GhidraGo is a mechanism to cause Ghidra to display a previously imported program within a local or multi-user project using a ghidraURL hyperlink similar to an http reference. In practice ghidraURL's work very similarly to selecting a URL reference which displays a PDF. Once setup correctly, GhidraURL links can be placed in web pages, external project documentation files, or any other place a URL hyperlink can be placed.
When a GhidraURL is selected, GhidraGo will startup Ghidra if it isn't already running as well as prompt to login to the multi-user project if necessary. The program is displayed in the default tool, usually the codebrowser, and can be configured to re-use an open default tool or to use a new default tool. The GhidraURL must currently be locating a DomainFile that is either in a Remote, Shared project, or a local project.
GhidraGo is a combination of a command line program to send a link, a plugin running within the Ghidra project manager, and the configuration of the default handling for the ghidraURL within the user environment. The ghidraURL is sent as the first and only parameter to the ghidraGo command line interface.
GhidraGo passes information through a simple filesystem mechanism vice an open port for security and simplicity. GhidraGo works on Windows, Linux, and MacOS.
GhidraURL's have the format:
Remote Ghidra Server File: ghidra://<host>[:<port>]/<repository-name>/<program-path> [#<address-or-symbol-ref>]
Example: ghidra://hostname/Repo/notepad.exe#main
Local Ghidra Project File: ghidra:/[<project-path>/]<project-name>?/<program-path> [#<address-or-symbol-ref>]
Example: ghidra:/share/MyProject?/notepad.exe#main
ghidraGo ghidra://ghidra-server/project/myProgram#symbol
Executing this command will result in the program called myProgram
being
opened in Ghidra's default tool with the cursor at symbol
.
Ghidra is now configured to listen to GhidraGo Requests. You can execute a GhidraGo request
using the "ghidraGo" shell/batch script in
/path/to/ghidra/support/GhidraGo/ghidraGo
Configuring your platform to handle the protocol is what enables the ghidraGo command line interface to be associated with a ghidraURL. Once configured, clicking hyperlinks that start with the protocol will execute the ghidraGo CLI with that hyperlink as the first argument. The configuration is platform specific.
*NOTE: changes to your path to ghidra, such as upgrading ghidra to a new version, will require the path you set in this configuration to be updated.
regedit
C:\Path\To\Ghidra\support\GhidraGo\ghidraGo "%1"
In Linux, when you click a browser link with an href
value to a GhidraURL,
you'll be prompted to use xdg-open.
ghidra.desktop
in ~/.local/share/applications
[Desktop Entry]
Name=ghidra Client
Exec=/path/to/ghidra/support/GhidraGo/ghidraGo "%u"
Type=Application
Terminal=false
MimeType=x-scheme-handler/ghidra;
~/.local/share/applications
[Default Applications]
x-scheme-handler/ghidra=ghidra.desktop
...
After the steps above, you should be able to click a GhidraURL href, get the same xdg-open prompt, and upon clicking "Open xdg-open" GhidraGo should execute and open Ghidra to the given GhidraURL.
Script Editor
and past the following into the editor.
on open location schemeUrl
set ghidraUrl to quoted form of schemeUrl
do shell script "/path/to/ghidraGo " & ghidraUrl
end open location
/Applications
or ~/Applications
<string>com.apple.ScriptEditor.id.GhidraGo</string>
paste the following:
<key>CFBundleURLTypes</key>
<array>
<dict>
<key>CFBundleURLName</key>
<string>Ghidra Scheme</string>
<key>CFBundleURLSchemes</key>
<array>
<string>ghidra</string>
</array>
</dict>
</array>