2

I am using Ghidra to do reverse engineering of an ARM binary. I want to print the disassembly of all blocks across all functions containing a specific instruction like 'CALL' or 'RET'. How do I do that?

2

You can do something like:

# get all functions
functions = program.getFunctionManager().getFunctions(True)
for function in functions:
    cur = function.getEntryPoint()
    while cur:
        inst = getInstructionAt(cur)
        if inst:
            # add similar check for call instruction
            if "RET" in inst.getMnemonicString():
                #do something
                print(inst)
                # this will break when function returns
                break
        cur = cur.next()

I wrote this script for x86 binaries, but it would work fine with arm as well (you may have to do minor changes), as the api is identical.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.