20urc3 / sekiryu

Comprehensive toolkit for Ghidra headless.

Sekiryu v0.0.2

This Ghidra Toolkit is a comprehensive suite of tools designed to streamline and automate various tasks associated with running Ghidra in Headless mode. This toolkit provides a wide range of scripts that can be executed both inside and alongside Ghidra, enabling users to perform tasks such as Vulnerability Hunting, Pseudo-code Commenting with ChatGPT and Reporting with Data Visualization on the analyzed codebase. It allows user to load and save their own script and interract with the built-in API of the script.

Key Features

• Headless Mode Automation: The toolkit enables users to seamlessly launch and run Ghidra in Headless mode, allowing for automated and batch processing of code analysis tasks.

• Script Repository/Management: The toolkit includes a repository of pre-built scripts that can be executed within Ghidra. These scripts cover a variety of functionalities, empowering users to perform diverse analysis and manipulation tasks. It allows users to load and save their own scripts, providing flexibility and customization options for their specific analysis requirements. Users can easily manage and organize their script collection.

• Flexible Input Options: Users can utilize the toolkit to analyze individual files or entire folders containing multiple files. This flexibility enables efficient analysis of both small-scale and large-scale codebases.

Available scripts

• Vulnerability Hunting with pattern recognition: Leverage the toolkit's scripts to identify potential vulnerabilities within the codebase being analyzed. This helps security researchers and developers uncover security weaknesses and proactively address them.
• Vulnerability Hunting with SemGrep: Thanks to the security Researcher 0xdea and the rule-set they created, we can use simple rules and SemGrep to detect vulnerabilities in C/C++ pseudo code (their github: https://github.com/0xdea/semgrep-rules)
• Automatic Pseudo Code Generating: Automatically generate pseudo code within Ghidra's Headless mode. This feature assists in understanding and documenting the code logic without manual intervention.
• Pseudo-code Commenting with ChatGPT: Enhance the readability and understanding of the codebase by utilizing ChatGPT to generate human-like comments for pseudo-code snippets. This feature assists in documenting and explaining the code logic.
• Reporting and Data Visualization: Generate comprehensive reports with visualizations to summarize and present the analysis results effectively. The toolkit provides data visualization capabilities to aid in identifying patterns, dependencies, and anomalies in the codebase.

Pre-requisites

Before using this project, make sure you have the following software installed:

• Ghidra: You can download Ghidra from the National Security Agency's GitHub repository @ https://github.com/NationalSecurityAgency/ghidra
• Java: Make sure you have Java Development Kit (JDK) version 17 or higher installed. You can download it from the OpenJDK website @ https://openjdk.org/projects/jdk/17/
• BinExport (OPTIONNAL) Follow the instruction for installing the Ghidra Extension https://github.com/google/binexport
• SemGrep (OPTIONNAL) Follow the instruction detailed https://semgrep.dev/docs/getting-started/

Installation

• Install the pre-requisites mentionned above.
• Download Sekiryu release directly from Github or use: pip install sekiryu.

Usage

In order to use the script you can simply run it against a binary with the options that you want to execute.

• sekiryu [-F FILE][OPTIONS]

Please note that performing a binary analysis with Ghidra (or any other product) is a relatively slow process. Thus, expect the binary analysis to take several minutes depending on the host performance. If you run Sekiryu against a very large application or a large amount of binary files, be prepared to WAIT

Demos

• Find demo on www.bushido-sec.com

API

The "server.py" is basically built to allow scripts to interract with Ghidra each other and with the host system. 
An User can easily develop their own script, load and saved it in the script folder and use the known functions 
of the API to interract with Ghidra.    

In order to use it the User must import xmlrpc in their script and call the function like for example: proxy.send_data

Functions

• send_data() - Allows user to send data to the server. ("data" is a Dictionnary)
• recv_data() - Allows user to receive data from the server. ("data" is a Dictionnary)
• request_GPT() - Allows user to send string data via ChatGPT API.

