AwesomeREA.org

Tool

Ghidra Ninja ghidra_scripts

Thomas Roth's (Ghidra Ninja) collection of Ghidra Python scripts, which appear under a Ghidra Ninja category in the Script Manager. binwalk.py and yara.py run binwalk or bundled YARA crypto-constant rules over the loaded program and bookmark the findings, YaraSearch.py does the same with a rule file the user chooses, swift_demangler.py demangles Swift function names, golang_renamer.py restores function names in stripped Go binaries from the .gopclntab table, and export_gameboy_rom.py writes a working ROM back out of a Game Boy program imported with GhidraBoy.

Requirements & limits

  • No releases or tags; the last commit is a merge from 2020-10-07. Open issues filed between 2020 and 2025 report problems including golang_renamer data-type errors, a binwalk.py temporary-file error and an out-of-memory failure, with no later commits.
  • Installed by adding the checked-out repository as a script directory in Ghidra's Script Manager. The scripts are Python 2 code for Ghidra's Jython interpreter, and the README names no supported Ghidra version. binwalk.py, yara.py and YaraSearch.py need binwalk or yara on PATH, swift_demangler.py needs the swift toolchain, and export_gameboy_rom.py needs the GhidraBoy extension.
  • Input is a program the analyst has loaded into Ghidra; export_gameboy_rom.py works on a Game Boy ROM the user imported, and an open issue says it fails for single-page ROMs. golang_renamer.py only searches for the .gopclntab header used before Go 1.16, and an open issue asks for Go 1.16 support. YARA and binwalk hits are signature matches for analyst review.
  • GPL-3.0 (LICENSE). The README says the bundled yara-crypto.yar rules are licensed under GPLv2, with an added SHA256 rule credited to @phoul, and credits golang_renamer.py as a port of George Zaytsev's go_renamer.py. No script was run for this review.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · ghidraninja/ghidra_scripts · Revision 99f2a86
  2. golang_renamer.py GitHub · ghidraninja/ghidra_scripts · Revision 99f2a86
  3. YaraSearch.py GitHub · ghidraninja/ghidra_scripts · Revision 99f2a86
  4. yara-crypto.yar GitHub · ghidraninja/ghidra_scripts · Revision 99f2a86
  5. LICENSE GitHub · ghidraninja/ghidra_scripts · Revision 99f2a86
  6. https://github.com/ghidraninja/ghidra_scripts/issues/12
  7. https://github.com/ghidraninja/ghidra_scripts/issues/19

More in Native binaries

All 113 entries in Native binaries