1

I have been trying to extract the function prototypes from a binary file using Ghidra. Up till now what I have done was to use Ghidra's included "Decompile" script and filtered out the function prototypes through the produced text file using python. However, this approach seems to be cumbersome and sometimes it fails to produce the intended results when the compiler options are changed. I feel that there may be a quicker way to get these. Given a binary, my requirement is to get all the function prototypes such as float strtof_l(char *__nptr,char **__endptr,__locale_t __loc) without the function bodies. Is there any existing script to do this? Or is there a method in the API that I could loop upon. Thank you very much.

0

1 Answer 1

6

You can use FunctionManager to get all the functions in the current program and then, from it iterate and get signatures of each.

fm = currentProgram.getFunctionManager()
functions = fm.getFunctions(True)
for f in functions:
  print(f.getSignature().getPrototypeString())

The output:

Signatures.py> Running...
char * strcpy(char * __dest, char * __src)
int mkdir(char * __path, __mode_t __mode)
int fclose(FILE * __stream)
int printf(char * __format, ...)
void * memset(void * __s, int __c, size_t __n)
void * memcpy(void * __dest, void * __src, size_t __n)
FILE * fopen(char * __filename, char * __modes)
char * strcat(char * __dest, char * __src)
...
3
  • This works very well but it seems to only include imported functions in the results. Is there a way to do something similar but also include functions defined within the binary itself? A use case is to find all locally defined functions with argument length 3, for example.
    – h0r53
    Jul 25 at 23:46
  • @h0r53 based on the docs, it should return ALL the functions (except EXTERNAL) Jul 26 at 16:01
  • Interesting. In my case it's returning ONLY external functions. Example, memcpy, memset, memmove, etc. These all come from libc. What I want is locally defined functions. Note, this binary has been stripped of its symbol table, but it still contains dynamic symbols. Also, Ghidra has identified several symbols and named them FUN_XXXX. In particular, I'd love to enumerate all the FUN_XXXX functions.
    – h0r53
    Jul 26 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.