pwndra (PyGhidra port)

Fork of 0xb0bb/pwndra updated for modern Ghidra and native Python 3.

Original pwndra targeted Ghidra's old Jython (Python 2.7) runtime. That stack is effectively dead on current Ghidra releases. This fork runs under PyGhidra (CPython 3.9+), which ships with Ghidra 11.3+ and is the default scripting path on Ghidra 12.x.

Upstream is essentially unmaintained for Python 3; this tree is a practical port so the same CTF/pwn helpers work again.

Requirements

• Ghidra 11.3+ (tested with 12.x)
• Launch via PyGhidra, not classic ghidraRun:
  • Linux/macOS: support/pyghidraRun
  • Windows: support\pyghidraRun.bat
• Python 3.9–3.14 available to the launcher (PyGhidra sets up a venv on first run)

Install

1. Clone or download this repository.
2. Start Ghidra with pyghidraRun.
3. Window → Script Manager → Script Directories and add the absolute path to this repo's scripts/ folder
   (e.g. /home/you/pwndra/scripts). Avoid $USER_HOME / ~ if your build does not expand them.
4. Refresh the script list. Scripts appear under the Pwn category.
5. Runtime column should show PyGhidra. All scripts declare #@runtime PyGhidra.

Optional: check In Tool on scripts you want in menus / keybindings. Menus land under Analysis → Pwn.

Utilities

• Replace Constants
• Annotate Syscalls
• Character Conversion
• Goto Main

Replace Constants

Replaces known numeric constants (flags, enums, etc.) with readable equates in call arguments, using architecture-specific JSON tables under scripts/data/constants/.

Frontends: ConstantsAmd64.py, ConstantsI386.py, … or AutoConstants.py (detects arch).

Annotate Syscalls

Finds syscall sites, resolves the syscall number, sets EOL comments / bookmarks, and annotates argument registers where possible. 1 Annotation in the decompiler view

Arguments are annotated in the disassembler view

Frontends: SyscallsAmd64.py, … or AutoSyscalls.py.

Note: For plain x86/x64 Linux, Ghidra also ships ResolveX86orX64LinuxSyscallsScript (Java). Use whichever you prefer.

Character conversion

Shortcut-friendly convert of a scalar operand to a quoted character / escape-sequence equate (UtilitiesConvertCharacter.py, default Shift+R when In Tool).

Goto Main

Jumps to main if present; otherwise falls back to the ELF entry point (UtilitiesGotoMain.py, default Ctrl+M when In Tool).

Architectures

Same coverage as upstream where data exists:

aarch64, amd64, arm (oabi/eabi), hppa, i386, m68k, mips (n32/o32/n64), powerpc, powerpc64, sh, sh4, sparc, sparc64, thumb

Auto* frontends pick arch (and a default ABI for mips/arm) from the loaded program.

Scripts can run globally or only on the current selection (useful for mixed mode, e.g. thumb/arm).

What changed vs upstream

• Target runtime: CPython 3 via PyGhidra (#@runtime PyGhidra)
• Removed Jython-only / removed Ghidra APIs (generic.continues, old ElfHeader.createElfHeader, nested SymbolicPropogator.Value import)
• Python 2 syntax fixed (print, except E, e, == None, etc.)
• UtilitiesGotoMain / UtilitiesConvertCharacter rewritten for the current API
• Evaluator construction updated for current ConstantPropagationContextEvaluator

JSON data tables are unchanged from upstream.

Credits

• Original work: 0xb0bb/pwndra (Apache-2.0)
• This fork: compatibility port for Ghidra 12 / PyGhidra

License

Apache License 2.0 — see LICENSE.