StellaOps.BinaryIndex.Ghidra

Service for Ghidra BSim (Binary Similarity) operations. BSim provides behavioral similarity matching based on P-Code semantics.

Generate BSim signatures for functions from an analyzed binary.

Ghidra analysis result. Signature generation options. Cancellation token. BSim signatures for each function.

Query BSim database for similar functions.

The signature to search for. Query options. Cancellation token. Matching functions from the database.

Query BSim database for multiple signatures in batch.

The signatures to search for. Query options. Cancellation token. Matching functions for each query signature.

Ingest functions into BSim database.

Name of the library being ingested. Version of the library. Signatures to ingest. Cancellation token.

Check if BSim database is available and healthy.

Cancellation token. True if BSim database is accessible.

Options for BSim signature generation.

Minimum function size (in instructions) to generate signatures for. Very small functions produce low-confidence matches.

Whether to include thunk/stub functions.

Whether to include imported library functions.

Options for BSim database queries.

Minimum similarity score (0.0-1.0) for matches.

Minimum significance score for matches. Significance measures how distinctive a function is.

Maximum number of results per query.

Limit search to specific libraries (empty = all libraries).

Limit search to specific library versions.

A BSim function signature.

Original function name. Function address in the binary. BSim feature vector bytes. Number of features in the vector. How distinctive this function is (higher = more unique). Number of P-Code instructions.

A BSim function signature.

Original function name.

Function address in the binary.

BSim feature vector bytes.

Number of features in the vector.

How distinctive this function is (higher = more unique).

Number of P-Code instructions.

A BSim match result.

Library containing the matched function. Version of the library. Name of the matched function. Address of the matched function. Similarity score (0.0-1.0). Significance of the match. Combined confidence score.

A BSim match result.

Library containing the matched function.

Version of the library.

Name of the matched function.

Address of the matched function.

Similarity score (0.0-1.0).

Significance of the match.

Combined confidence score.

Result of a batch BSim query for a single signature.

The signature that was queried. Matching functions found.

Result of a batch BSim query for a single signature.

The signature that was queried. Matching functions found.

The signature that was queried.

Matching functions found.

Main Ghidra analysis service interface. Provides access to Ghidra Headless analysis capabilities.

Analyze a binary using Ghidra headless.

The binary stream to analyze. Optional analysis configuration. Cancellation token. Analysis results including functions, imports, exports, and metadata.

Analyze a binary from a file path using Ghidra headless.

Absolute path to the binary file. Optional analysis configuration. Cancellation token. Analysis results including functions, imports, exports, and metadata.

Check if Ghidra backend is available and healthy.

Cancellation token. True if Ghidra is available, false otherwise.

Gets information about the Ghidra installation.

Cancellation token. Ghidra version and capability information.

Options for Ghidra analysis.

Whether to run full auto-analysis (slower but more complete).

Whether to include decompiled code in function results.

Whether to generate P-Code hashes for functions.

Whether to extract string literals.

Whether to extract functions.

Whether to extract decompilation (alias for IncludeDecompilation).

Maximum analysis time in seconds (0 = unlimited).

Specific scripts to run during analysis.

Architecture hint for raw binaries.

Processor language hint for Ghidra (e.g., "x86:LE:64:default").

Base address override for raw binaries.

Result of Ghidra analysis.

SHA256 hash of the analyzed binary. Discovered functions. Import symbols. Export symbols. Discovered string literals. Memory blocks/sections in the binary. Analysis metadata.

Result of Ghidra analysis.

SHA256 hash of the analyzed binary. Discovered functions. Import symbols. Export symbols. Discovered string literals. Memory blocks/sections in the binary. Analysis metadata.

SHA256 hash of the analyzed binary.

Discovered functions.

Import symbols.

Export symbols.

Discovered string literals.

Memory blocks/sections in the binary.

Analysis metadata.

Information about the Ghidra installation.

Ghidra version string (e.g., "11.2"). Java runtime version. Available processor languages. Ghidra installation path.

Information about the Ghidra installation.

Ghidra version string (e.g., "11.2"). Java runtime version. Available processor languages. Ghidra installation path.

Ghidra version string (e.g., "11.2").

Java runtime version.

Available processor languages.

Ghidra installation path.

Bridge interface for ghidriff Python tool integration. ghidriff provides automated binary diff reports using Ghidra.

