// Decompile the pdb export functions found via string xrefs.
import java.io.PrintWriter;
import ghidra.app.script.GhidraScript;
import ghidra.app.decompiler.*;
import ghidra.program.model.address.Address;
import ghidra.program.model.listing.Function;

public class DecPdb extends GhidraScript {
    // export.pdb serializer call stack from a live Frida WriteFile backtrace.
    // module+offset -> Ghidra static = 0x140000000 + offset (base confirmed).
    static final String[] ADDRS = {
        "0x1420e883e", // calls WriteFile
        "0x1420d73a6",
        "0x1420d6e92",
        "0x1420d6368",
        "0x1420eae07",
        "0x1420e0852",
        "0x1420de1c4",
        "0x141d75d21", // export.pdb-specific frame
        "0x141cad188",
        "0x141cac585",
        "0x141b8ba75",
        "0x141acaf8c",
        "0x1423c9b3b",
    };
    @Override public void run() throws Exception {
        PrintWriter out = new PrintWriter("/home/ntr/ghidra_proj/decpdb.txt");
        DecompInterface di = new DecompInterface();
        di.openProgram(currentProgram);
        for (String a : ADDRS) {
            Address addr = currentProgram.getAddressFactory().getAddress(a);
            Function f = currentProgram.getFunctionManager().getFunctionContaining(addr);
            if (f == null) { out.println("// no function at " + a); continue; }
            out.println("\n//================ " + f.getName() + " @ " + f.getEntryPoint() + " ================");
            DecompileResults r = di.decompileFunction(f, 90, monitor);
            if (r != null && r.decompileCompleted())
                out.println(r.getDecompiledFunction().getC());
            else
                out.println("// decompile failed: " + (r != null ? r.getErrorMessage() : "null"));
        }
        out.flush(); out.close();
        println("wrote decpdb.txt");
    }
}