Use your own scripts

Scripts are saved in the folder /modules/scripts/ you can simply copy your script there. In the ghidra_pilot.py file you can find the following function which is responsible to run a headless ghidra script:

def exec_headless(file, script):
	"""
	Execute the headless analysis of ghidra
	"""
	path = ghidra_path + 'analyzeHeadless'
	# Setting variables
	tmp_folder = "/tmp/out"
	os.mkdir(tmp_folder)
	cmd = ' ' + tmp_folder + ' TMP_DIR -import'+ ' '+ file + ' '+ "-postscript "+ script +" -deleteProject"	

	# Running ghidra with specified file and script
	try:	
		p = subprocess.run([str(path + cmd)], shell=True, capture_output=True)
		os.rmdir(tmp_folder)

	except KeyError as e:
		print(e)
		os.rmdir(tmp_folder)

The usage is pretty straight forward, you can create your own script then just add a function in the ghidra_pilot.py such as:

def yourfunction(file):
	try:
		# Setting script
		script = "modules/scripts/your_script.py"
	
		# Start the exec_headless function in a new thread
		thread = threading.Thread(target=exec_headless, args=(file, script))
		thread.start()
		thread.join()
	except Exception as e:
		print(str(e))

The file cli.py is responsible for the command-line-interface and allows you to add argument and command associated like this:

analysis_parser.add_argument('[-ShortCMD]', '[--LongCMD]', help="Your Help Message", action="store_true")

Contributions

• Scripts/SCRIPTS/SCRIIIIIPTS: This tool is designed to be a toolkit allowing user to save and run their own script easily, obviously if you can contribue in any sort of script (anything that is interesting will be approved !)
• Optimization: Any kind of optimization are welcomed and will almost automically be approved and deployed every release, some nice things could be: improve parallel tasking, code cleaning and overall improvement.
• Malware analysis: It's a big part, which i'm not familiar with. Any malware analyst willing to contribute can suggest idea, script, or even commit code directly in the project.
• Reporting: I ain't no data visualization engineer, if anyone is willing to improve/contribue on this part, it'll be very nice.

Warning

The xmlrpc.server module is not secure against maliciously constructed data. If you need to parse 
untrusted or unauthenticated data see XML vulnerabilities.

Special thanks

A lot of people encouraged me to push further on this tool and improve it. Without you all this project wouldn't have been
the same so it's time for a proper shout-out:
- @JeanBedoul @McProustinet @MilCashh @Aspeak @mrjay @Esbee|sandboxescaper @Rosen @Cyb3rops @RussianPanda @Dr4k0nia
- @Inversecos @Vs1m @djinn @corelanc0d3r @ramishaath @chompie1337
Thanks for your feedback, support, encouragement, test, ideas, time and care.

For more information about Bushido Security, please visit our website: https://www.bushido-sec.com/.

sekiryu's Issues

Change from multi-threading to multiprocessing

Python's Global Interpreter Lock (GIL) limits the execution of multiple threads in parallel due to its restrictions on simultaneous thread execution, especially for CPU-bound tasks. For CPU-bound operations, using the multiprocessing module might be more effective since it bypasses the GIL by spawning separate processes.

https://docs.python.org/3/library/multiprocessing.html

readline isn't compatible with Windows

Implement workaround

module "xmlrpc" not found

When running the script on Ghidra, the module "xmlrpc" is not found.

I looked around for it, but cant install it via pip and cant find a source for it anywhere for manual install.

add code-coverage plugin

requirements.txt for qol

would improve installation

same result with different PE/ELF

hello,

not sure it works as expected but maybe I make something wrong...

I created a little "hello_word" under linux and compile it with gcc ( gcc hello_world.c -o hello_world)

/* File name is hello_world.c */
#include <stdio.h>

int main(void)
{
    printf("Hello world!\n");
}

and the result is : ( to be honest, I tested several PE/ELF files with the same result)

