import ghidra.app.script.GhidraScript;
import ghidra.program.model.address.Address;
import ghidra.program.model.listing.Instruction;
import ghidra.program.model.listing.Listing;
import ghidra.program.model.symbol.FlowType;

public class ScanBranches extends GhidraScript {
    @Override
    protected void run() throws Exception {
        Listing listing = currentProgram.getListing();
        String[] args = getScriptArgs();
        Address start = toAddr(args[0]);
        Address end = toAddr(args[1]);
        Address target = toAddr(args[2]);
        Address cur = start;
        int n = 0;
        while (cur.compareTo(end) < 0 && n < 20000) {
            Instruction insn = listing.getInstructionAt(cur);
            if (insn == null) {
                try { disassemble(cur); } catch (Exception e) { println("stop at " + cur + ": " + e); break; }
                insn = listing.getInstructionAt(cur);
            }
            if (insn == null) { println("no insn at " + cur); break; }
            for (Address a : insn.getFlows()) {
                if (a.equals(target)) {
                    println("TARGET HIT: " + insn.getAddress() + ": " + insn.toString());
                }
            }
            cur = insn.getMaxAddress().add(1);
            n++;
        }
        println("scanned " + n + " instructions from " + start + " to " + cur);
    }
}