added ghidra-function metadatas

Author: rdmmf

mispghidra/PyMISPGhidra.py

@@ -240,25 +240,27 @@ def create_file_objects(self, event, ghidraProgram=None):
             )
 
     def get_function_infos(self, func):
+        # Initialize all potential conditional values to None
+        ext_lib = fh_hex = fx_hex = fn_sig = fn_code = calling_convention = None
+
         # Basic Info
         entry_point = func.getEntryPoint()
 
         # Handle External/Thunk logic
-        ext_lib = None
         if func.isThunk():
             thunked = func.getThunkedFunction(True)
             if thunked and thunked.getExternalLocation():
                 ext_lib = thunked.getExternalLocation().getLibraryName()
         elif func.getExternalLocation():
             ext_lib = func.getExternalLocation().getLibraryName()
 
+        instruction_count = len(
+            list(self.ghidraProgram.getListing().getInstructions(func.getBody(), True))
+        )
+
         # FID Hashes
         hash_function = self.FIDservice.hashFunction(func)
-        fh_hex = None
-        fx_hex = None
-
         if hash_function:
-            # Handle potential property vs method access in pyghidra/ghidra versions
             fh = hash_function.getFullHash()
             fx = hash_function.getSpecificHash()
             fh_hex = Long.toHexString(fh)
@@ -270,6 +272,23 @@ def get_function_infos(self, func):
             [format(f & 0xFFFFFFFF, "08x") for f in signature.features]
         )
 
+        # Decompilation logic
+        decomp_results = self.decompiler.decompileFunction(func, 30, self.monitor)
+        try:
+            decomp_func = decomp_results.getDecompiledFunction()
+            fn_sig = decomp_func.getSignature()
+            fn_code = decomp_func.getC()
+        except:
+            print("There was an error in decompilation!")
+
+        calling_convention = (
+            str(func.getCallingConventionName())
+            if func.getCallingConventionName()
+            else None
+        )
+        lang_id = self.ghidraProgram.getLanguageID().toString()
+        comp_id = self.ghidraProgram.getCompilerSpec().getCompilerSpecID().toString()
+        print(lang_id, comp_id)
         return {
             "function-name": func.getName(),
             "entrypoint-address": entry_point.getOffset(),
@@ -280,10 +299,14 @@ def get_function_infos(self, func):
             "function-scope": "import" if func.isExternal() else "internal",
             "decompiler-minor-version": self.decompiler.getMinorVersion(),
             "decompiler-major-version": self.decompiler.getMajorVersion(),
-            "instruction-count": func.getBody().getNumAddresses(),
+            "instruction-count": instruction_count,
             "fid-fh-hash": fh_hex,
             "fid-fx-hash": fx_hex,
             "bsim-vector": vector_csv,
+            "decompiled-function": fn_code,
+            "function-signature": fn_sig,
+            "return-type": func.getReturnType().getName(),
+            "calling-convention": calling_convention,
         }
 
     def _create_object_from_function(self, func):
@@ -335,6 +358,23 @@ def _create_object_from_function(self, func):
 
         ghidra_function.add_attribute("bsim-vector", value=info["bsim-vector"])
 
+        if info["decompiled-function"]:
+            ghidra_function.add_attribute(
+                "decompiled-function", value=info["decompiled-function"]
+            )
+
+        if info["function-signature"]:
+            ghidra_function.add_attribute(
+                "function-signature", value=info["function-signature"]
+            )
+
+        if info["calling-convention"]:
+            ghidra_function.add_attribute(
+                "calling-convention", value=info["calling-convention"]
+            )
+
+        ghidra_function.add_attribute("return-type", value=info["return-type"])
+
         logger.info(
             f"Created MISP object for {info['function-name']} at {hex(info['entrypoint-address'])}"
         )

mispghidra/misp/object-templates/ghidra-function/definition.json

@@ -7,14 +7,14 @@
       "disable_correlation": true
     },
     "label": {
-      "description": "ghidra symbol label",
+      "description": "ghidra symbol label(s) associated with the function",
       "misp-attribute": "text",
       "ui-priority": 0,
       "disable_correlation": true,
       "multiple": true
     },
     "function-scope": {
-      "description": "ghidra function type",
+      "description": "ghidra function scope (export, import, internal)",
       "misp-attribute": "text",
       "ui-priority": 0,
       "disable_correlation": true,
@@ -25,13 +25,13 @@
       ]
     },
     "is-thunk": {
-      "description": "ghidra function type",
+      "description": "identifies a thunk function",
       "misp-attribute": "boolean",
       "ui-priority": 0,
       "disable_correlation": true
     },
     "external-library": {
-      "description": "external library name if the function is an external",
+      "description": "external library name if the function is an import",
       "misp-attribute": "text",
       "ui-priority": 0,
       "disable_correlation": true
@@ -49,7 +49,7 @@
       "disable_correlation": true
     },
     "entrypoint-address": {
-      "description": "function entry point address",
+      "description": "function entrypoint address (integer in a text for consistency with the entrypoint-address in ELF/PE/Mach-O Objects)",
       "misp-attribute": "text",
       "ui-priority": 0,
       "disable_correlation": true
@@ -96,6 +96,18 @@
       "misp-attribute": "text",
       "ui-priority": 0,
       "disable_correlation": true
+    },
+    "return-type": {
+      "description": "The data type returned by the function",
+      "misp-attribute": "text",
+      "ui-priority": 0,
+      "disable_correlation": true
+    },
+      "calling-convention": {
+      "description": "The calling convention used by the function (e.g., cdecl, stdcall)",
+      "misp-attribute": "text",
+      "ui-priority": 0,
+      "disable_correlation": true
     }
   },
   "description": "ghidra function",

readme.md

@@ -111,3 +111,10 @@ Event correlation graph
 Event graph
 
 <img src="img/function_call_graph.png">
+
+# License 
+
+This software is licensed under [Apache License, Version 2.0](https://www.apache.org/licenses/LICENSE-2.0)
+
+Copyright 2026 Thomas Caillet
+Copyright 2026 CIRCL - Computer Incident Response Center Luxembourg