-12 08:45:58 +00:00
..
extract_rust_hashes.py [copyright + license] Fix headers 2025-01-14 17:52:22 +01:00
idaplugin.py [copyright + license] Fix headers 2025-01-14 17:52:22 +01:00
README.md Added docs for scripts in FLOSS (#677) 2023-04-04 13:40:22 +02:00
render-binja-import-script.py [copyright + license] Fix headers 2025-01-14 17:52:22 +01:00
render-ghidra-import-script.py Migrate Ghidra import script to PyGhidra with enhanced stack variable… (#1190) 2026-01-12 08:45:58 +00:00
render-ida-import-script.py [copyright + license] Fix headers 2025-01-14 17:52:22 +01:00
render-r2-import-script.py [copyright + license] Fix headers 2025-01-14 17:52:22 +01:00
render-x64dbg-database.py [copyright + license] Fix headers 2025-01-14 17:52:22 +01:00

README.md

FLOSS Scripts

FLOSS supports converting its output into scripts for various tools. Please see the render scripts in this directory.

Additionally, there is another plugin for IDA to allow FLOSS to automatically extract obfuscated strings and apply them to the currently loaded module in IDA. idaplugin.py is a IDAPython script you can directly run within IDA Pro (File - Script File... [ALT + F7]).

Installation

These scripts can be downloaded from the FLOSS GitHub repository alongside the source, which is required for the scripts to run. To install FLOSS as source, see the documentation here.

Usage

Convert FLOSS output for use by other tools

  • Run FLOSS on the desired executable with the -j or --json argument to emit a JSON result and redirect it to a JSON file.
    $ floss -j suspicious.exe > floss_results.json

For Binary Ninja, IDA Pro, Ghidra or Radare2:

  • Run the script for your tool of choice by passing the result json file as an argument and redirect the output to a Python (.py) file.

Ghidra Example:
$ python render-ghidra-import-script.py floss_results.json > apply_floss.py

  • Run the Python script apply_floss.py using the desired tool.

For x64dbg:

  • Instead of a Python file, redirect the output to a .json file.
    $ python render-x64dbg-database.py floss-results.json > database.json

  • Open the JSON file database.json in x64dbg.