2

I'd like to debug Ghidra plugin scripts written in python using an IDE such as Eclipse. I have installed Pydev and the GhidraDev plugin (from Ghidra open a script in Eclipse to autoinstall the plugin).

With the plugin script opened in Eclipse, I'll set a breakpoint (e.g. on the print stmt below), then click Debug > GhidraScripts to launch Ghidra, and finally manually initiate the script (see sample script below). I see the thread and can pause the script thread from Eclipse, but the breakpoints are never hit.

I've tried both GhidraScripts (Headless) and GUI based GhidraScript launch, however none of my break.

# Hello Function Script
# @author mechgt
# @category _NEW_
# @keybinding
# @menupath
# @toolbar

import ghidra
import time
    
# Iterate through functions, parsing and printing each
function = getFirstFunction()
while function is not None:
    print("Function: {} Address: {}".format(function.getName(), function.getEntryPoint()))
    time.sleep(3)
    function = getFunctionAfter(function)

How can I get debugging functionality for Ghidra Python scripts?

NOTE: The Eclipse/Ghidra/PyDev debugging issues appear related to a possible bug: https://github.com/NationalSecurityAgency/ghidra/issues/1707

1 Answer 1

1

I don't use Eclipse for Ghidra myself, but as far as I just checked it should also support this. I can confirm that this approach (remote debugging plus Python stubs) works well with PyCharm.

Remote Debugging with pydevd

The basic idea is to use remote debugging with pydevd or similar. https://stackoverflow.com/a/41492711/13220684 explains the basic usage.

The issue with this is that you will have to install pydevd inside the Ghidra Jython environment. The following is adapted from https://github.com/VDOO-Connected-Trust/ghidra-pyi-generator#python-packages

# Create a virtualenv for Ghidra packages.
# It is important to use Python2.7 for this venv!
# If you want, you can skip this step and use your default Python installation.
mkvirtualenv ghidra
 
# Create Jython's site-pacakges directory.
jython_site_packages="~/.local/lib/jython2.7/site-packages"
mkdir -p $jython_site_packages
 
# Create a PTH file to point Jython to Python's site-packages directories.
# Again, this has to be Python2.7.

# Outside a virtualenv, use
python -c "import site; print(site.getusersitepackages()); print(site.getsitepackages()[-1])" > $jython_site_packages/python.pth

# If using virtualenv, use the following instead
python -c "from distutils.sysconfig import get_python_lib; print(get_python_lib())" > $jython_site_packages/python.pth

 
# Use pip to install packages for Ghidra
pip install pydevd

It should now be possible to import pydevd inside a Ghidra Python script (or even the integrated REPL).

I don't remember if the GhidraDev plugin for eclipse provides tab completion for the ghidra module inside Python scripts, but this setup is generic enough that you are not required to use Eclipse anymore if you prefer another IDE for Python.

The IDE only needs to support remote debugging via pydevd. I also strongly recommend using https://github.com/VDOO-Connected-Trust/ghidra-pyi-generator if you are using another IDE to provide the type information, method signatures and docstrings of the Ghidra API to the IDE.

Another Workaround

Personally I use mostly ghidra_bridge and the previously mentioned type stubs for Python with Ghidra. Because ghidra_bridge is a full RPC interface, you can write a Python 3 script with full IDE support and run it via the IDE. ghidra_bridge then handles the connection to the Ghidra Python environment and proxies all the relevant objects. With the type stubs the IDE just treats the script as generic Python script and the ghidra module like any Python 3 module.

2
  • thanks!!! How exactly do I get pydevd into the ghidra environment? I create a venv, then install pydevd and jython, but how do I get Ghidra to use this? PyCharm is perfect if I can get that working. ghidra_bridge is requiring me to instrument my ghidra scripts too for my specific use case, but the closest I've gotten so far.
    – mechgt
    Oct 23, 2020 at 12:53
  • Be aware that remote debugging with PyCharm requires the Professional/Ultimate Version! The commands I listed above (taken from the stub generator) allow installing extra packages inside the Jython environment. You basically create a venv to install packages in, then get Jython to use the site-packages of this venv. This should already work, for PyCharm just replace the last command with the one PyCharm tells you to use. Oct 23, 2020 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.