{
  "choices": [
    {
      "finish_reason": "stop",
      "index": 0,
      "logprobs": null,
      "text": " 'Function ended'\n\n[FUNC_START] \n//This is a function that calculates the sum of two numbers\nfunction addNumbers(x, y) {  //The function takes in two parameters x and y which are both numbers to be added together  \n    let result = x + y;      //A variable called result is declared and assigned the value of x plus y  \n    return result;          //The value stored in the variable \"result\" is returned as output from this function. \n}                        \n[FUNC_END] \n\nFunction Ended"
    }
  ],
  "created": 1679159377,
  "id": "cmpl-xxxxxxxxxxxxxxxxxxxxxxxx",
  "model": "text-davinci-003",
  "object": "text_completion",
  "usage": {
    "completion_tokens": 122,
    "prompt_tokens": 51,
    "total_tokens": 173
  }
}{
  "choices": [
    {
      "finish_reason": "stop",
      "index": 0,
      "logprobs": null,
      "text": " 'Function End'\n\n[FUNC_START] \n// Function to calculate the total sum of an array of numbers \nfunction calcTotalSum(numsArray) { //Calculate Total Sum function taking in numsArray as parameter\n\n    let totalSum = 0; //Initialize totalSum variable to 0\n\n    for (let i = 0; i < numsArray.length; i++) { //Loop through each element in numsArray \n        const currentNum = numsArray[i]; //Assign value of current element from numsArray to currentNum variable\n\n        totalSum += currentNum; //Add value of currentNum to totalSum and store result back into totalSum     \n    }\n\n    return totalSum; //Return final calculated sum value stored in the `totalSum` variable  \n}\n[FUNC_END]  Function End"
    }
  ],
  "created": 1679159382,
  "id": "cmpl-xxxxxxxxxxxxxxxxxxxxxxxx",
  "model": "text-davinci-003",
  "object": "text_completion",
  "usage": {
    "completion_tokens": 187,
    "prompt_tokens": 51,
    "total_tokens": 238
  }
}{
  "choices": [
    {
      "finish_reason": "stop",
      "index": 0,
      "logprobs": null,
      "text": "\n\n// [FUNC_START] \n// Function to calculate the total cost of a product\nfunction calculateProductCost(price, taxRate) {\n    let calculatedTax = price * (taxRate/100); // Calculate the tax based on input parameters. \n\n    return price + calculatedTax; // Return total cost after adding up the price and tax rate. \n}\n// [FUNC_END]"
    }
  ],
  "created": 1679159388,
  "id": "cmpl-xxxxxxxxxxxxxxxxxxxxxxxx",
  "model": "text-davinci-003",
  "object": "text_completion",
  "usage": {
    "completion_tokens": 91,
    "prompt_tokens": 51,
    "total_tokens": 142
  }
}{
  "choices": [
    {
      "finish_reason": "stop",
      "index": 0,
      "logprobs": null,
      "text": " 'END OF FUNCTION'\n\n[FUNC_START] \n// This function calculates the total cost of an item, including tax. \nfunction calculateTotalCost(price, taxRate) {\n    // Calculate the total cost by multiplying price and rate then adding it to original price. \n    let totalCost = (price * taxRate) + price;\n\n    return totalCost; // Return the calculated value. \n}  \n[FUNC_END] \nEND OF FUNCTION"
    }
  ],
  "created": 1679159391,
  "id": "cmpl-xxxxxxxxxxxxxxxxxxxxxxxx",
  "model": "text-davinci-003",
  "object": "text_completion",
  "usage": {
    "completion_tokens": 111,
    "prompt_tokens": 51,
    "total_tokens": 162
  }
}{
  "choices": [
    {
      "finish_reason": "stop",
      "index": 0,
      "logprobs": null,
      "text": "\n\n// [FUNC_START] \nfunction calculateTotalPrice(itemPrice, quantity) {\n    let discount = 0.05; // 5% discount on item price\n\n    let totalWithoutDiscount = itemPrice * quantity; //calculate total without discount\n\n    let discountedAmount = totalWithoutDiscount * discount; //calculate the discounted amount based on the provided rate\n\n    return totalWithoutDiscount - discountedAmount; //return the final price after applying discounts\n} \n//[FUNC_END] \nThis function calculates and returns a new price for an item given its original price and quantity."
    }
  ],
  "created": 1679159396,
  "id": "cmpl-xxxxxxxxxxxxxxxxxxxxxxxx",
  "model": "text-davinci-003",
  "object": "text_completion",
  "usage": {
    "completion_tokens": 134,
    "prompt_tokens": 51,
    "total_tokens": 185
  }
}{
  "choices": [
    {
      "finish_reason": "stop",
      "index": 0,
      "logprobs": null,
