# Ghidra bridge scripts

Two Java scripts run inside Ghidra (GUI or headless):

| Script | Direction | Purpose |
|---|---|---|
| `ExportForGreenEye.java` | Ghidra → risc-v-gsp-rm-debugger | write `addr<TAB>name<TAB>size` for every function |
| `MarkGreenEyeHits.java` | risc-v-gsp-rm-debugger → Ghidra | annotate functions with runtime hit counts + bookmarks |

Typical loop:

```bash
# 1. Export the decompiler's view of the firmware.
$GHIDRA/support/analyzeHeadless <proj_dir> <project> -process <program> -noanalysis \
    -scriptPath debug/risc-v-gsp-rm-vm/ghidra \
    -postScript ExportForGreenEye.java /tmp/ghidra-symbols.tsv

# 2. Build a risc-v-gsp-rm-debugger symbol DB from it.
./risc-v-gsp-rm-debugger.sh symbols export --index /tmp/ghidra-symbols.tsv -o symbols.json

# 3. Run a session, then export its hits.
python3 - <<'PY'
from greeneye.ghidra import export_hits
from greeneye.symbols import SymbolDB
db = SymbolDB(); db.load_json("symbols.json")
print(export_hits("dumps/<run>", "/tmp/greeneye_hits.tsv", symbols=db))
PY

# 4. Annotate the project.
$GHIDRA/support/analyzeHeadless <proj_dir> <project> -process <program> -noanalysis \
    -scriptPath debug/risc-v-gsp-rm-vm/ghidra \
    -postScript MarkGreenEyeHits.java /tmp/greeneye_hits.tsv
```

Address convention: the exported `addr` is the **program address** (what
Ghidra shows). `./risc-v-gsp-rm-debugger.sh symbols export --index` understands the 3-column
form and keeps file/program addresses separate when present (4/7-column
project indexes). Pass `--bias` only when the exported TSV does not already
carry runtime addresses.