28 lines
1.3 KiB
Java
28 lines
1.3 KiB
Java
// Finds writers and readers of Handler(30)'s callback pointer, then decompiles
|
|
// their containing functions. Run headless; the original PE remains read only.
|
|
import ghidra.app.decompiler.DecompInterface;
|
|
import ghidra.app.script.GhidraScript;
|
|
import ghidra.program.model.address.Address;
|
|
import ghidra.program.model.listing.Function;
|
|
import ghidra.program.model.symbol.Reference;
|
|
|
|
public class FindAiVmHandler30Callback extends GhidraScript {
|
|
private static final long ADDRESS = 0x100555e4L;
|
|
|
|
@Override
|
|
public void run() throws Exception {
|
|
Address address = currentProgram.getAddressFactory().getDefaultAddressSpace()
|
|
.getAddress(ADDRESS);
|
|
DecompInterface decompiler = new DecompInterface();
|
|
decompiler.openProgram(currentProgram);
|
|
for (Reference reference : currentProgram.getReferenceManager().getReferencesTo(address)) {
|
|
Function function = currentProgram.getFunctionManager()
|
|
.getFunctionContaining(reference.getFromAddress());
|
|
println("===== callback reference " + reference.getFromAddress() + " =====");
|
|
if (function == null) { println("no containing function"); continue; }
|
|
println(decompiler.decompileFunction(function, 60, monitor).getDecompiledFunction().getC());
|
|
}
|
|
decompiler.dispose();
|
|
}
|
|
}
|