3

I have written a script which extracts all the assembly code from a PE using this code in ghidra

instructionList = []
for instr in currentProgram.getListing().getInstructions(True):
    instructionList.append(instr)

but the issue is that, is changes all the .DLL calls in the assembly code. For example, if the listing window shows

CALL        dword ptr [->MSVCRT.DLL::signal] 

The output I get is

CALL dword ptr [EBP + -0x14]

Is there a way to get the assembly code exactly as it is in the listing window

0

2 Answers 2

4

So, the answer was provided in the OP's ticket #1994, just transferring it here for the future seekers:

from ghidra.program.model.listing import CodeUnitFormat, CodeUnitFormatOptions
codeUnitFormat = CodeUnitFormat(CodeUnitFormatOptions(CodeUnitFormatOptions.ShowBlockName.ALWAYS,CodeUnitFormatOptions.ShowNamespace.ALWAYS,"",True,True,True,True,True,True,True))

instructionList = []
for instr in currentProgram.getListing().getInstructions(True):
    instructionList.append(codeUnitFormat.getRepresentationString(inst))
2

I came up with this after I read the post but couldn't find a way to make it neat and clean

just recording the thought process as pawel created an answer that is nice

>>> inst = currentProgram.listing.getCodeUnitAt(currentAddress)
>>> print (inst,inst.getReferencesFrom()[1])
(CALL qword ptr [0x1c0007050], ->NTOSKRNL.EXE::EtwRegister)

edit a regex substitute hack is what I was thinking of before abandoning it like below

>>> re.sub("\[.*\]",'['+inst.getReferencesFrom()[1].toString()+']',inst.toString())
    u'CALL qword ptr [->NTOSKRNL.EXE::EtwRegister]'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.