Ghidra

The documentation (Same as the Java-API)

The FlatProgramAPI

Often used functions

Get the program

prog = getCurrentProgram()

Get a function

f = getFunction("func_name") # First function with that name

Get an instruction

i = getInstructionAt(address) # Get instruction at address
i = getFirstInstruction(getFunction("func_name") # First instruction in function

Obtaining an address

addr = currentAddress # Location of the cursor
addr = askAddress("Address", "Insert Address") # Input dialog for the user

f = getFunction("func_name")

start = f.getBody().getMinAddress() # Starting address of function
end = f.getBody().getMaxAddress() # End address of function

Handling Instructions

i = getFirstInstruction(getFunction("main"))

print(i.getMnemonicString()) # The Mnemonic of the instruction (e.g. "PUSH")

print(i.getOpObjects(0)) # The Parameters on the left side, e.g. MOV [RAX + 1], 59 -> ["RAX", 1]
print(i.getOpObjects(1)) # The Parameters on the right side, e.g. MOV [RAX + 1], 59 -> [59]

print(i.address) # The address of the instruction

i = i.next # The next instruction

Reading from the program memory

print(getByte(address)) # Read a byte
print(getShort(address)) # Read a short
print(getInt(address)) # Read an int
print(getLong(address)) # Read a long

print(getFloat(address)) # Read a float
print(getDouble(address)) # Read a double

print(getBytes(address, length)) # Read length-bytes starting from address