45 lines
1.8 KiB
Java
45 lines
1.8 KiB
Java
// Decompile the pdb export functions found via string xrefs.
|
|
import java.io.PrintWriter;
|
|
import ghidra.app.script.GhidraScript;
|
|
import ghidra.app.decompiler.*;
|
|
import ghidra.program.model.address.Address;
|
|
import ghidra.program.model.listing.Function;
|
|
|
|
public class DecPdb extends GhidraScript {
|
|
// export.pdb serializer call stack from a live Frida WriteFile backtrace.
|
|
// module+offset -> Ghidra static = 0x140000000 + offset (base confirmed).
|
|
static final String[] ADDRS = {
|
|
"0x1420e883e", // calls WriteFile
|
|
"0x1420d73a6",
|
|
"0x1420d6e92",
|
|
"0x1420d6368",
|
|
"0x1420eae07",
|
|
"0x1420e0852",
|
|
"0x1420de1c4",
|
|
"0x141d75d21", // export.pdb-specific frame
|
|
"0x141cad188",
|
|
"0x141cac585",
|
|
"0x141b8ba75",
|
|
"0x141acaf8c",
|
|
"0x1423c9b3b",
|
|
};
|
|
@Override public void run() throws Exception {
|
|
PrintWriter out = new PrintWriter("/home/ntr/ghidra_proj/decpdb.txt");
|
|
DecompInterface di = new DecompInterface();
|
|
di.openProgram(currentProgram);
|
|
for (String a : ADDRS) {
|
|
Address addr = currentProgram.getAddressFactory().getAddress(a);
|
|
Function f = currentProgram.getFunctionManager().getFunctionContaining(addr);
|
|
if (f == null) { out.println("// no function at " + a); continue; }
|
|
out.println("\n//================ " + f.getName() + " @ " + f.getEntryPoint() + " ================");
|
|
DecompileResults r = di.decompileFunction(f, 90, monitor);
|
|
if (r != null && r.decompileCompleted())
|
|
out.println(r.getDecompiledFunction().getC());
|
|
else
|
|
out.println("// decompile failed: " + (r != null ? r.getErrorMessage() : "null"));
|
|
}
|
|
out.flush(); out.close();
|
|
println("wrote decpdb.txt");
|
|
}
|
|
}
|