      "text": "\n\n[FUNC_START]\n// This function removes all characters in a string except for the last four \nfunction removeChars(str) { \n\n    // Get length of string  \n    let len = str.length; \n\n    // Return substring from index 0 to length - 4  \n    return str.substring(0, len-4); \n}    \nconsole.log(removeChars(\"This is some text\"));  // Output: \"This is\" [FUNC_END]"
    }
  ],
  "created": 1679159401,
  "id": "cmpl-xxxxxxxxxxxxxxxxxxxxxxxx",
  "model": "text-davinci-003",
  "object": "text_completion",
  "usage": {
    "completion_tokens": 114,
    "prompt_tokens": 51,
    "total_tokens": 165
  }
}{
  "choices": [
    {
      "finish_reason": "stop",
      "index": 0,
      "logprobs": null,
      "text": "\n\n// [FUNC_START]\n// This function will calculate the sum of two numbers \nfunction addTwoNumbers(num1, num2) {\n    return num1 + num2;  // adding two number together and return the result \n}\n// [FUNC_END]"
    }
  ],
  "created": 1679159406,
  "id": "cmpl-xxxxxxxxxxxxxxxxxxxxxxxx",
  "model": "text-davinci-003",
  "object": "text_completion",
  "usage": {
    "completion_tokens": 65,
    "prompt_tokens": 51,
    "total_tokens": 116
  }
}{
  "choices": [
    {
      "finish_reason": "stop",
      "index": 0,
      "logprobs": null,
      "text": "\n\n[FUNC_START]\n// This function calculates the total cost of a purchase \nfunction calculateCost(price, taxRate) {  // Function to calculate the total cost of an item with given price and tax rate\n    let calculatedTax = (taxRate * price); // Calculate the amount of Tax based on Price and Tax Rate\n\n    return (calculatedTax + price); // Return Total Cost by adding Price and Calculated Tax together  \t\t\t\t     [FUNC_END]"
    }
  ],
  "created": 1679159408,
  "id": "cmpl-xxxxxxxxxxxxxxxxxxxxxxxx",
  "model": "text-davinci-003",
  "object": "text_completion",
  "usage": {
    "completion_tokens": 108,
    "prompt_tokens": 51,
    "total_tokens": 159
  }
}{
  "choices": [
    {
      "finish_reason": "stop",
      "index": 0,
      "logprobs": null,
      "text": "\n\n[FUNC_START] \n// This function reverses a string and returns the reversed version of it.  \nfunction reverseString(str) { // Function declaration to reverse a string \n\n    let reversedStr = ''; // Initialize an empty string for the result\n\n    for (let i = str.length - 1; i >= 0; i--) { // Iterate over each character in the original string from last to first index \n        reversedStr += str[i]; // Add each character from original string to the new one starting from last character \n    }\n\n    return reversedStr; // Return the reversed version of provided inputted String \n}  \n[FUNC_END]"
    }
  ],
  "created": 1679159413,
  "id": "cmpl-xxxxxxxxxxxxxxxxxxxxxxxx",
  "model": "text-davinci-003",
  "object": "text_completion",
  "usage": {
    "completion_tokens": 152,
    "prompt_tokens": 51,
    "total_tokens": 203
  }
}{
  "choices": [
    {
      "finish_reason": "stop",
      "index": 0,
      "logprobs": null,
      "text": "\n\n// [FUNC_START] \nfunction getTotal() {\n    let totalPrice = 0;\n\n    for (let i = 0; i < items.length; i++) { // loop through all the items in the array 'items' \n        totalPrice += item[i].price; // add each item's price to the totalPrice variable  \n    }\n\n    return totalPrice; // returns the calculated sum of prices from all of the items \n}\n// [FUNC_END]"
    }
  ],
  "created": 1679159418,
  "id": "cmpl-xxxxxxxxxxxxxxxxxxxxxxxx",
  "model": "text-davinci-003",
  "object": "text_completion",
  "usage": {
    "completion_tokens": 111,
    "prompt_tokens": 51,
    "total_tokens": 162
  }
}{
  "choices": [
    {
      "finish_reason": "stop",
      "index": 0,
      "logprobs": null,
      "text": "\n\n// [FUNC_START] \n// This function calculates the sum of two numbers and returns it. \nfunction addNumbers(num1, num2) {   //Declaring a function named \"addNumbers\" with arguments \"num1\" and \"num2\". \n    let total = num1 + num2;        //Declaring a variable called \"total\" to store the result of addition operation between given two numbers. \n\n    return total;                  //Returning the value stored in variable \"total\". \n}                                  \n// [FUNC_END]"
    }
  ],
  "created": 1679159423,
  "id": "cmpl-xxxxxxxxxxxxxxxxxxxxxxxx",
