// Decompile the prime index_shift candidate FUN_14232a86c (shl5 + mask 0x7ff) and // a few neighboring DeviceSQL page-manager functions. Output -> ~/ghidra_proj/decshift.txt import java.io.PrintWriter; import java.util.*; import ghidra.app.script.GhidraScript; import ghidra.app.decompiler.*; import ghidra.program.model.listing.*; public class DecShift extends GhidraScript { PrintWriter out; DecompInterface di; FunctionManager fm; Set done=new HashSet<>(); void dec(String a, String why) { Function f = fm.getFunctionContaining(currentProgram.getAddressFactory().getAddress(a)); if (f == null) { out.println("// no fn at " + a + " (" + why + ")"); return; } if (!done.add(f.getEntryPoint().toString())) return; out.println("\n//===== " + f.getName() + " @ " + f.getEntryPoint() + " [" + why + "] ====="); DecompileResults r = di.decompileFunction(f, 120, monitor); out.println(r != null && r.decompileCompleted() ? r.getDecompiledFunction().getC() : "// decompile failed"); } @Override public void run() throws Exception { out = new PrintWriter("/home/ntr/ghidra_proj/decshift.txt"); di = new DecompInterface(); di.openProgram(currentProgram); fm = currentProgram.getFunctionManager(); dec("0x14232a86c", "shl5+mask7ff PRIME index_shift candidate"); // neighbors in DeviceSQL page-manager range dec("0x1423e1550", "page-mgr neighbor"); dec("0x1423e12a0", "page-mgr neighbor"); out.flush(); out.close(); println("wrote decshift.txt"); } }