48 lines
2.6 KiB
Java
48 lines
2.6 KiB
Java
// @flesniak documented track-row 0x18=u2 "always 19048" (0x4A68) and 0x1a=u2
|
|
// "always 30967" (0x78F7). Our AceMo export has 0xa7ab / 0x21b4 instead, and a
|
|
// const-scan found no 0xa7ab/0x21b4 immediates. So locate every reference to the
|
|
// documented defaults 0x4A68 and 0x78F7 (and combined 0x78F74A68 / 0x4A6878F7),
|
|
// decompile the containing functions, and report. This should reveal how 0x18/0x1a
|
|
// are produced (literal default vs computed). Output -> ~/ghidra_proj/find4a68.txt
|
|
import java.io.PrintWriter;
|
|
import java.util.*;
|
|
import ghidra.app.script.GhidraScript;
|
|
import ghidra.app.decompiler.*;
|
|
import ghidra.program.model.listing.*;
|
|
import ghidra.program.model.scalar.Scalar;
|
|
|
|
public class Find4A68 extends GhidraScript {
|
|
@Override public void run() throws Exception {
|
|
PrintWriter out = new PrintWriter("/home/ntr/ghidra_proj/find4a68.txt");
|
|
FunctionManager fm = currentProgram.getFunctionManager();
|
|
DecompInterface di = new DecompInterface(); di.openProgram(currentProgram);
|
|
long[] consts = {0x4A68L, 0x78F7L, 0x78F74A68L, 0x4A6878F7L, 19048L, 30967L};
|
|
Set<String> fns = new LinkedHashSet<>();
|
|
InstructionIterator it = currentProgram.getListing().getInstructions(true);
|
|
while (it.hasNext() && !monitor.isCancelled()) {
|
|
Instruction ins = it.next();
|
|
for (int op=0; op<ins.getNumOperands(); op++)
|
|
for (Object o : ins.getOpObjects(op))
|
|
if (o instanceof Scalar) {
|
|
long v=((Scalar)o).getUnsignedValue();
|
|
for (long c: consts) if (v==c) {
|
|
Function f=fm.getFunctionContaining(ins.getAddress());
|
|
out.println("// HIT 0x"+Long.toHexString(c)+" @"+ins.getAddress()
|
|
+" in "+(f!=null?f.getName()+"@"+f.getEntryPoint():"?")+" : "+ins.toString());
|
|
if (f!=null) fns.add(f.getEntryPoint().toString());
|
|
}
|
|
}
|
|
}
|
|
// also search defined data for the byte patterns
|
|
out.println("// --- decompiling containing functions ---");
|
|
for (String a: fns) {
|
|
Function f=fm.getFunctionContaining(currentProgram.getAddressFactory().getAddress(a));
|
|
out.println("\n//===== "+f.getName()+" @ "+f.getEntryPoint()+" =====");
|
|
DecompileResults r=di.decompileFunction(f,90,monitor);
|
|
out.println(r!=null&&r.decompileCompleted()?r.getDecompiledFunction().getC():"// decompile failed");
|
|
}
|
|
out.flush(); out.close();
|
|
println("wrote find4a68.txt");
|
|
}
|
|
}
|