Symbol Management

Work with symbols, labels, and namespaces in Ghidra

Symbol System Overview

Symbols provide human-readable names for addresses, functions, and data throughout the program.

The SymbolTreePlugin and SymbolTablePlugin provide comprehensive symbol management through tree and table views.

Symbol Types

Labels

Named locations in code:

• Entry points
• Jump targets
• Data locations
• User-defined markers

Functions

Callable subroutines:

• Function entry points
• Named in symbol table
• Have signatures
• Organized in namespaces

Parameters

Function parameters:

• Named arguments
• Part of function signature
• Local to function scope

Local Variables

Function-local symbols:

• Stack variables
• Register variables
• Scoped to function

Global Variables

Program-wide data:

• Static data labels
• Global memory locations
• Shared across functions

Namespaces

Organizational containers:

• Classes
• Modules
• Libraries
• Hierarchical structure

Symbol Tree

Opening Symbol Tree

1. Open Window

   Access symbol tree:

   • Window > Symbol Tree
   • Default: docked on left
   • Hierarchical symbol view
2. View Organization

   Tree structure shows:

   • Global namespace (root)
   • Organized by namespace
   • Functions, labels, classes
   • Expandable hierarchy

Navigating Symbol Tree

1. Expand Nodes

   Explore hierarchy:

   • Click triangles to expand
   • Double-click to navigate to symbol
   • Shows child symbols
   • Group threshold: 200 symbols (configurable)
2. Sync with Listing

   Tree tracks location:

   • Current location highlighted
   • Implemented via ProgramLocationPluginEvent
   • Auto-scrolls to current symbol
   • Bidirectional sync

Adjust the group threshold in Edit > Tool Options > Symbol Tree if dealing with very large symbol sets.

Symbol Table

Symbol Table Window

1. Open Table View

   Access symbol table:

   • Window > Symbol Table
   • Tabular display of all symbols
   • Sortable and filterable
2. Use Columns

   Table displays:

   • Name: Symbol name
   • Location: Address
   • Type: Symbol type
   • Namespace: Containing namespace
   • Source: Origin (user, analysis, import)
   • References: Reference count
3. Filter and Sort

   Organize view:

   • Click column headers to sort
   • Use filter bar to search
   • Select symbols for operations

Creating Symbols

Creating Labels

1. Position Cursor

   Navigate to address:

   • Place cursor on instruction or data
   • Address to be labeled
2. Add Label

   Create label:

   • Press L key
   • Right-click > Label > Add Label
   • Or use label field in listing
3. Enter Name

   Name the label:

   • Type meaningful name
   • Follow naming conventions
   • Press Enter to apply

Label names must be unique within their namespace. Ghidra will warn if a duplicate name is used.

Symbol Naming Rules

Valid symbol names:

• Start with letter or underscore
• Contain letters, digits, underscores
• No spaces (use underscores)
• Case-sensitive
• Should be descriptive

Auto-Generated Symbols

Ghidra creates default symbols:

• FUN_<address> for functions
• DAT_<address> for data
• LAB_<address> for labels
• SUB_<address> for subroutines

Replace auto-generated names with meaningful names to improve code readability.

Renaming Symbols

Interactive Rename

1. Select Symbol

   Choose symbol to rename:

   • Click on symbol in listing
   • Or select in Symbol Tree/Table
2. Rename Action

   Execute rename:

   • Press L on existing label
   • Right-click > Rename
   • In Symbol Tree: right-click > Rename Symbol
3. Enter New Name

   Provide new name:

   • Type replacement name
   • Press Enter
   • Updates throughout program

Batch Renaming

Rename multiple symbols:

• Use BatchRename.java script
• Pattern-based renaming
• Regular expression support
• Bulk operations

1. Select Symbols

   Choose symbols to rename:

   • Select in Symbol Table
   • Or script-based selection
2. Apply Pattern

   Execute batch rename:

   • Define naming pattern
   • Preview changes
   • Apply to selection

Symbol Sources

Symbols have source types:

User Defined

Manually created:

• Highest priority
• User-specified names
• Won’t be auto-renamed

Imported

From external sources:

• Import tables
• Debug symbols
• Symbol files
• High priority

Analysis

Created by analyzers:

• Function analysis
• Symbol propagation
• Pattern matching
• Medium priority

Default

Auto-generated:

• Default naming (FUN_, DAT_)
• Lowest priority
• Replaced by higher priority

Symbol source determines priority - user symbols won’t be overwritten by analysis.

