capa: add Ghidra Explorer plugin

[dhruvak001]

Hello @williballenthin,

I had gained some understanding of the codebase till now. I wanted to work with CAPA plugins.

I had started working on a PR (mandiant/capa#2583), but I used the IDA Free license and couldn't complete it. How can I get started with this plugin, and is there any way I could obtain a license?

[williballenthin]

I think that the IDA Home license is the appropriate tier: https://hex-rays.com/pricing?section=individuals

We don't have a surplus of licenses at this time, so further development on the IDA plugin is probably limited to those who already have/can get a license. It kinda sucks, and I'm sorry!

[williballenthin]

As an alternative, developing a plugin for Ghidra would have a widespread appeal and doesn't require a license. So, perhaps consider that, too.

[dhruvak001]

Hi, i have configured and got a good understanding of how to use Ghidra and Ghidrathon as written in https://github.com/mandiant/ghidrathon

Any Guidance how shall i further proceed with Ghidra ?

[mike-hunhoff]

Hi @dhruvak001 , we'd like to migrate away from Ghidrathon now that Ghidra has official Python 3 support, PyGhidra. I'd recommend experimenting with using PyGhidra and Ghidra's programming API to get familiar with the two. Ghidra includes many example scripts to use as a resource. One of my favorites is XorMemoryScript.java

[dhruvak001]

HI @mike-hunhoff thankyou! I have tried PyGhidra meanwhile and it seems interesting. Is there some issue or code-work so I can start to learn by trying to solve them. Or if you can provide any guidance on how else would be better to go further with this.

[mike-hunhoff]

Because this project is focused on migrating our existing code to PyGhidra we don't have any open issues geared towards writing code with PyGhidra specifically. You can start by taking a look at the existing implementation under https://github.com/mandiant/capa/tree/master/capa/features/extractors/ghidra and consider what updates may need to take place for PyGhidra. If you're looking for open issues to tackle I'd recommend reviewing our list of open issues for capa.