mirror of
https://github.com/NationalSecurityAgency/ghidra.git
synced 2025-10-03 17:59:46 +02:00
dcc56457ea
Change name of symbolserver 'remote' property to 'untrusted' to reflectits intended usage.Add column in config table to allow user to toggle trusted status onhttp:// symbol servers (the only type that currently supports thisconcept)
82 lines
3.3 KiB
Java
82 lines
3.3 KiB
Java
/* ###
|
|
* IP: GHIDRA
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
//Creates a http download URL for a binary that Microsoft has previously published on their symbol server
|
|
// (ie. windows OS binaries). Useful for sharing an exact Windows OS binary from your local
|
|
// workstation to someone else without requiring the recipient to trust your binary as they
|
|
// can download it directly from Microsoft's symbol server.
|
|
// This works by extracting 2 pieces of metadata from the chosen binary's PE header to create
|
|
// the URL to Microsoft's symbol server and verifying that it exists on Microsoft's symbol server
|
|
// by connecting to the MS symbol server and probing for the file before declaring success and
|
|
// showing it to the user.
|
|
//@category Import
|
|
|
|
import java.io.File;
|
|
import java.io.IOException;
|
|
import java.nio.file.AccessMode;
|
|
import java.util.List;
|
|
|
|
import ghidra.app.script.GhidraScript;
|
|
import ghidra.app.util.bin.FileByteProvider;
|
|
import ghidra.app.util.bin.format.pe.NTHeader;
|
|
import ghidra.app.util.bin.format.pe.PortableExecutable;
|
|
import ghidra.app.util.bin.format.pe.PortableExecutable.SectionLayout;
|
|
import pdb.symbolserver.*;
|
|
|
|
public class GetMSDownloadLinkScript extends GhidraScript {
|
|
|
|
private static final String MS_PUBLIC_SYMBOL_SERVER_URL =
|
|
"https://msdl.microsoft.com/download/symbols/";
|
|
|
|
@Override
|
|
protected void run() throws Exception {
|
|
SymbolServerService symbolService =
|
|
new SymbolServerService(new SameDirSymbolStore(null),
|
|
List.of(HttpSymbolServer.createTrusted(MS_PUBLIC_SYMBOL_SERVER_URL)));
|
|
|
|
File f = askFile("File To Scan", "Select");
|
|
if (f == null) {
|
|
return;
|
|
}
|
|
|
|
try (FileByteProvider bp = new FileByteProvider(f, null, AccessMode.READ)) {
|
|
monitor.setMessage("Parsing file " + f.getName());
|
|
PortableExecutable pe = new PortableExecutable(bp, SectionLayout.FILE, false, false);
|
|
NTHeader ntHeader = pe.getNTHeader();
|
|
if (ntHeader != null && ntHeader.getOptionalHeader() != null) {
|
|
int timeDateStamp = ntHeader.getFileHeader().getTimeDateStamp();
|
|
int sizeOfImage = (int) ntHeader.getOptionalHeader().getSizeOfImage();
|
|
println(f + ", timeDateStamp: " + Integer.toHexString(timeDateStamp) +
|
|
", sizeOfImage: " + Integer.toHexString(sizeOfImage));
|
|
SymbolFileInfo symbolFileInfo = SymbolFileInfo.fromValues(f.getName().toLowerCase(),
|
|
Integer.toHexString(timeDateStamp), sizeOfImage);
|
|
List<SymbolFileLocation> findResults = symbolService.find(symbolFileInfo, monitor);
|
|
if (findResults.isEmpty()) {
|
|
println("Not found on " + MS_PUBLIC_SYMBOL_SERVER_URL);
|
|
return;
|
|
}
|
|
SymbolFileLocation symLoc = findResults.get(0);
|
|
println("Download link: " + symLoc.getLocationStr());
|
|
}
|
|
else {
|
|
printerr("Unrecognized format: " + f);
|
|
}
|
|
}
|
|
catch (IOException e) {
|
|
printerr("Failed to parse file: " + f);
|
|
printerr(e.getMessage());
|
|
}
|
|
}
|
|
}
|