Program API

Main entry point for accessing program data in Ghidra

The Program interface is the main entry point into an object which stores all information relating to a single program. This program model divides a program into four major parts: the memory, the symbol table, the equate table, and the listing.

Overview

The Program interface provides access to all major components of a Ghidra program, including:

• Memory - Binary data and memory organization
• Listing - Code units, instructions, and data
• Symbol Table - Named locations and references
• Functions - Function definitions and signatures
• Data Types - Type information and structures

Although the components are divided into separate objects, they are not independent. Any changes to one component may affect other components.

Core Methods

Getting Program Components

getListing() · Listing

Returns the listing object for accessing code units, instructions, and data.

Listing listing = program.getListing();
Instruction inst = listing.getInstructionAt(address);

getMemory() · Memory

Returns the memory object for reading and writing program bytes.

Memory memory = program.getMemory();
byte[] bytes = new byte[4];
memory.getBytes(address, bytes);

getSymbolTable() · SymbolTable

Returns the symbol table for managing symbols and references.

SymbolTable symbolTable = program.getSymbolTable();
Symbol symbol = symbolTable.createLabel(address, "MyLabel", SourceType.USER_DEFINED);

getFunctionManager() · FunctionManager

Returns the function manager for working with functions.

FunctionManager funcMgr = program.getFunctionManager();
Function func = funcMgr.getFunctionAt(address);

getDataTypeManager() · ProgramBasedDataTypeManager

Returns the program’s datatype manager.

DataTypeManager dtm = program.getDataTypeManager();
DataType dt = dtm.getDataType("/BuiltInTypes/int");

getReferenceManager() · ReferenceManager

Returns the reference manager for managing cross-references.

ReferenceManager refMgr = program.getReferenceManager();
Reference[] refs = refMgr.getReferencesFrom(address);

Program Metadata

getName() · String

Returns the name of the program.

getExecutablePath() · String

Returns the path to the program’s executable file (e.g., /home/user/foo.exe).

getExecutableFormat() · String

Returns the original file format (e.g., “PE”, “ELF”).

getExecutableMD5() · String

Returns the MD5 hash of the original binary file.

getExecutableSHA256() · String

Returns the SHA256 hash of the original binary file.

getCreationDate() · Date

Returns the creation date of this program.

setExecutablePath(String path) · void

Sets the path to the program’s executable file.

Language and Compiler

getLanguage() · Language

Returns the language used by this program (e.g., x86:LE:64:default).

getCompilerSpec() · CompilerSpec

Returns the compiler specification currently used by this program.

getLanguageID() · LanguageID

Returns the language ID.

getCompiler() · String

Gets the name of the compiler believed to have been used to create this program.

setCompiler(String compiler) · void

Sets the name of the compiler which created this program.

Address Information

getMinAddress() · Address

Returns the program’s minimum address, or null if no memory blocks are defined.

An AddressRange should generally not be formed using this and getMaxAddress() since it may span multiple AddressSpaces.

getMaxAddress() · Address

Returns the program’s maximum address, or null if no memory blocks are defined.

getImageBase() · Address

Returns the current program image base address within default space.

parseAddress(String addrStr) · Address[]

Returns an array of memory addresses that could correspond to the given string.

Supported formats:

• Memory block-name based (e.g., ‘MyBlk:abcd’, ‘MyBlk::abcd’)
• Default memory space (e.g., ‘abcd’, ‘0xabcd’)
• Memory space-name based (e.g., ‘ram:abc’)

Address[] addrs = program.parseAddress("ram:00401000");
if (addrs.length > 0) {
    Address addr = addrs[0];
}

getAddressFactory() · AddressFactory

Returns the AddressFactory for this program.

Registers

getRegister(String name) · Register

Returns the register with the given name.

Register rax = program.getRegister("RAX");

getRegister(Address addr) · Register

Returns the largest register located at the specified address.

getRegisters(Address addr) · Register[]

Returns all registers located at the specified address.

Namespace Management

getGlobalNamespace() · Namespace

Returns the global namespace for this program.

Program Context

getProgramContext() · ProgramContext

Returns the program context for managing processor context registers.

getDefaultPointerSize() · int

Gets the default pointer size in bytes.

Example Usage

Basic Program Navigation

import ghidra.program.model.listing.*;
import ghidra.program.model.address.*;

public class ProgramExample {
    public void analyzeProgram(Program program) {
        // Get program metadata
        String name = program.getName();
        Address imageBase = program.getImageBase();
        String compiler = program.getCompiler();
        
        println("Program: " + name);
        println("Image Base: " + imageBase);
        println("Compiler: " + compiler);
        
        // Access program components
        Listing listing = program.getListing();
        Memory memory = program.getMemory();
        SymbolTable symbolTable = program.getSymbolTable();
        
        // Iterate through functions
        FunctionManager funcMgr = program.getFunctionManager();
        FunctionIterator iter = funcMgr.getFunctions(true);
        while (iter.hasNext()) {
            Function func = iter.next();
            println("Function: " + func.getName() + " @ " + func.getEntryPoint());
        }
    }
}

Reading Program Data

public void readProgramData(Program program, Address address) {
    Memory memory = program.getMemory();
    Listing listing = program.getListing();
    
    try {
        // Read bytes from memory
        byte[] bytes = new byte[16];
        memory.getBytes(address, bytes);
        
        // Get instruction at address
        Instruction inst = listing.getInstructionAt(address);
        if (inst != null) {
            println("Instruction: " + inst.getMnemonicString());
        }
        
        // Get data at address
        Data data = listing.getDataAt(address);
        if (data != null) {
            println("Data type: " + data.getDataType().getName());
        }
    } catch (MemoryAccessException e) {
        println("Error reading memory: " + e.getMessage());
    }
}

Package Location

ghidra.program.model.listing.Program

Related Interfaces

• Listing API - Code unit access
• Memory API - Memory operations
• Symbol Table API - Symbol management
• Data Types API - Type system

Constants

PROGRAM_INFO · String

Options name for storing program information: "Program Information"

DATE_CREATED · String

Property name for creation date: "Date Created"

ANALYZED_OPTION_NAME · String

Boolean analyzed property name: "Analyzed"

MAX_OPERANDS · int

Maximum number of operands for any assembly language: 16