Run ghidriff to compare two binaries.

Path to the older binary version. Path to the newer binary version. ghidriff configuration options. Cancellation token. Diff result with added, removed, and modified functions.

Run ghidriff to compare two binaries from streams.

Stream of the older binary version. Stream of the newer binary version. ghidriff configuration options. Cancellation token. Diff result with added, removed, and modified functions.

Generate a formatted report from ghidriff results.

The diff result to format. Output format. Cancellation token. Formatted report string.

Check if ghidriff is available (Python + ghidriff installed).

Cancellation token. True if ghidriff is available.

Get ghidriff version information.

Cancellation token. Version string.

Options for ghidriff diff operation.

Path to Ghidra installation (auto-detected if not set).

Path for Ghidra project files (temp dir if not set).

Whether to include decompiled code in results.

Whether to include disassembly listing in results.

Functions to exclude from comparison (by name pattern).

Maximum number of concurrent Ghidra instances.

Maximum analysis time in seconds.

Result of a ghidriff comparison.

SHA256 hash of the old binary. SHA256 hash of the new binary. Name/path of the old binary. Name/path of the new binary. Functions added in new binary. Functions removed from old binary. Functions modified between versions. Comparison statistics. Raw JSON output from ghidriff.

Result of a ghidriff comparison.

SHA256 hash of the old binary.

SHA256 hash of the new binary.

Name/path of the old binary.

Name/path of the new binary.

Functions added in new binary.

Functions removed from old binary.

Functions modified between versions.

Comparison statistics.

Raw JSON output from ghidriff.

A function from ghidriff output.

Function name. Function address. Function size in bytes. Decompiled signature. Decompiled C code (if requested).

A function from ghidriff output.

Function name. Function address. Function size in bytes. Decompiled signature. Decompiled C code (if requested).

Function name.

Function address.

Function size in bytes.

Decompiled signature.

Decompiled C code (if requested).

A function diff from ghidriff output.

Function name. Address in old binary. Address in new binary. Size in old binary. Size in new binary. Signature in old binary. Signature in new binary. Similarity score. Decompiled code from old binary. Decompiled code from new binary. List of instruction-level changes.

A function diff from ghidriff output.

Function name.

Address in old binary.

Address in new binary.

Size in old binary.

Size in new binary.

Signature in old binary.

Signature in new binary.

Similarity score.

Decompiled code from old binary.

Decompiled code from new binary.

List of instruction-level changes.

Statistics from ghidriff comparison.

Total functions in old binary. Total functions in new binary. Number of added functions. Number of removed functions. Number of modified functions. Number of unchanged functions. Time taken for analysis.

Statistics from ghidriff comparison.

Total functions in old binary.

Total functions in new binary.

Number of added functions.

Number of removed functions.

Number of modified functions.

Number of unchanged functions.

Time taken for analysis.

Report output format for ghidriff.

JSON format.

Markdown format.

HTML format.

Service for running Ghidra Version Tracking between two binaries. Version Tracking correlates functions between two versions of a binary using multiple correlator algorithms.

Run Ghidra Version Tracking with multiple correlators.

Stream of the older binary version. Stream of the newer binary version. Version tracking configuration. Cancellation token. Version tracking results with matched, added, removed, and modified functions.

Run Ghidra Version Tracking using file paths.

Path to the older binary version. Path to the newer binary version. Version tracking configuration. Cancellation token. Version tracking results with matched, added, removed, and modified functions.

Options for Version Tracking analysis.

Correlators to use for function matching, in priority order.

Minimum similarity score (0.0-1.0) to consider a match.

Whether to include decompiled code in results.

Whether to compute detailed instruction-level differences.

Maximum analysis time in seconds.

Type of correlator algorithm used for function matching.

Matches functions with identical byte sequences.

Matches functions with identical instruction mnemonics (ignoring operands).

Matches functions by symbol name.

Matches functions with similar data references.

Matches functions with similar call references.

Combined reference scoring algorithm.

BSim behavioral similarity matching.

Result of Version Tracking analysis.

Functions matched between versions. Functions added in the new version. Functions removed from the old version. Functions modified between versions. Analysis statistics.

Result of Version Tracking analysis.

Functions matched between versions. Functions added in the new version. Functions removed from the old version. Functions modified between versions. Analysis statistics.

