diff --git a/GHIDRA_HTTP_API.md b/GHIDRA_HTTP_API.md index 9cd656f..0608188 100644 --- a/GHIDRA_HTTP_API.md +++ b/GHIDRA_HTTP_API.md @@ -371,6 +371,39 @@ Represents defined data items in memory. - **`PATCH /data/{address}`**: Modify a data item (e.g., change `name`, `type`, `comment`). Payload specifies changes. - **`DELETE /data/{address}`**: Undefine the data item at the specified address. +### 6.1 Strings + +Provides access to string data in the binary. + +- **`GET /strings`**: List all defined strings in the binary. Supports pagination and filtering. + - Query Parameters: + - `?offset=[int]`: Number of strings to skip (default: 0). + - `?limit=[int]`: Maximum number of strings to return (default: 2000). + - `?filter=[string]`: Only include strings containing this substring (case-insensitive). + ```json + // Example Response + "result": [ + { + "address": "0x00401234", + "value": "Hello, world!", + "length": 14, + "type": "string", + "name": "aHelloWorld" + }, + { + "address": "0x00401250", + "value": "Error: could not open file", + "length": 26, + "type": "string", + "name": "aErrorCouldNotO" + } + ], + "_links": { + "self": { "href": "/strings?offset=0&limit=10" }, + "next": { "href": "/strings?offset=10&limit=10" } + } + ``` + ### 7. Memory Segments Represents memory blocks/sections defined in the program. diff --git a/README.md b/README.md index 7cee624..0a55df2 100644 --- a/README.md +++ b/README.md @@ -156,6 +156,7 @@ Theoretically, any MCP client should work with GhydraMCP. Two examples are given - `list_exports`: List exported functions (params: offset, limit) - `list_namespaces`: Show namespaces (params: offset, limit) - `list_data_items`: View data labels (params: offset, limit) +- `list_strings`: List all defined strings in binary (params: offset, limit, filter) - `search_functions_by_name`: Find functions (params: query, offset, limit) **Function Operations**: @@ -192,6 +193,11 @@ client.use_tool("ghydra", "get_callgraph", {"address": "0x00401000"}) client.use_tool("ghydra", "read_memory", {"address": "0x00401000", "length": 16}) client.use_tool("ghydra", "get_disassembly", {"address": "0x00401000", "length": 32}) +# String analysis +client.use_tool("ghydra", "list_strings") # List all strings in the binary +client.use_tool("ghydra", "list_strings", {"limit": 100, "offset": 0}) # Pagination +client.use_tool("ghydra", "list_strings", {"filter": "password"}) # Search for strings containing "password" + # Function operations client.use_tool("ghydra", "set_function_signature", {"address": "0x00401000", "signature": "int main(int argc, char **argv)"}) client.use_tool("ghydra", "set_comment", {"address": "0x00401100", "comment": "This instruction initializes the counter", "comment_type": "plate"})