// Anchor the track-row builder via the track-row bitmask 0xc0700 (constant in
// every AceMo track row at offset 0x04) and the subtype/0x24 nearby. Find any
// instruction with immediate 0xc0700 and decompile the function. Output ->
// ~/ghidra_proj/findbitmask.txt
import java.io.PrintWriter;
import java.util.*;
import ghidra.app.script.GhidraScript;
import ghidra.app.decompiler.*;
import ghidra.program.model.listing.*;
import ghidra.program.model.scalar.Scalar;

public class FindBitmask extends GhidraScript {
    @Override public void run() throws Exception {
        PrintWriter out = new PrintWriter("/home/ntr/ghidra_proj/findbitmask.txt");
        FunctionManager fm = currentProgram.getFunctionManager();
        DecompInterface di = new DecompInterface(); di.openProgram(currentProgram);
        long[] consts = {0xc0700L, 0x700L, 0xc07L};
        Set<String> fns = new LinkedHashSet<>();
        InstructionIterator it = currentProgram.getListing().getInstructions(true);
        while (it.hasNext() && !monitor.isCancelled()) {
            Instruction ins = it.next();
            for (int op=0; op<ins.getNumOperands(); op++)
                for (Object o : ins.getOpObjects(op))
                    if (o instanceof Scalar) {
                        long v=((Scalar)o).getUnsignedValue();
                        if (v==0xc0700L) {
                            Function f=fm.getFunctionContaining(ins.getAddress());
                            out.println("// HIT 0xc0700 @"+ins.getAddress()+" in "
                                +(f!=null?f.getName()+"@"+f.getEntryPoint():"?")+" : "+ins.toString());
                            if (f!=null) fns.add(f.getEntryPoint().toString());
                        }
                    }
        }
        out.println("// --- decompiling ---");
        for (String a: fns) {
            Function f=fm.getFunctionContaining(currentProgram.getAddressFactory().getAddress(a));
            out.println("\n//===== "+f.getName()+" @ "+f.getEntryPoint()+" =====");
            DecompileResults r=di.decompileFunction(f,120,monitor);
            out.println(r!=null&&r.decompileCompleted()?r.getDecompiledFunction().getC():"// fail");
        }
        out.flush(); out.close();
        println("wrote findbitmask.txt");
    }
}