{"id":50677672,"url":"https://github.com/kassane/ghidra-demangle-scripts","last_synced_at":"2026-06-08T16:35:02.373Z","repository":{"id":356553852,"uuid":"1233062736","full_name":"kassane/ghidra-demangle-scripts","owner":"kassane","description":"Ghidra Headless - decomp C++, Rust, Swift, D","archived":false,"fork":false,"pushed_at":"2026-05-09T13:20:04.000Z","size":19,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-08T14:34:25.593Z","etag":null,"topics":["decompilation","demangle-symbols","ghidra-scripts","reverse-engineering"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"unlicense","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kassane.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-08T14:52:40.000Z","updated_at":"2026-05-09T13:20:07.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/kassane/ghidra-demangle-scripts","commit_stats":null,"previous_names":["kassane/ghidra-demangle-scripts"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/kassane/ghidra-demangle-scripts","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kassane%2Fghidra-demangle-scripts","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kassane%2Fghidra-demangle-scripts/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kassane%2Fghidra-demangle-scripts/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kassane%2Fghidra-demangle-scripts/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kassane","download_url":"https://codeload.github.com/kassane/ghidra-demangle-scripts/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kassane%2Fghidra-demangle-scripts/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34071657,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-08T02:00:07.615Z","response_time":111,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["decompilation","demangle-symbols","ghidra-scripts","reverse-engineering"],"created_at":"2026-06-08T16:35:01.471Z","updated_at":"2026-06-08T16:35:02.368Z","avatar_url":"https://github.com/kassane.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Ghidra Headless RE: C++23, D, Rust, Swift\n\nHeadless Ghidra toolkit — demangle symbols, rename functions, and decompile binaries for four languages without opening the GUI.\n\n## Requirements\n\n| Tool | Notes |\n|------|-------|\n| Ghidra | `analyzeHeadless` at `/opt/ghidra/support/` |\n| g++ 13+ | `-std=c++23` support |\n| LDC2 | includes `ddemangle` |\n| c++filt | GNU binutils, standard on Linux |\n| rustfilt | `cargo install rustfilt` |\n| swift-demangle | Swift toolchain, must be on `PATH` |\n\n## Layout\n\n```\nghidra-demangle-scripts/\n├── decompile.sh                        # build all samples + run all Ghidra passes\n├── sample/\n│   ├── target.cpp / target_cpp         # C++23\n│   ├── target.d   / target_d           # D (extern(D) + extern(C++, \"ns\"))\n│   ├── target.rs  / target_rust        # Rust\n│   └── target.swift / target_swift     # Swift\n├── ghidra_scripts/\n│   ├── ExtractFunctions.java   # C++23 feature tagging + xrefs + decompile\n│   ├── DemangleD.java          # _D* via ddemangle, _Z* via c++filt\n│   ├── DemangleRust.java       # _R* and _ZN*…h\u003chash\u003eE via rustfilt\n│   └── DemangleSwift.java      # $s / _$s via swift-demangle\n├── *_analysis_output.txt               # generated: symbol + function reports\n└── *_decompiled_output.c               # generated: Ghidra decompiler output\n```\n\n## Build Samples \u0026 Run Analysis\n\n```bash\nbash decompile.sh\n```\n\nThe script builds all four sample binaries and runs each Ghidra headless pass in sequence. Output files are written to the repo root:\n\n| File | Script |\n|------|--------|\n| `cpp_analysis_output.txt` | `ExtractFunctions.java` |\n| `cpp_decompiled_output.c` | `ExtractFunctions.java` |\n| `d_analysis_output.txt` | `DemangleD.java` |\n| `d_decompiled_output.c` | `DemangleD.java` |\n| `rust_analysis_output.txt` | `DemangleRust.java` |\n| `rust_decompiled_output.c` | `DemangleRust.java` |\n| `swift_analysis_output.txt` | `DemangleSwift.java` |\n| `swift_decompiled_output.c` | `DemangleSwift.java` |\n\nOverride output paths per-pass with `-scriptArgs \"output.path=/tmp/out.txt decompile.path=/tmp/out.c\"`.