Skip to content

Releases: nccgroup/ghostrings

Version 2.4

09 Jun 04:49
Compare
Choose a tag to compare

More known strings from standard libraries (go version go1.19 darwin/amd64)

Version 2.3

05 Mar 20:22
Compare
Choose a tag to compare

Handle VARIABLE varnodes in GoFuncCallStrings

Version 2.2

08 Feb 19:19
Compare
Choose a tag to compare
  • Fix build for Ghidra 11
  • Add GoFuncCallStrings.java script
    • Analyzes P-Code to find string structures passed directly to function calls via registers, without being written to the stack. Uses "normalize" style analysis with Ghidra's new built-in Golang support (see Ghidra release notes for supported Golang versions).

Version 2.1

24 May 17:26
Compare
Choose a tag to compare
  • Fix help file build for Ghidra 10.3
  • Recursive input resolution for COPY and intAddStackOffset
  • Clean up static string script

Version 2.0

25 Jan 00:45
Compare
Choose a tag to compare
  • Support phi-nodes (MULTIEQUAL ops) in dynamic string analysis
  • New script to find statically allocated string structures
  • Use of go.func.* as string data end boundary for better address candidate filtering
  • Changes to internal APIs
  • Removed option to allow false positives in filler script

Version 1.2

05 Nov 22:21
Compare
Choose a tag to compare
  • Recognize Mach-O _go.string.* symbol and new go:string.* symbol
  • Recognize Mach-O __rodata segment
  • NOTE: The hack that GoDynamicStringsHigh.java depends on breaks in Ghidra 10.2.

Version 1.1

11 Aug 21:06
Compare
Choose a tag to compare

Improvements to Known Strings script:

  • String data is now loaded from a JSON file in the module data directory (data/known_strings.json)
  • Supports searching for known UTF-8 strings

Version 1.0

13 May 22:56
Compare
Choose a tag to compare

Initial release