capa: add Ghidra Explorer plugin

[0xRavenspar]

Hey @williballenthin @mike-hunhoff , I'm Tanmay, a cybersecurity enthusiast with a strong passion for malware analysis, reverse engineering, and offensive security. I have hands-on experience with tools like Ghidra, IDA Pro, and GDB, and I’m particularly interested in contributing to capa as part of GSoC 2025.

I've familiarised with capa's codebase and its rule-based analysis, and have gone through the Ghidra documentation for developing plugins.

i'm also working on fixing issues and raised couple of PRs.

I’d love to get your guidance on how I can make meaningful contributions to the project. Looking forward to your insights and feedback!

[mike-hunhoff]

Hi @0xRavenspar , thanks for reaching out. Please review our contributor guidance if you haven't already. This tells you everything that you need to know about applying and contributing. Reach out here with any specific questions you may have 😄

[0xRavenspar]

Thank you @mike-hunhoff for the response.

I had a question, Ghidra has both scripts and plugins. Hence i wanted to know which method is more appropriate for this project. Should we implement it through scripts or as a plugin. is there a difference between them?

[0xRavenspar]

I would also like to ask for guidance on how pyghidra can be used for plugin development

[mike-hunhoff]

The focus of this project is to develop a new Ghidra extension that (as possible) mirrors the functionality of our IDA Pro plugin, capa explorer. I'd recommend reviewing PyGhidra's implementation for its Ghidra extension REPL as we'll likely need to do something similar to bridge the Ghidra UI (Java) and capa processing (Python).

[0xRavenspar]

Hey @mike-hunhoff,
I realized after picking up this project that it's not really my strong suit. I'm more passionate about the reverse engineering aspects like digging into code structures.

Hence I've been checking out the "FLOSS: extract language specific strings (.NET, Swift, Zig, ...)" project this past week and have put together a draft proposal for it. I'm also working on some open issues in the FLOSS repo to get more familiar with everything.

Would it be ok if I switched to this project instead? It's much more my speed and I think I could really contribute something valuable here. Sorry for the last-minute change request!

[mike-hunhoff]

Absolutely @0xRavenspar , we 100% encourage contributors to choose a project that best fits their background and interests.

[0xRavenspar]

should i change the name of this discussion or make a new one?

[mike-hunhoff]

Please create a new discussion and tag the appropriate mentors 😄

[0xRavenspar]

Sure thank you 🙏