Скачать или смотреть Reversing: Import function names from IDA Pro into Ghidra

Export function names from IDA Pro and import them with the ImportSymbolsScript.py script from Ghidra's Script Manager. IDA Pro can recognize many library functions and label them appropriately. Ghidra can do so as well, but many times the sets of recognized functions differ. So, why not combine the power of both tools?

Background: Every reverser has been in this situation: You spend ages reversing a quite complicated function only to find out at some point that it is an optimized variant of the memcpy or printf function. Great success. Executables often include a few statically linked functions, e.g. strcpy, memcpy, memset, or the new and delete operators for C++, even if the executable is otherwise dynamically linked. Using its FLIRT function recognition technique with pre-populated signatures, IDA Pro can help label these functions, so that the set of "custom" functions that require manual analysis is reduced.

The export_symbols.idc can be found here: https://gist.github.com/ChrisDietrich...
It is based on https://gist.github.com/hax0kartik/e3...

This video is part of the lecture "Malware Analysis and Cyber Threat Intelligence" for the master programme Internet Security at the Westphalian University in Gelsenkirchen, Germany. More information can be found at https://www.it-sicherheit.de/master-s...