assemblyreverse-engineeringdisassemblyghidraradare2

how to Convert a .exe file to multiple assembly files at the function level?


I have an exe file and want to disassemble them. reverse engineering tools determine how many sections and functions this file consists of.

image describing the desired result

Now I want to have those functions separately as files. Now either in a text file or in any format. I just want to have these files separately.


Solution

  • The following script should get you started or even already address your need:

    //Exports function bodies into separate files
    //@author @larsborn
    //@category Assembly
    
    import java.io.File;
    import java.io.FileNotFoundException;
    import java.io.FileOutputStream;
    import java.io.IOException;
    import java.io.PrintWriter;
    
    import ghidra.app.script.GhidraScript;
    import ghidra.program.model.address.Address;
    import ghidra.program.model.address.AddressRange;
    import ghidra.program.model.address.AddressSetView;
    import ghidra.program.model.listing.Function;
    import ghidra.program.model.listing.Instruction;
    import ghidra.program.model.mem.MemoryAccessException;
    
    public class ExportFunctionDisassembly extends GhidraScript {
        public void run() throws Exception {
            File directory = askDirectory("Select directory for export", "Export!");
            for (Function function : currentProgram.getFunctionManager().getFunctions(true)) {
                exportBinary(directory, function);
                exportDisassembly(directory, function);
            }
        }
    
        private void exportDisassembly(File directory, Function function) throws FileNotFoundException {
            PrintWriter output = new PrintWriter(getFileName(directory, "asm", function));
            for (AddressRange ar : function.getBody()) {
                for (Address addr : ar) {
                    Instruction instr = getInstructionAt(addr);
                    if (instr == null) {
                        continue;
                    }
                    output.write(String.format("%s\n", instr.toString()));
                }
            }
            output.close();
        }
    
        private void exportBinary(File directory, Function function) throws MemoryAccessException, IOException {
            File output = new File(getFileName(directory, "bin", function));
            if (output.createNewFile()) {
                Address minAddress = minAddress(function.getBody());
                Address maxAddress = maxAddress(function.getBody());
                byte[] data = getBytes(minAddress, (int) (maxAddress.getOffset() - minAddress.getOffset()));
                FileOutputStream fos = new FileOutputStream(output);
                fos.write(data);
                fos.close();
            }
        }
    
        private String getFileName(File directory, String extension, Function function) {
            Address minAddress = minAddress(function.getBody());
            return String.format("%s%sfun-%08x.%s", directory.getAbsolutePath(), File.separator, minAddress.getOffset(),
                    extension);
        }
    
        private Address minAddress(AddressSetView asv) {
            Address ret = null;
    
            for (AddressRange ar : asv) {
                if (ret == null) {
                    ret = ar.getMinAddress();
                    continue;
                }
                if (ar.getMinAddress().getOffset() < ret.getOffset()) {
                    ret = ar.getMinAddress();
                }
            }
            return ret;
        }
    
        private Address maxAddress(AddressSetView asv) {
            Address ret = null;
    
            for (AddressRange ar : asv) {
                if (ret == null) {
                    ret = ar.getMaxAddress();
                    continue;
                }
                if (ar.getMaxAddress().getOffset() > ret.getOffset()) {
                    ret = ar.getMaxAddress();
                }
            }
            return ret;
        }
    }