I am trying to extract the original file name of some functions through Ghidra. In particular I have enabled the debug symbols so that it does contains the function names in the disassembly listing and want to get the actual file names (header file or source file) of function. For example let's say we have a function named HAL_UART_Transmit. I want to identify the exact file name or the location (path) that this function belongs in the source. Can I do this from the Ghidra IDE itself, or I there a way to get this from a script? Any help would be appreciated. Thanks.

  • What’s “underline file name”? – Igor Skochinsky Apr 10 '20 at 12:45
  • 'stm32l4xx_hal_uart.h' is the file name – hEShaN Apr 10 '20 at 16:24
  • I think you meant "underlying", not "underline". I proposed an edit with some changes to clear that up. – multithr3at3d Apr 11 '20 at 13:30

@hEShaN check this "unofficial" ghidra api.

There is a method called - getProgram(). So, function.getProgram() gives the name of a "program" (underline file?) containing this function.

  • It returns the program that contains this function, which is actually the current program, but I need the file that defined the function. For example, the above function is defined in 'stm32l4xx_hal_uart.h' header file. – hEShaN Apr 10 '20 at 16:27

Within your GhidraScript class, call:


Note that getProgramFile() returns a File object. With that you can get all the paths you need.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.