Ghidra: Decompile Multiple File

[harshitalpha]

Hello There,
I have a bunch of .out (binary) files, I have to analyze them al once and get the decompiled C code for all files. I am able to do it for one file at once, I am not able to get c files for all binaries. Can anyone help me in this

I had run the following command
analyzeHeadless $PWD Project -import $PWD/*.out -postscript Decompile.java <file_name.c>

Thank you
Harshit Singhal

[dev747368]

It appears you are running the headless analyze in a unix environment. It should be simple to use a bash for loop to execute the same command for each file you have.

something like:

for i in *.out; do your_cmd_here $i; done

[ryanmkurtz]

It appears you are running the headless analyze in a unix environment

[harshitalpha]

Thanks for the suggestion,
But, I have around 25,000 binary files and decompilation of one binary file takes around 5 sec, then running all files one by one takes 25000*5 = 125,000 sec = approx 2016.12 mins = around 34 Hours.

Am, I thinking in the right way, if so, is there any faster method to do this. If not, what am I missing?

[dev747368]

When you need to handle that many binaries, you probably need to have multiple ingest processes running in parallel.
That also implies that the project is hosted on a Ghidra server instead of being a simple, non-shared project. Firing up a ghidra server on your local machine isn't very hard.

Another word of advice, is to separate out the steps of the process... ie. import everything first, and then later do a mass export using that script you mentioned. I mention this because when dealing with this number of files, you always run into some issue or other, so in the end it saves time to get the first step done for all the files, and then do the next step.

[harshitalpha]

Thanks,
I am using Decompile.java which exports the decompiled version of code into C/C++ code. I have one project in which had already imported all binary files with noanalysis flag, and when I do analysis and do mass export using postscript file Decompile.java it only dumps last binary file into C code.

I had run the following command :
analyzeHeadless /home/harshit/Desktop/Test_Ghidra/GHIDRA Project -process -postscript Decompile.java Decomp.c
Basically, after running a postscript file on one binary it creates Decomp.c and then overwrites Decomp.c for every binary file.

I want decompiled file for every binary. How should i do it by running analyzeHeadless single time?

[harshitalpha]

Hello There,
Actually, I managed to get decompiled version of all binary files by single command.

Thanks for helping me out.
Harshit Singhal

[dev747368]

Good to hear. Care to share with the other users that might read this ticket in the future?

[harshitalpha]

First of all, sorry for the late reply

what I was doing before is that running loop

for i in *.c; do
<cmd>
done 

It leads to opening ghidra project much time which took time, Then I tried to do a mass import which is successful
analyzeHeadless $PWD <proj_name> -import $PWD/*.o -noanalysis

Then I tried mass export of binary files
analyzeHeadless $PWD <proj_name> -process -postscript Decompile.java <Decompile_filename>.c

But the above leads to only one c file which is last decompiles binary, then I notices that actually it create a file for every binary but next binary overwrites that file. Now I came to know that problem lies with my Decompile.java script, so I modify the file do that I only need to pass the prefix of the file and Decompile.java create the file name on the basis of a binary file name.

Here's the sample code I changed in Decompile.java

String name = currentProgram.getName();
String suffix = name.substring(0, name.length() - 2);
String[] args = getScriptArgs();
String filename = args[0] + suffix + ".c";
export(filename);

Thank you
Harshit Singhal