rsleigh 0.4.2

SLEIGH (.slaspec) parser and Rust decoder/P-code emitter codegen — Ghidra-compatible disassembly in pure Rust
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

#!/usr/bin/env python3
"""
Ghidra headless export script for decompiler output.
Usage: analyzeHeadless ... -postScript ghidra-export-decompile.py <output_json>

Uses DecompInterface (correct API as of Ghidra 10.x+).
"""

import json
import sys

from ghidra.app.decompiler import DecompInterface
from ghidra.util.task import ConsoleTaskMonitor


def export_decompile_results(program, output_file):
    results = {}

    decompiler = DecompInterface()
    decompiler.openProgram(program)
    monitor = ConsoleTaskMonitor()

    count = 0
    skipped = 0
    for func in program.getFunctionManager().getFunctions(True):
        try:
            if func.isThunk() or func.isExternal():
                skipped += 1
                continue
            dec_result = decompiler.decompileFunction(func, 30, monitor)
            if dec_result is not None and dec_result.decompileCompleted():
                pseudocode = dec_result.getDecompiledFunction().getC()
                results[func.getName()] = {
                    "address": hex(func.getEntryPoint().getOffset()),
                    "pseudocode": pseudocode,
                    "signature": func.getPrototypeString(False, True),
                }
                count += 1
            else:
                err = dec_result.getErrorMessage() if dec_result is not None else "no result"
                results[func.getName()] = {
                    "address": hex(func.getEntryPoint().getOffset()),
                    "error": err,
                }
        except Exception as e:
            results[func.getName()] = {
                "address": hex(func.getEntryPoint().getOffset()),
                "error": str(e),
            }

    decompiler.dispose()

    with open(output_file, 'w') as f:
        json.dump(results, f, indent=2)

    print("Exported {} functions ({} skipped) to {}".format(count, skipped, output_file))


if __name__ == "__main__":
    args = getScriptArgs()  # Ghidra-provided
    output = args[0] if len(args) > 0 else "ghidra_output.json"
    export_decompile_results(currentProgram, output)