Functions matched between versions.

Functions added in the new version.

Functions removed from the old version.

Functions modified between versions.

Analysis statistics.

Statistics from Version Tracking analysis.

Total functions in old binary. Total functions in new binary. Number of matched functions. Number of added functions. Number of removed functions. Number of modified functions (subset of matched). Time taken for analysis.

Statistics from Version Tracking analysis.

Total functions in old binary.

Total functions in new binary.

Number of matched functions.

Number of added functions.

Number of removed functions.

Number of modified functions (subset of matched).

Time taken for analysis.

A matched function between two binary versions.

Function name in old binary. Function address in old binary. Function name in new binary. Function address in new binary. Similarity score (0.0-1.0). Correlator that produced the match. Detected differences if any.

A matched function between two binary versions.

Function name in old binary.

Function address in old binary.

Function name in new binary.

Function address in new binary.

Similarity score (0.0-1.0).

Correlator that produced the match.

Detected differences if any.

A function added in the new binary version.

Function name. Function address. Function size in bytes. Decompiled signature if available.

A function added in the new binary version.

Function name. Function address. Function size in bytes. Decompiled signature if available.

Function name.

Function address.

Function size in bytes.

Decompiled signature if available.

A function removed from the old binary version.

Function name. Function address. Function size in bytes. Decompiled signature if available.

A function removed from the old binary version.

Function name. Function address. Function size in bytes. Decompiled signature if available.

Function name.

Function address.

Function size in bytes.

Decompiled signature if available.

A function modified between versions (with detailed differences).

Function name in old binary. Function address in old binary. Function size in old binary. Function name in new binary. Function address in new binary. Function size in new binary. Similarity score. List of specific differences. Decompiled code from old binary (if requested). Decompiled code from new binary (if requested).

A function modified between versions (with detailed differences).

Function name in old binary.

Function address in old binary.

Function size in old binary.

Function name in new binary.

Function address in new binary.

Function size in new binary.

Similarity score.

List of specific differences.

Decompiled code from old binary (if requested).

Decompiled code from new binary (if requested).

A specific difference between matched functions.

Type of difference. Human-readable description. Value in old binary (if applicable). Value in new binary (if applicable). Address where difference occurs (if applicable).

A specific difference between matched functions.

Type of difference. Human-readable description. Value in old binary (if applicable). Value in new binary (if applicable). Address where difference occurs (if applicable).

Type of difference.

Human-readable description.

Value in old binary (if applicable).

Value in new binary (if applicable).

Address where difference occurs (if applicable).

Type of difference detected between functions.

Instruction added.

Instruction removed.

Instruction changed.

Branch target changed.

Call target changed.

Constant value changed.

Function size changed.

Stack frame layout changed.

Exception thrown when Ghidra operations fail.

Creates a new GhidraException.

Creates a new GhidraException with a message.

Error message.

Creates a new GhidraException with a message and inner exception.

Error message. Inner exception.

Exit code from Ghidra process if available.

Standard error output from Ghidra process if available.

Standard output from Ghidra process if available.

Exception thrown when Ghidra is not available or not properly configured.

Creates a new GhidraUnavailableException.

Creates a new GhidraUnavailableException with a message.

Error message.

Creates a new GhidraUnavailableException with a message and inner exception.

Error message. Inner exception.

Exception thrown when Ghidra analysis times out.

Creates a new GhidraTimeoutException.

The timeout that was exceeded.

Creates a new GhidraTimeoutException with a message.

Error message. The timeout that was exceeded.

The timeout value that was exceeded.

Exception thrown when ghidriff operations fail.

Creates a new GhidriffException.

Creates a new GhidriffException with a message.

Error message.

Creates a new GhidriffException with a message and inner exception.

Error message. Inner exception.

Exit code from Python process if available.

Standard error output from Python process if available.

Standard output from Python process if available.

Exception thrown when ghidriff is not available.

Creates a new GhidriffUnavailableException.

Creates a new GhidriffUnavailableException with a message.

Error message.

Creates a new GhidriffUnavailableException with a message and inner exception.

Error message. Inner exception.

Exception thrown when BSim operations fail.

Creates a new BSimException.

Creates a new BSimException with a message.

Error message.

Creates a new BSimException with a message and inner exception.

Error message. Inner exception.

