# Ghidra Ninja ghidra_scripts

> Thomas Roth's (Ghidra Ninja) collection of Ghidra Python scripts, which appear under a Ghidra Ninja category in the Script Manager. binwalk.py and yara.py run binwalk or bundled YARA crypto-constant rules over the loaded program and bookmark the findings, YaraSearch.py does the same with a rule file the user chooses, swift_demangler.py demangles Swift function names, golang_renamer.py restores function names in stripped Go binaries from the .gopclntab table, and export_gameboy_rom.py writes a working ROM back out of a Game Boy program imported with GhidraBoy.

- Type: Tool
- Targets: Binary
- Category: Native analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-20
- Added to the catalog: 2026-11-02
- Original resource: <https://github.com/ghidraninja/ghidra_scripts>
- Primary source: <https://github.com/ghidraninja/ghidra_scripts/blob/99f2a8644a29479618f51e2d4e28f10ba5e9ac48/README.md>
- Catalog page: <https://awesomerea.org/resources/ghidra-ninja-scripts/>
- Record JSON: <https://awesomerea.org/resources/ghidra-ninja-scripts/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/ghidra-ninja-scripts/index.md)

## Requirements & limits

- No releases or tags; the last commit is a merge from 2020-10-07. Open issues filed between 2020 and 2025 report problems including golang_renamer data-type errors, a binwalk.py temporary-file error and an out-of-memory failure, with no later commits.
- Installed by adding the checked-out repository as a script directory in Ghidra's Script Manager. The scripts are Python 2 code for Ghidra's Jython interpreter, and the README names no supported Ghidra version. binwalk.py, yara.py and YaraSearch.py need binwalk or yara on PATH, swift_demangler.py needs the swift toolchain, and export_gameboy_rom.py needs the GhidraBoy extension.
- Input is a program the analyst has loaded into Ghidra; export_gameboy_rom.py works on a Game Boy ROM the user imported, and an open issue says it fails for single-page ROMs. golang_renamer.py only searches for the .gopclntab header used before Go 1.16, and an open issue asks for Go 1.16 support. YARA and binwalk hits are signature matches.
- GPL-3.0 (LICENSE). The README says the bundled yara-crypto.yar rules are licensed under GPLv2, with an added SHA256 rule credited to @phoul, and credits golang_renamer.py as a port of George Zaytsev's go_renamer.py.

## Primary sources

1. <https://github.com/ghidraninja/ghidra_scripts/blob/99f2a8644a29479618f51e2d4e28f10ba5e9ac48/README.md>
2. <https://github.com/ghidraninja/ghidra_scripts/blob/99f2a8644a29479618f51e2d4e28f10ba5e9ac48/golang_renamer.py>
3. <https://github.com/ghidraninja/ghidra_scripts/blob/99f2a8644a29479618f51e2d4e28f10ba5e9ac48/YaraSearch.py>
4. <https://github.com/ghidraninja/ghidra_scripts/blob/99f2a8644a29479618f51e2d4e28f10ba5e9ac48/yara-crypto.yar>
5. <https://github.com/ghidraninja/ghidra_scripts/blob/99f2a8644a29479618f51e2d4e28f10ba5e9ac48/LICENSE>
6. <https://github.com/ghidraninja/ghidra_scripts/issues/12>
7. <https://github.com/ghidraninja/ghidra_scripts/issues/19>

## More in Native binaries

- [FindCrypt - Ghidra Edition](https://awesomerea.org/resources/findcrypt-ghidra/index.md) · Tool
- [Binary Refinery](https://awesomerea.org/resources/binary-refinery/index.md) · Tool
- [AngryGhidra](https://awesomerea.org/resources/angryghidra/index.md) · Tool
- [fpicker](https://awesomerea.org/resources/fpicker/index.md) · Tool
- [RetroWrite](https://awesomerea.org/resources/retrowrite/index.md) · Tool
- [Interruptor](https://awesomerea.org/resources/interruptor/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.