blob: f1572c7416bfc1cfc66c62f51a2e53d357e822fd (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
|
// SPDX-License-Identifier: BSD-3-Clause
//
// ###########################################################################
// # WARNING: DEPRECATED - DO NOT USE FOR NEW ANALYSIS (kept for history). #
// # #
// # It treats its argument as a Ghidra program address, but the analysis #
// # convention here is FILE virtual addresses (libcuda+0x...) and Ghidra #
// # loads these binaries at image base 0x100000. Called with a file vaddr #
// # it decompiles the function 0x100000 bytes too low (the bug behind the #
// # old `helper_453ef0.c` / `fn_0x481360.c` artifacts). #
// # #
// # Replacement: tools/ghidra/DecompileAt.java (adds the image base) used #
// # through tools/ghidra_decompile_at.sh. #
// ###########################################################################
//
// DecompileAt.java - Ghidra post-script: decompile the function containing a
// given address (no auto-analysis required).
//
// Usage (via scripts/ghidra_decompile.sh):
// analyzeHeadless <proj> <name> -import <binary> -noanalysis \
// -postScript DecompileAt.java <hex-vaddr> [outfile]
import ghidra.app.script.GhidraScript;
import ghidra.app.decompiler.DecompInterface;
import ghidra.app.decompiler.DecompileResults;
import ghidra.program.model.address.Address;
import ghidra.program.model.listing.Function;
import java.io.FileWriter;
public class DecompileAt extends GhidraScript {
@Override
public void run() throws Exception {
String[] args = getScriptArgs();
if (args.length < 1) {
println("usage: DecompileAt.java <hex-vaddr> [outfile]");
return;
}
long target = Long.parseUnsignedLong(args[0].replaceFirst("^0x", ""), 16);
Address addr = toAddr(target);
Function f = getFunctionContaining(addr);
if (f == null) {
disassemble(addr);
f = createFunction(addr, null);
}
if (f == null) {
println("// no function at 0x" + Long.toHexString(target));
return;
}
DecompInterface dif = new DecompInterface();
dif.toggleCCode(true);
dif.toggleSyntaxTree(true);
dif.openProgram(currentProgram);
DecompileResults res = dif.decompileFunction(f, 120, monitor);
StringBuilder sb = new StringBuilder();
sb.append("// function ").append(f.getName())
.append(" at 0x").append(Long.toHexString(f.getEntryPoint().getOffset()))
.append(" containing 0x").append(Long.toHexString(target)).append("\n");
if (res != null && res.decompileCompleted()) {
sb.append(res.getDecompiledFunction().getC());
} else {
sb.append("// decompilation failed\n");
}
String text = sb.toString();
if (args.length > 1) {
try (FileWriter w = new FileWriter(args[1])) {
w.write(text);
}
}
println(text);
}
}
|
