A Look at Jython-Enhanced Reverse Engineering with Ghidra
summary
Shows a concrete Ghidra workflow that automates resolving SpyEye’s hashed Windows API calls by using Ghidra’s Java/Python API and the built-in decompiler. It generates a rainbow-table of ~8,000 Windows exports, scans all instructions for 32-bit push constants, runs the custom hash to match names, and then renames functions and annotates types in-place. The Python/Jython script runs across the binary in about five seconds, handles most lookups (collision risk is low but noted), and substantially cuts manual reversal time.
AI-written summary · about
chapters (9)
- 0:00Introduction to Ghidra
- 2:00The challenge of static analysis
- 3:29Core features of Ghidra
- 6:30Scripting and automation
- 11:47SpyEye malware case study
- 17:49Reverse engineering API hashes
- 26:10Automating analysis with scripts
- 35:15Conclusion and takeaways
- 37:22Q&A session
related talks
48mGhidra - Journey from Classified NSA Tool to Open Source
45mFinding Vulnerabilities through Static Analysis and Scripting
36mAutomatic Detection of Anti‑Debugging with IDA/Ghidra and Debugging Process Efficiency via Support Features
01h 06mHow hacking works
21mDemystify Today's Binary Disassembling and How Modern ABI Makes it Easier
38mThere and Back Again: Reverse Engineering Python Binaries
50m.NET Reversing and Exploitation for Cool Kids
40mMalware Reverse Engineering with PE Tree—OSS Inspired by COVID