Exception thrown when BSim database is not available.

Creates a new BSimUnavailableException.

Creates a new BSimUnavailableException with a message.

Error message.

Creates a new BSimUnavailableException with a message and inner exception.

Error message. Inner exception.

Extension methods for registering Ghidra services.

Adds Ghidra integration services to the service collection.

The service collection. The configuration section for Ghidra. The service collection for chaining.

Adds Ghidra integration services with custom configuration.

The service collection. Action to configure Ghidra options. Optional action to configure BSim options. Optional action to configure ghidriff options. The service collection for chaining.

A function discovered by Ghidra analysis.

Function name (may be auto-generated like FUN_00401000). Virtual address of the function entry point. Size of the function in bytes. Decompiled signature if available. Decompiled C code if requested. SHA256 hash of normalized P-Code for semantic comparison. Names of functions called by this function. Names of functions that call this function. Whether this is a thunk/stub function. Whether this function is external (imported).

A function discovered by Ghidra analysis.

Function name (may be auto-generated like FUN_00401000).

Virtual address of the function entry point.

Size of the function in bytes.

Decompiled signature if available.

Decompiled C code if requested.

SHA256 hash of normalized P-Code for semantic comparison.

Names of functions called by this function.

Names of functions that call this function.

Whether this is a thunk/stub function.

Whether this function is external (imported).

An import symbol from Ghidra analysis.

Symbol name. Address where symbol is referenced. Name of the library providing the symbol. Ordinal number if applicable (PE imports).

An import symbol from Ghidra analysis.

Symbol name. Address where symbol is referenced. Name of the library providing the symbol. Ordinal number if applicable (PE imports).

Symbol name.

Address where symbol is referenced.

Name of the library providing the symbol.

Ordinal number if applicable (PE imports).

An export symbol from Ghidra analysis.

Symbol name. Address of the exported symbol. Ordinal number if applicable (PE exports).

An export symbol from Ghidra analysis.

Symbol name. Address of the exported symbol. Ordinal number if applicable (PE exports).

Symbol name.

Address of the exported symbol.

Ordinal number if applicable (PE exports).

A string literal discovered by Ghidra analysis.

The string value. Address where string is located. Length of the string in bytes. String encoding (ASCII, UTF-8, UTF-16, etc.).

A string literal discovered by Ghidra analysis.

The string value. Address where string is located. Length of the string in bytes. String encoding (ASCII, UTF-8, UTF-16, etc.).

The string value.

Address where string is located.

Length of the string in bytes.

String encoding (ASCII, UTF-8, UTF-16, etc.).

Metadata from Ghidra analysis.

Name of the analyzed file. Binary format detected (ELF, PE, Mach-O, etc.). CPU architecture. Ghidra processor language ID. Compiler ID if detected. Byte order (little or big endian). Pointer size in bits (32 or 64). Image base address. Entry point address. When analysis was performed. Ghidra version used. How long analysis took.

Metadata from Ghidra analysis.

Name of the analyzed file.

Binary format detected (ELF, PE, Mach-O, etc.).

CPU architecture.

Ghidra processor language ID.

Compiler ID if detected.

Byte order (little or big endian).

Pointer size in bits (32 or 64).

Image base address.

Entry point address.

When analysis was performed.

Ghidra version used.

How long analysis took.

A data reference discovered by Ghidra analysis.

Address where reference originates. Address being referenced. Type of reference (read, write, call, etc.).

A data reference discovered by Ghidra analysis.

Address where reference originates. Address being referenced. Type of reference (read, write, call, etc.).

Address where reference originates.

Address being referenced.

Type of reference (read, write, call, etc.).

Type of reference in Ghidra analysis.

Unknown reference type.

Memory read reference.

Memory write reference.

Function call reference.

Unconditional jump reference.

Conditional jump reference.

Computed/indirect reference.

Data reference (address of).

A memory block/section from Ghidra analysis.

Section name (.text, .data, etc.). Start address. End address. Size in bytes. Whether section is executable. Whether section is writable. Whether section has initialized data.

A memory block/section from Ghidra analysis.

Section name (.text, .data, etc.). Start address. End address. Size in bytes. Whether section is executable. Whether section is writable. Whether section has initialized data.

Section name (.text, .data, etc.).

Start address.

End address.

Size in bytes.

