Skip to content

Commit 04181bc

Browse files
committed
updated Readme with PyGhidra changes
1 parent 8fbf5c8 commit 04181bc

5 files changed

Lines changed: 24 additions & 53 deletions

File tree

README.md

Lines changed: 9 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -13,33 +13,26 @@ Follow normal Ghidra extension installation procedures. Copy the CodeCut and De
1313
**NOTE:** After restarting and loading a CodeBrowser window, Ghidra will tell you it has found new plugins and ask if you want to configure them. Only CodeCut shows up in this window. This is because DeepCut is a "one-shot" analyzer (it is still installed).
1414

1515
## Configuring Native Python Paths & Python Dependencies
16-
Both CodeCut and DeepCut rely on native Python (outside of Ghidra) on your system. CodeCut uses native Python for guessing module names. DeepCut's model evaluation runs in native Python.
16+
Both CodeCut and DeepCut rely on the native PyGhidra extension, and are not compatible with Jython. CodeCut uses native Python for guessing module names. DeepCut's model inference runs in native Python.
1717

1818
### Native Python Dependencies
19+
1920
CodeCut:
2021
- nltk
2122

2223
DeepCut:
2324
- torch
2425
- torch-geometric
26+
- networkx
27+
- scipy
2528

26-
To install dependencies run:
27-
28-
```
29-
pip3 install nltk
30-
pip3 install torch torch-geometric
29+
To install dependencies, run:
30+
```bash
31+
pip install nltk
32+
pip install torch torch-geometric networkx scipy
3133
```
34+
using the Python installation linked to your PyGhidra.
3235

33-
(assuming that pip3 points to the version of Python you plan to use below)
34-
35-
### Configuring CodeCut Python Path
36-
![](img/codecut-config.png)
37-
Configure the native Python path for CodeCut by choosing **Edit -> Tool Options** and selecting "Python Executable."
38-
39-
### Configuring DeepCut Python Path
40-
![](img/deepcut-config.png)
41-
42-
Configure the native Python path for DeepCut by choosing **Analysis -> Analyze All Open...** and selecting **Deepcut (Prototype)**. After changing the path, click the **Apply** button.
4336

4437
## Running DeepCut Analysis
4538
DeepCut is best run as a one-shot analyzer *after* initial auto-analysis. Select **Analysis -> One Shot -> Deepcut**. After DeepCut runs, you can view the results by looking at the **Namespace** field in the **Symbol Table** view.

codecut-gui/README.md

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
## Building and Installation
55

6-
Requirements are the same as the Ghidra build requirements, currently JDK 17 (or newer) is required for Ghidra 10.2.
6+
Requirements are the same as the Ghidra build requirements, currently JDK 21 (or newer) is required for Ghidra 11.
77

88
Ghidra's standard Gradle build system is used. Set the `GHIDRA_INSTALL_DIR` environment variable before building, or set it as a Gradle property (useful for building in an IDE).
99

@@ -20,13 +20,12 @@ gradle
2020
echo GHIDRA_INSTALL_DIR="/path/to/ghidra" > gradle.properties
2121
```
2222

23-
### Python 3
23+
### PyGhidra and Dependencies
2424

25-
The CodeCut GUI's Module Name Guessing tool requires Python 3. Before running the tool, you may need to modify the Python Path of the tool. To do this, **Edit -> Tool Options -> Python Executable**. Insert path to your Python 3 executable. Click apply and ok.
25+
CodeCut GUI requires the PyGhidra extension, and is not compatible with Jython.
2626

27-
### Install nltk
28-
This module depends on the Python 3 dependency `nltk`. Run the following command to install:
29-
```
27+
The CodeCut GUI's Module Name Guessing tool requires the Python dependency [Natural Language ToolKit](https://www.nltk.org/). CodeCut attempts to automatically install the dependency when the tool is launched, but it can also be installed using the Python associated with PyGhidra by running:
28+
```bash
3029
pip install nltk
3130
```
3231

deepcut-ghidra/README.md

Lines changed: 10 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -30,39 +30,18 @@ used by your Ghidra installation. If you have multiple Java runtime
3030
environments installed, select the correct JRE by setting the
3131
`JAVA_HOME` environment variable before building.
3232

33-
### Native Python 3
34-
The Deepcut graph based machine learning model needs Python 3 to
35-
execute (outside of Ghidra). The analyzer calls an external Python
36-
process to execute the model on a graph representation of the binary.
37-
There are no GPU requirements since the model converge quickly even
38-
running in CPU mode.
39-
40-
#### Python 3 Path
41-
By default the analyzer use the command `/usr/local/bin/python3` to
42-
execute the deepcut python script. This setting can be changed in the
43-
Analysis Options menu **Analysis -> Analyze All Open...** To change the
44-
setting you need to click the checkbox next to **Deepcut (Prototype)**
45-
first.
46-
47-
#### Dependencies
48-
Deepcut has the following Python 3 dependencies:
49-
50-
- torch 1.7.1
51-
- torch-geometric 1.6.3
52-
- torch-cluster 1.5.8
53-
- torch-sparse 0.6.8
54-
- torch-scatter 2.0.5
55-
- torch-spline-conv 1.2.0
56-
57-
To install the dependencies:
58-
33+
#### ### PyGhidra and Dependencies
34+
35+
DeepCut requires the PyGhidra extension, and is not compatible with Jython. It uses [PyTorch Geometric](https://pytorch-geometric.readthedocs.io/) to perform machine learning on the function call graph. It has the following Python 3 dependencies:
36+
- torch
37+
- torch-geometric
38+
- networkx
39+
- scipy
40+
DeepCut attempts to automatically install the dependencies when the tool is launched, but they can also be installed using the Python associated with PyGhidra by running:
5941
```bash
60-
pip install torch==1.7.1+cpu -f https://download.pytorch.org/whl/torch_stable.html
61-
pip install -r requirements-torch_geometric.txt
42+
pip install torch torch-geometric networkx scipy
6243
```
63-
64-
The torch-cluster dependency can take a significant amount of time to
65-
build and install.
44+
The torch-geometric dependency can take a significant amount of time to build and install.
6645

6746
## Running the Analyzer
6847
The Deepcut analyzer will not run during auto-analysis. Once the binary

img/codecut-config.png

-101 KB
Binary file not shown.

img/deepcut-config.png

-70.2 KB
Binary file not shown.

0 commit comments

Comments
 (0)