// Confirm 0x78f74a68 / 0x4a68 / 0x78f7 is rekordbox's default opaque_seed by
// searching DEFINED DATA (not just instruction immediates) for the byte pattern
// 68 4a f7 78 (LE u4) and the two u2s, and report containing context.
// Output -> ~/ghidra_proj/finddefault.txt
import java.io.PrintWriter;
import ghidra.app.script.GhidraScript;
import ghidra.program.model.address.*;
import ghidra.program.model.mem.*;

public class FindDefault extends GhidraScript {
    @Override public void run() throws Exception {
        PrintWriter out = new PrintWriter("/home/ntr/ghidra_proj/finddefault.txt");
        Memory mem = currentProgram.getMemory();
        byte[] pat = { (byte)0x68,(byte)0x4a,(byte)0xf7,(byte)0x78 }; // 0x78f74a68 LE
        Address a = mem.getMinAddress();
        int found=0;
        while (a != null && found < 50) {
            Address hit = mem.findBytes(a, pat, null, true, monitor);
            if (hit == null) break;
            out.println("// 0x78f74a68 bytes @ " + hit);
            found++;
            a = hit.add(1);
        }
        out.println("// total occurrences of 0x78f74a68 LE in memory image: " + found);
        out.flush(); out.close();
        println("wrote finddefault.txt found="+found);
    }
}