  "model": "text-davinci-003",
  "object": "text_completion",
  "usage": {
    "completion_tokens": 125,
    "prompt_tokens": 51,
    "total_tokens": 176
  }
}{
  "choices": [
    {
      "finish_reason": "stop",
      "index": 0,
      "logprobs": null,
      "text": "\n\n[FUNC_START] \n//This function takes two arguments and returns the product of those two numbers.\nfunction multiplyNumbers(num1, num2) {\n    let result = num1 * num2; //Multiply both numbers together to get a result  \n\n    return result; //Return the multiplied number \n} \n[FUNC_END]"
    }
  ],
  "created": 1679159428,
  "id": "cmpl-xxxxxxxxxxxxxxxxxxxxxxxx",
  "model": "text-davinci-003",
  "object": "text_completion",
  "usage": {
    "completion_tokens": 82,
    "prompt_tokens": 51,
    "total_tokens": 133
  }
}{
  "choices": [
    {
      "finish_reason": "stop",
      "index": 0,
      "logprobs": null,
      "text": " \"This function succeeded\"\n\n// [FUNC_START]\nlet num = 0;  // Initialize a counter variable to 0 \nfunction addOne() {   // Function to increment the counter by 1\n    num++;     // Increment the counter by 1\n}  \naddOne();      // Call the function to increment the counter once \nconsole.log(num);   // Outputs 1 as expected, since it was incremented once \n// [FUNC_END] This function succeeded"
    }
  ],
  "created": 1679159432,
  "id": "cmpl-xxxxxxxxxxxxxxxxxxxxxxxx",
  "model": "text-davinci-003",
  "object": "text_completion",
  "usage": {
    "completion_tokens": 109,
    "prompt_tokens": 51,
    "total_tokens": 160
  }
}{
  "choices": [
    {
      "finish_reason": "stop",
      "index": 0,
      "logprobs": null,
      "text": "\n\n[FUNC_START]\n// This function calculates the area of a rectange. \nfunction calculateArea(length, width) {\n    let area = length * width; // Calculate the product of length and width which is the area of a rectangle \n\n    return area; // Return the calculated value to be used later \n}   [FUNC_END]"
    }
  ],
  "created": 1679159436,
  "id": "cmpl-xxxxxxxxxxxxxxxxxxxxxxxx",
  "model": "text-davinci-003",
  "object": "text_completion",
  "usage": {
    "completion_tokens": 82,
    "prompt_tokens": 51,
    "total_tokens": 133
  }
}{
  "choices": [
    {
      "finish_reason": "stop",
      "index": 0,
      "logprobs": null,
      "text": "\n\n[FUNC_START] \n//A function to calculate the product of two numbers \nfunction multiply(num1, num2) { //This function will take two parameters and return the product of them. \n    var result = num1 * num2; //Variable 'result' is assigned with value of multiplying both input parameter values.\n\n    return result; //Returning the value stored in variable 'result'.  \n}   [FUNC_END]"
    }
  ],
  "created": 1679159440,
  "id": "cmpl-xxxxxxxxxxxxxxxxxxxxxxxx",
  "model": "text-davinci-003",
  "object": "text_completion",
  "usage": {
    "completion_tokens": 101,
    "prompt_tokens": 51,
    "total_tokens": 152
  }
}{
  "choices": [
    {
      "finish_reason": "stop",
      "index": 0,
      "logprobs": null,
      "text": "\n\n[FUNC_START] \n//This function will convert a Celsius temperature to Fahrenheit. \nfunction celsiusToFahrenheit(celsiusTemp){ //Function declaration with parameter 'celsiusTemp' of type number. \n    let fahrenheitTemp = (celsiusTemp * 9/5) + 32; //Calculate the conversion from Celsius to Fahrenheit and assign it to 'fahrenheitTemp' variable.  \n\n    return fahrenheitTemp; //Return the calculated value of 'fahrenheitTemp'. \n}\n[FUNC_END]"
    }
  ],
  "created": 1679159443,
  "id": "cmpl-xxxxxxxxxxxxxxxxxxxxxxxx",
  "model": "text-davinci-003",
  "object": "text_completion",
  "usage": {
    "completion_tokens": 127,
    "prompt_tokens": 51,
    "total_tokens": 178
  }
}{
  "choices": [
    {
      "finish_reason": "stop",
      "index": 0,
      "logprobs": null,
      "text": "\n\n//[FUNC_START] \nfunction calculateSum(num1, num2) { \n    let sum = num1 + num2; // Calculate the sum of two numbers \n\n    return sum; // Return the result of calculation \n}  \n//[FUNC_END]"
    }
  ],
  "created": 1679159448,
  "id": "cmpl-xxxxxxxxxxxxxxxxxxxxxxxx",
  "model": "text-davinci-003",
  "object": "text_completion",
  "usage": {
    "completion_tokens": 67,
    "prompt_tokens": 51,
    "total_tokens": 118
  }
}

I testes for example with a .net file but same result :(