用于获取 EXE 文件的反汇编输出的 Python 脚本

逆向工程 拆卸 Python 吉德拉
2021-06-12 02:46:43

我对 Ghidra 很陌生,希望使用它的 API(无头分析器)并使用 python 通过命令行获取组装文件。

这是我的代码,它可能与正确的代码相去甚远。它给出了错误,我被卡住了。你能帮忙吗?

我用来运行脚本的命令是:

analyzeHeadless ~/Desktop/ghidra_9.1-BETA_DEV   DNETSamples.gpr -scriptPath ~/Desktop/ghidra_9.1-BETA_DEV  -postScript disassemble.py    -process -recursive

这是disassemble.py:

#!/usr/bin/python
# -*- coding: utf-8 -*-


from ghidra.util.task import ConsoleTaskMonitor
from ghidra.app.cmd.disassemble import DisassembleCommand
from ghidra.app.script import GhidraScript
from  ghidra.program.model.address import AddressSet



addset = AddressSet()
addset.add(currentAddress)
cmd = DisassembleCommand(addset, None, True)
cmd.doDisassembly​(ConsoleTaskMonitor(), currentProgram, 0)

错误是java.lang.IllegalArgumentException: Cannot create PyString with non-byte value

INFO  SCRIPT: ghidra_9.1-BETA_DEV/ghidra_decomp.py (HeadlessAnalyzer)
Exception in thread "Python script execution thread" java.lang.IllegalArgumentException: Cannot create PyString with non-byte value
    at org.python.core.PyString.<init>(PyString.java:57)
    at org.python.core.PyString.<init>(PyString.java:70)
    at org.python.core.PyString.<init>(PyString.java:74)
    at org.python.core.PySyntaxError.<init>(PySyntaxError.java:31)
    at org.python.core.ParserFacade.fixParseError(ParserFacade.java:95)
    at org.python.core.ParserFacade.parse(ParserFacade.java:190)
    at org.python.core.Py.compile_flags(Py.java:2185)
    at org.python.core.\__builtin__.execfile_flags(\__builtin__.java:527)
    at org.python.util.PythonInterpreter.execfile(PythonInterpreter.java:286)
    at ghidra.python.GhidraPythonInterpreter.execFile(GhidraPythonInterpreter.java:232)
    at ghidra.python.PythonScriptExecutionThread.run(PythonScriptExecutionThread.java:51)
1个回答

解决方案是删除您的项目(或使用新项目)并在-deleteproject下次运行analyzeHeadless脚本添加