\n\nAll four samples share the same license logic: length 12, byte/scalar sum `0x4B2`, prefix `A`.\nValid key example: `Auffffffffff`.\n\n## Scripts\n\n### ExtractFunctions.java — C++23\n\nTags functions with detected C++23 features and decompiles all non-thunk functions to `cpp_decompiled_output.c`. Ghidra's built-in demangler strips `std::` before postScripts run, so the script scans the full signature string (name + param types + return type) and matches bare forms:\n\n| Tag | Matches |\n|-----|---------|\n| `[C++23:expected]` | `expected\u003c` |\n| `[C++23:print]` | `println`, `vprint_*` |\n| `[C++23:fold]` | `fold_left`, `fold_right` |\n| `[C++23:deducing-this]` | `(this ` in signature |\n| `[C++23:flat]` | `flat_map`, `flat_set` |\n| `[C++23:generator]` | `generator\u003c` |\n\n### DemangleD.java — D\n\n- `_D*` → `ddemangle` via **stdin** (passing as CLI arg causes \"Cannot open file\")\n- `_Z*` → `c++filt \u003csymbol\u003e`\n- Reports `[extern(D)  ]` / `[extern(C++)]` per symbol\n- Auto-discovers `ddemangle` from `PATH` then `~/.dlang/*/bin/`\n\n### DemangleRust.java — Rust\n\n- `_R*` → v0 mangling\n- `_ZN*17h[0-9a-f]{16}E` → legacy mangling (hash suffix distinguishes Rust from C++)\n- Both handled by `rustfilt \u003csymbol\u003e`; auto-discovers from `PATH` then `~/.cargo/bin/`\n\n### DemangleSwift.java — Swift\n\n- `$s` prefix on Linux, `_$s` on macOS\n- `swift-demangle \u003csymbol\u003e` outputs `mangled ---\u003e demangled`; script splits on ` ---\u003e `\n- Auto-discovers from `PATH` then `/usr/bin/swift-demangle`\n\n## D Namespace Gotcha\n\nLDC2's colon-form `extern(C++, \"ns\"):` accumulates namespace context — a second block nests inside the first. Use **block form** instead:\n\n```d\nextern(C++, \"security\") { uint fnv1a(...) { ... } }   // → security::fnv1a\nextern(C++, \"crackme\")  { class Validator { ... } }   // → crackme::Validator\n```\n\nString-literal form (`\"ns\"`) specifies an absolute namespace path; identifier form (`ns`) does not.\n\nD slices (`string`, `int[]`) have no C++ ABI — use `const(char)*` + `size_t` in `extern(C++)` methods and bridge back to D logic via a `@trusted` function.\n\n## Gotchas\n\n| | |\n|---|---|\n| `ldc2 -of=~/...` | `~` not expanded; use `$HOME` or absolute path |\n| `ddemangle` | stdin only — not CLI arg |\n| `c++filt` / `rustfilt` | CLI arg — not stdin |\n| `--edition=` | valid: 2023, 2024, 2025 |\n| `-preview=safer` | disallows `.ptr` on slices; use `\u0026arr[0]` |\n| `grep '$s'` | use `-F` flag; `$s` is not a shell variable |\n\n## References\n\n- [Ghidra Scripting API](https://ghidra.re/online-docs/api/ghidra/app/script/GhidraScript.html)\n- [DecompInterface API](https://ghidra.re/online-docs/api/ghidra/app/decompiler/DecompInterface.html)\n- [D extern(C++) interop](https://dlang.org/spec/cpp_interface.html)\n- [Rust symbol mangling v0](https://doc.rust-lang.org/rustc/symbol-mangling/v0.html)\n- [Swift ABI mangling](https://github.com/apple/swift/blob/main/docs/ABI/Mangling.rst)\n- [Itanium C++ ABI](https://itanium-cxx-abi.github.io/cxx-abi/abi.html#mangling)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkassane%2Fghidra-demangle-scripts","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkassane%2Fghidra-demangle-scripts","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkassane%2Fghidra-demangle-scripts/lists"}