Whether section is executable.

Whether section is writable.

Whether section has initialized data.

Configuration options for Ghidra integration.

Configuration section name.

Path to Ghidra installation directory (GHIDRA_HOME).

Path to Java installation directory (JAVA_HOME). If not set, system JAVA_HOME will be used.

Working directory for Ghidra projects and temporary files.

Path to custom Ghidra scripts directory.

Maximum memory for Ghidra JVM (e.g., "4G", "8192M").

Maximum CPU cores for Ghidra analysis.

Default timeout for analysis operations in seconds.

Whether to clean up temporary projects after analysis.

Maximum concurrent Ghidra instances.

Whether Ghidra integration is enabled.

Configuration options for BSim database.

Configuration section name.

BSim database connection string. Format: postgresql://user:pass@host:port/database

BSim database host.

BSim database port.

BSim database name.

BSim database username.

BSim database password.

Default minimum similarity for queries.

Default maximum results per query.

Whether BSim integration is enabled.

Gets the effective connection string.

Configuration options for ghidriff Python bridge.

Configuration section name.

Path to Python executable. If not set, "python3" or "python" will be used from PATH.

Path to ghidriff module (if not installed via pip).

Whether to include decompilation in diff output by default.

Whether to include disassembly in diff output by default.

Default timeout for ghidriff operations in seconds.

Working directory for ghidriff output.

Whether ghidriff integration is enabled.

Implementation of for BSim signature generation and querying.

Creates a new BSimService.

The Ghidra Headless manager. BSim options. Ghidra options. Logger instance.

Ghidra-based disassembly plugin providing broad architecture support as a fallback backend. Ghidra is used for complex cases where B2R2 has limited coverage, supports 20+ architectures, and provides mature decompilation, Version Tracking, and BSim capabilities.

This plugin has lower priority than B2R2 since Ghidra requires external process invocation (Java-based headless analysis) which is slower than native .NET disassembly. It serves as the fallback when B2R2 returns low-confidence results or for architectures B2R2 handles poorly.

Plugin identifier.

Creates a new Ghidra disassembly plugin.

The Ghidra analysis service. Ghidra options. Logger instance. Time provider for timestamps. GUID provider for deterministic IDs.

Disposes the plugin and releases resources.

Internal handle for Ghidra-analyzed binaries.

The Ghidra analysis result. The original binary bytes.

Internal handle for Ghidra-analyzed binaries.

The Ghidra analysis result. The original binary bytes.

The Ghidra analysis result.

The original binary bytes.

Manages Ghidra Headless process lifecycle. Provides methods to run analysis with proper process isolation and cleanup.

Creates a new GhidraHeadlessManager.

Ghidra configuration options. Logger instance. Time provider for deterministic time. GUID provider for deterministic IDs.

Runs Ghidra analysis on a binary.

Absolute path to the binary file. Name of the post-analysis script to run. Arguments to pass to the script. Whether to run full auto-analysis. Timeout in seconds (0 = use default). Cancellation token. Standard output from Ghidra.

Runs a Ghidra script on an existing project.

Path to the Ghidra project directory. Name of the Ghidra project. Name of the script to run. Arguments to pass to the script. Timeout in seconds (0 = use default). Cancellation token. Standard output from Ghidra.

Checks if Ghidra is available and properly configured.

Cancellation token. True if Ghidra is available.

Gets Ghidra version information.

Cancellation token. Version string.

Result of a Ghidra process execution.

Process exit code. Standard output content. Standard error content. Execution duration.

Result of a Ghidra process execution.

Process exit code. Standard output content. Standard error content. Execution duration.

Process exit code.

Standard output content.

Standard error content.

Execution duration.

Whether the process completed successfully (exit code 0).

Implementation of using Ghidra Headless analysis.

Creates a new GhidraService.

The Ghidra Headless manager. Ghidra options. Logger instance. Time provider for timestamps. GUID provider for deterministic IDs.

Implementation of for Python ghidriff integration.

Creates a new GhidriffBridge.

ghidriff options. Ghidra options for path configuration. Logger instance. Time provider. GUID provider for deterministic IDs.

Implementation of using Ghidra Version Tracking.

Creates a new VersionTrackingService.

The Ghidra Headless manager. Ghidra options. Logger instance. Time provider. GUID provider for deterministic IDs.