Ghidra headless analyzer not finding qiling

[Ramaaaaaa1]

I am trying to run the Ghidra headless analyzer using the below command. Despite Qiling being installed in my Windows 10 system, it throws an error: ImportError: No module named qiling. Surprisingly, it works fine with normal python3 cmd, and Qiling is the latest version.

"C:\Users\hacke\Downloads\Malware Analysis Tools\ghidra_11.0.1_PUBLIC_20240130\ghidra_11.0.1_PUBLIC\support\analyzeHeadless.bat" "C:\Users\hacke" "Binary Analysis1" -process elf_xordd -noanalysis -postScript xorddos_decrypt_config.py

Could you please help me to fix this issue?

[ryanmkurtz]

Ghidra's built in Python support is "Jython 2", so it is not surprising it is not working with a CPython module. You may need to try one of the 3rd party Ghidra Python extensions, such as Ghidrathon or pyhidra.

[Ramaaaaaa1]

Thank you for your response, @ryanmkurtz. Writing a detailed answer to help others who might run into the same problem. As @ryanmkurtz mentioned, we can use the Ghidrathon plugin to make Ghidra use host python.

1. Download Ghidrathon from: https://github.com/mandiant/Ghidrathon/releases
2. Install Java
3. Install numpy
4. Install Visual C++ Build Tools: https://visualstudio.microsoft.com/visual-cpp-build-tools
5. Extract the Ghidrathon downloaded zip file and run the following commands from the extracted directory

• python -m pip install -r requirements.txt
• python ghidrathon_configure.py <absolute_path_to_ghidra_install_dir>

6. In the extracted folder, you will find another ZIP file. Extract this ZIP file, open the "extension.properties" file, and check whether the mentioned version matches your Ghidra version. If your Ghidra version is 11.0.1 and your Ghidrathon version is 11.0, you can change that value from 11.0 to 11.0.1. After making these modifications, compress this file and load it into Ghidra as an extension.
7. After performing all these steps, we are good to run the Ghidra headless analyzer with host Python.

• Load the binary into Ghidra GUI, analyze it, and save it.
• Close the Ghidra GUI
• Open the cmd and run the following command:
  "<path_to_Ghidra_Headless_Analyzer_Bat_file" "<project_location>" <project_name> -process <binary_name_saved_after_analyzing> -noanalysis -postScript <Python_script_path>
  To understand the Ghidra headless analyzer commands, refer to https://github.com/galoget/ghidra-headless-scripts