29 lines
1.2 KiB
Java
29 lines
1.2 KiB
Java
// Confirm 0x78f74a68 / 0x4a68 / 0x78f7 is rekordbox's default opaque_seed by
|
|
// searching DEFINED DATA (not just instruction immediates) for the byte pattern
|
|
// 68 4a f7 78 (LE u4) and the two u2s, and report containing context.
|
|
// Output -> ~/ghidra_proj/finddefault.txt
|
|
import java.io.PrintWriter;
|
|
import ghidra.app.script.GhidraScript;
|
|
import ghidra.program.model.address.*;
|
|
import ghidra.program.model.mem.*;
|
|
|
|
public class FindDefault extends GhidraScript {
|
|
@Override public void run() throws Exception {
|
|
PrintWriter out = new PrintWriter("/home/ntr/ghidra_proj/finddefault.txt");
|
|
Memory mem = currentProgram.getMemory();
|
|
byte[] pat = { (byte)0x68,(byte)0x4a,(byte)0xf7,(byte)0x78 }; // 0x78f74a68 LE
|
|
Address a = mem.getMinAddress();
|
|
int found=0;
|
|
while (a != null && found < 50) {
|
|
Address hit = mem.findBytes(a, pat, null, true, monitor);
|
|
if (hit == null) break;
|
|
out.println("// 0x78f74a68 bytes @ " + hit);
|
|
found++;
|
|
a = hit.add(1);
|
|
}
|
|
out.println("// total occurrences of 0x78f74a68 LE in memory image: " + found);
|
|
out.flush(); out.close();
|
|
println("wrote finddefault.txt found="+found);
|
|
}
|
|
}
|