Summary

In this chapter, you learned how to use scripting to be more efficient when analyzing malware using Ghidra. We have used scripting to go beyond the limitations of static analysis and resolve some API function hashes that are calculated at runtime.

You also learned the advantages and disadvantages of using Python or Java when developing a script.

You learned how to translate assembly language algorithms into Java and Python, and also learned skills in scripting while developing your first extremely useful script. By using the provided Ghidra Flat API function classification, you are now able to quickly identify Ghidra API functions required by your own scripts without needing to remember or waste time looking for a function in the documentation.

In the next chapter of this book, we will cover Ghidra headless mode, which can be very useful in some situations, such as performing analysis of a huge amount of binaries or using Ghidra alone to integrate it with other tools...