Namespaces

Understanding Namespaces

Namespaces organize symbols hierarchically:

• Global: Top-level namespace
• Libraries: External library symbols
• Classes: C++ classes, structures
• Functions: Function-scoped symbols
• Custom: User-defined namespaces

Creating Namespaces

1. Create Namespace

   Add new namespace:

   • Right-click in Symbol Tree
   • Create Namespace
   • Enter namespace name
2. Organize Symbols

   Move symbols to namespace:

   • Drag symbols in tree
   • Or change namespace in symbol properties
   • Creates hierarchy

Namespace Notation

Fully qualified names:

• Format: namespace::symbol
• Example: MyClass::myFunction
• Multiple levels: Lib::Module::Function
• Global namespace: ::symbol

Symbol Operations

Deleting Symbols

1. Select Symbol

   Choose symbol to delete:

   • In Symbol Tree or Table
   • Or in listing view
2. Delete Action

   Remove symbol:

   • Press Delete key
   • Right-click > Delete Symbol
   • Confirm deletion
3. Result

   After deletion:

   • Symbol name removed
   • References become addresses
   • May create default symbol

Deleting a function symbol also deletes the function definition, but not the code itself.

Pinning Symbols

Prevent symbol changes:

1. Pin Symbol

   Lock symbol name:

   • Right-click symbol > Pin Symbol
   • Uses PinSymbolCmd
   • Prevents auto-rename
2. Unpin Symbol

   Allow changes:

   • Right-click > Unpin Symbol
   • Symbol can be modified
   • Analysis can update

Pin important symbols to prevent analysis from changing names you’ve carefully chosen.

Symbol Analysis

Symbol Analyzers

ARM Symbol Analyzer

ArmSymbolAnalyzer:

• ARM-specific symbol detection
• Thumb mode symbols
• ARM/Thumb transitions

Golang Symbol Analyzer

GolangSymbolAnalyzer:

• Go language symbols
• Package structure
• Interface types

External Symbol Resolver

ExternalSymbolResolverAnalyzer:

• Resolves imports
• Links to libraries
• Applies signatures

Auto-Rename Operations

Scripts for symbol cleanup:

1. Auto Rename Labels

   Use naming scripts:

   • AutoRenameLabelsScript.java: Sophisticated renaming
   • AutoRenameSimpleLabels.java: Simple patterns
   • Creates meaningful names from context
2. Label Data

   Name data automatically:

   • LabelDataScript.java: Label data references
   • LabelIndirectReferencesScript.java: Indirect refs
   • LabelIndirectStringReferencesScript.java: String refs

Symbol Search

Finding Symbols

1. Search in Table

   Use symbol table filter:

   • Open Symbol Table window
   • Type in filter bar
   • Supports wildcards
   • Results update live
2. Go To Symbol

   Direct navigation:

   • Press G for Go To
   • Type symbol name
   • Jump to symbol location
3. Advanced Search

   Program text search:

   • Search > Program Text
   • Search in label field
   • Regular expressions supported

Symbol References

Viewing Symbol Usage

1. Show References

   See where symbol is used:

   • Right-click symbol > References > Show References to
   • Lists all uses
   • Code and data references
2. Navigate Usage

   Explore references:

   • Click reference to navigate
   • See context of use
   • Analyze data flow

Symbol Import/Export

Importing Symbols

1. Import Symbol File

   Load external symbols:

   • File > Import File
   • Select symbol file format
   • Map file, symbol file, etc.
2. Import Debug Symbols

   Load debug information:

   • PDB files (Windows)
   • DWARF symbols (Linux)
   • Automatically applied

Exporting Symbols

1. Export Symbol List

   Save symbols to file:

   • File > Export Program
   • Choose symbol format
   • Save for other tools

Symbol Tree Service

Programmatic symbol access:

// Symbol tree provides SymbolTreeService
SymbolTreeService service = tool.getService(SymbolTreeService.class);
// Access to symbol hierarchy
// Navigate and manipulate symbols

Use the IterateFunctionsScript.java and similar scripts as templates for programmatic symbol manipulation.

Special Symbol Operations

Symbol Quotes

Handling special characters:

• Some imports have quoted names
• Use RemoveSymbolQuotesScript.java to clean
• Improves readability

Primary Symbols

Multiple symbols at same address:

• One symbol is “primary”
• Primary shown in listing
• Others accessible via references
• Set via symbol properties

The primary symbol is the default display name for an address. Non-primary symbols are alternate names.