// @flesniak documented track-row 0x18=u2 "always 19048" (0x4A68) and 0x1a=u2
// "always 30967" (0x78F7). Our AceMo export has 0xa7ab / 0x21b4 instead, and a
// const-scan found no 0xa7ab/0x21b4 immediates. So locate every reference to the
// documented defaults 0x4A68 and 0x78F7 (and combined 0x78F74A68 / 0x4A6878F7),
// decompile the containing functions, and report. This should reveal how 0x18/0x1a
// are produced (literal default vs computed). Output -> ~/ghidra_proj/find4a68.txt
import java.io.PrintWriter;
import java.util.*;
import ghidra.app.script.GhidraScript;
import ghidra.app.decompiler.*;
import ghidra.program.model.listing.*;
import ghidra.program.model.scalar.Scalar;

public class Find4A68 extends GhidraScript {
    @Override public void run() throws Exception {
        PrintWriter out = new PrintWriter("/home/ntr/ghidra_proj/find4a68.txt");
        FunctionManager fm = currentProgram.getFunctionManager();
        DecompInterface di = new DecompInterface(); di.openProgram(currentProgram);
        long[] consts = {0x4A68L, 0x78F7L, 0x78F74A68L, 0x4A6878F7L, 19048L, 30967L};
        Set<String> fns = new LinkedHashSet<>();
        InstructionIterator it = currentProgram.getListing().getInstructions(true);
        while (it.hasNext() && !monitor.isCancelled()) {
            Instruction ins = it.next();
            for (int op=0; op<ins.getNumOperands(); op++)
                for (Object o : ins.getOpObjects(op))
                    if (o instanceof Scalar) {
                        long v=((Scalar)o).getUnsignedValue();
                        for (long c: consts) if (v==c) {
                            Function f=fm.getFunctionContaining(ins.getAddress());
                            out.println("// HIT 0x"+Long.toHexString(c)+" @"+ins.getAddress()
                                +" in "+(f!=null?f.getName()+"@"+f.getEntryPoint():"?")+"  : "+ins.toString());
                            if (f!=null) fns.add(f.getEntryPoint().toString());
                        }
                    }
        }
        // also search defined data for the byte patterns
        out.println("// --- decompiling containing functions ---");
        for (String a: fns) {
            Function f=fm.getFunctionContaining(currentProgram.getAddressFactory().getAddress(a));
            out.println("\n//===== "+f.getName()+" @ "+f.getEntryPoint()+" =====");
            DecompileResults r=di.decompileFunction(f,90,monitor);
            out.println(r!=null&&r.decompileCompleted()?r.getDecompiledFunction().getC():"// decompile failed");
        }
        out.flush(); out.close();
        println("wrote find4a68.txt");
    }
}