Ghidra Deepcut Analyzer
=======================

Implementation of the deepcut as a Ghidra one-shot analyzer. 

## Building and Installation
JDK 11 (or newer) and Ghidra 9.1.0 (or newer) are required.

Ghidra's standard Gradle build system is used. Set the
`GHIDRA_INSTALL_DIR` environment variable before building, or set it as
a Gradle property (useful for building in an IDE):

### Environment variable
```bash
$ export GHIDRA_INSTALL_DIR="/path/to/ghidra"
$ ./gradlew
```

### Gradle property
```bash
echo GHIDRA_INSTALL_DIR=/path/to/ghidra > gradle.properties
```

The module ZIP will be output to `dist/`. Use **File > Install
Extensions** and select the green plus to browse to the
extension. Restart Ghidra when prompted.

For proper functionality, the plugin should be built with the same JRE
used by your Ghidra installation. If you have multiple Java runtime
environments installed, select the correct JRE by setting the
`JAVA_HOME` environment variable before building.

### Python 3 
The deepcut graph based machine learning model needs Python 3 to
execute. The analyzer calls and external python process to execute the
model on a graph representation of the binary. There are no GPU
requirements since the model converge quickly even running in CPU mode.

#### Python 3 Path
By default the analyzer use the command `/usr/local/bin/python3` to
execute the deepcut python script. This setting can be changed in the
Analysis Options menu **Analysis -> Analyze All Open...** To change the
setting you need to click the checkbox next to **Deepcut (Prototype)**
first.

#### Dependencies
Deepcut has the following Python 3 dependencies:

  - torch 1.7.1
  - torch-geometric 1.6.3
  - torch-cluster 1.5.8
  - torch-sparse 0.6.8
  - torch-scatter 2.0.5
  - torch-spline-conv 1.2.0

To install the dependencies:

```bash
pip install torch==1.7.1+cpu -f https://download.pytorch.org/whl/torch_stable.html
pip install -r requirements-torch_geometric.txt
```

The torch-cluster dependency can take a significant amount of time to
build and install.

## Running the Analyzer
The Deepcut analyzer will not run during auto-analysis. Once the binary
is loaded and the auto-analyzer is finish use the menu item **Analysis
-> One Shot -> Deepcut**

Once complete each function will include a `moduleX` value in the
Namespace field.

If there are any errors please make sure you are using the proper path
to Python 3 and the requirement dependencies installed.
