Integrate MobSF within scripts or by building docker image for ghidra

[AAH20]

https://github.com/MobSF/Mobile-Security-Framework-MobSF : is a mobile security framework collecting open source reverse engineering decompilers and malware analysis tools in one open source framework , which also has a docker image for static analysis , and integrated dynamic analysis with frida , etc..

Would be glad to contribute to such integration project , feel free to share your opinions , Regards.

[ryanmkurtz]

Sounds like this is more of an integration task over on the MobSF side...do you foresee needing specific changes to Ghidra to get it integrated?

[AAH20]

Maybe the first step is to add json , restful apis support to all the import/export functions of the results of the existing functionalities , that would facilitate the integration of many other important tools not only MobSF ,(e.g) data science platform such as RapidMiner would add a new category of ghidra users in form of reverse engineers powered with AI and machine learning.

[ryanmkurtz]

That's a fairly big effort, and the Ghidra team would not be able to put in the resources to make those changes for the sole purpose of supporting MobSF. We do see value in having a restful api one day, but it's not on our near-term todo list. You always have the option of using Ghidra's headless analyzer or "single jar mode" to aid in your integration.

[AAH20]

Thanks for your detailed response , but the sole purpose isn't just supporting MobSF , its the idea of supporting the key players open source tools in the scene , MobSF is a collection of open source tools too , why wouldn't you integrate antivirus apis or even virustotal api within the framework of ghidra ?

[ryanmkurtz]

why wouldn't you integrate antivirus apis or even virustotal api within the framework of ghidra ?

The key word in your question is "you". The Ghidra team's goal is to work on core Ghidra. It's mostly a limitation of resources and priorities. Adding things like that has a large maintenance and testing cost. Two of the goals of Ghidra are to make it accessible and extensible. Our open source license makes it integratable into almost any tool that wants to use it, and our scripting and extension mechanisms makes it extensible and customizable to fit someone's specific use case.

Something that would fit into our team's goals would be to improve the ways you can extend Ghidra, such as perhaps one day adding a rest api if we determine there is a need. So far though, the mechanisms Ghidra currently provides have worked for most people. Since Ghidra can take input and provide output in some form, it should be currently integratable with any tool. It's just a matter of how clunky does the integration feel in the end.