Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/washi1337/ghidra-nativeaot
Helper scripts for analyzing NativeAOT compiled .NET binaries with Ghidra
https://github.com/washi1337/ghidra-nativeaot
dotnet ghidra ghidra-scripts nativeaot
Last synced: 5 days ago
JSON representation
Helper scripts for analyzing NativeAOT compiled .NET binaries with Ghidra
- Host: GitHub
- URL: https://github.com/washi1337/ghidra-nativeaot
- Owner: Washi1337
- License: mit
- Created: 2023-11-16T21:31:06.000Z (12 months ago)
- Default Branch: main
- Last Pushed: 2023-11-16T21:33:09.000Z (12 months ago)
- Last Synced: 2024-08-01T19:55:16.410Z (3 months ago)
- Topics: dotnet, ghidra, ghidra-scripts, nativeaot
- Language: Java
- Homepage:
- Size: 1.29 MB
- Stars: 54
- Watchers: 2
- Forks: 4
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE.md
Awesome Lists containing this project
README
# Ghidra + NativeAOT
NativeAOT-compiled programs are binaries that have the .NET runtime as well as all the .NET metadata statically linked into a single binary that can run natively on the target host.
Because of the sheer amount of code and data, it can be difficult to analyze them sometimes.
This is why, since the release of NativeAOT, malware developers have taken an interest in using this technique not just for portability but also as a means of obfuscation.
This repo contains a collection of Ghidra scripts that may help in analyzing these types of files with Ghidra.
## How to Use
Add the `src` folder of this repo to the Ghidra scripts folders.
The scripts should then appear in the Script Manager under the `NativeAOT` category.
## Disclaimer
The scripts have been tested with Ghidra 10.4 and only on Windows x64 PEs and Linux x64 ELFs.
## Contents
### NativeAotStringFinder
Finds and annotates string literals based on a provided Method Table address representing `System.String`.
### NativeAotMethodTableAnalyzer
Recursively (but non-exhaustively) discovers and parses Method Tables (essentially .NET's version of types/vtables) based on an initial Method Table address.
## License
MIT