Releases: nccgroup/ghostrings
Releases · nccgroup/ghostrings
Version 2.4
Version 2.3
Handle VARIABLE varnodes in GoFuncCallStrings
Version 2.2
- Fix build for Ghidra 11
- Add
GoFuncCallStrings.java
script- Analyzes P-Code to find string structures passed directly to function calls via registers, without being written to the stack. Uses "normalize" style analysis with Ghidra's new built-in Golang support (see Ghidra release notes for supported Golang versions).
Version 2.1
- Fix help file build for Ghidra 10.3
- Recursive input resolution for COPY and intAddStackOffset
- Clean up static string script
Version 2.0
- Support phi-nodes (MULTIEQUAL ops) in dynamic string analysis
- New script to find statically allocated string structures
- Use of
go.func.*
as string data end boundary for better address candidate filtering - Changes to internal APIs
- Removed option to allow false positives in filler script
Version 1.2
- Recognize Mach-O
_go.string.*
symbol and newgo:string.*
symbol - Recognize Mach-O
__rodata
segment - NOTE: The hack that
GoDynamicStringsHigh.java
depends on breaks in Ghidra 10.2.
Version 1.1
Improvements to Known Strings script:
- String data is now loaded from a JSON file in the module data directory (
data/known_strings.json
) - Supports searching for known UTF-8 strings
Version 1.0
Initial release