0

I am trying out Ghidra scripting in Java and I would like to get the functions a program exports as shown under the "Exports" folder in the Symbol Tree. However, I can't seem to figure out how to achieve this.

I have tried the solution listed here: Getting Imports/Exports from an PE using a Ghidra Script but that is only for returning Imports.

0necloud
  • 1

1 Answers1

0

One nice thing about Ghidra is that it's open source. Since the exports can be seen using the Code Browser GUI in the Symbol Tree window, you can see how they gather the exports by looking through the source code on GitHub. This is the specific function that you would find: https://github.com/NationalSecurityAgency/ghidra/blob/c66ad6b047255f9e218dfe7051f3e0e065d0340d/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/symboltree/nodes/ExportsCategoryNode.java#L54

A simple Python script may look something like this (tested with Ghidra v10.3):

# Get the symbol table of the current program
symtab = currentProgram.getSymbolTable()

# Get all external entry points.
# This is an iterator of addresses for exports.
exportAddrs = symtab.getExternalEntryPointIterator()

# Iterate the entry point addresses to get the relative symbol.
# Print the symbol name if successfully got.
for addr in exportAddrs:
    sym = sm.getPrimarySymbol(addr)
    if(sym is not None):
        print(sym.getName())
Ben_Lolo
  • 1