mirror of
https://github.com/NationalSecurityAgency/ghidra.git
synced 2025-10-03 17:59:46 +02:00
Remove another redundant check for file offset < 0
Fixed four comments. Changed location of call to containsFileOffset() from Memory.java toMemoryBlockSourceInfo.java. Changed from print() to println() in thepython file. GP-782: New API to support converting file offsets to memory addresses, with sample scripts that use it
This commit is contained in:
parent
70675fce99
commit
0ec17a9bb7
4 changed files with 218 additions and 10 deletions
|
@ -0,0 +1,88 @@
|
|||
/* ###
|
||||
* IP: GHIDRA
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
//This example script locates a memory address for a file offset.
|
||||
//Prompt user for a file offset.
|
||||
//Print the associated memory address to the Ghidra console
|
||||
//Print the file offset as a Ghidra comment at the memory address in the Ghidra Listing
|
||||
//If multiple addresses are located, then print the addresses to the console (do not set a
|
||||
//Ghidra comment)
|
||||
//@category Examples
|
||||
|
||||
import java.util.Set;
|
||||
|
||||
import ghidra.app.script.GhidraScript;
|
||||
import ghidra.program.model.address.Address;
|
||||
import ghidra.program.model.listing.CodeUnit;
|
||||
import ghidra.program.model.mem.Memory;
|
||||
import ghidra.util.exception.CancelledException;
|
||||
|
||||
public class LocateMemoryAddressesForFileOffset extends GhidraScript {
|
||||
|
||||
@Override
|
||||
public void run() throws Exception {
|
||||
long myFileOffset = getFileOffset();
|
||||
Memory mem = currentProgram.getMemory();
|
||||
Set<Address> addressSet = mem.locateAddressesForFileOffset(myFileOffset);
|
||||
if (addressSet.isEmpty()) {
|
||||
println("No memory address found for: " + Long.toHexString(myFileOffset));
|
||||
}
|
||||
else if (addressSet.size() == 1) {
|
||||
Address address = addressSet.iterator().next();
|
||||
processAddress(address, mem.getBlock(address).getName(), myFileOffset);
|
||||
|
||||
}
|
||||
//address set size is > 1, file offset matches to multiple addresses.
|
||||
//Let the user decide which address they want.
|
||||
else {
|
||||
println("Possible memory block:address are:");
|
||||
for (Address addr : addressSet) {
|
||||
println(mem.getBlock(addr).getName() + ":" + addr.toString());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public long getFileOffset()
|
||||
throws CancelledException, NumberFormatException, IllegalArgumentException {
|
||||
String userFileOffset =
|
||||
askString("File offset", "Please provide a hexadecimal file offset");
|
||||
long myFileOffset = 0;
|
||||
myFileOffset = Long.parseLong(userFileOffset, 16);
|
||||
if (myFileOffset < 0) {
|
||||
throw new IllegalArgumentException(
|
||||
"Offset cannot be a negative value." + userFileOffset);
|
||||
}
|
||||
return myFileOffset;
|
||||
}
|
||||
|
||||
public void processAddress(Address addr, String memBlockName, long fileOffset) {
|
||||
println("File offset " + Long.toHexString(fileOffset) +
|
||||
" is associated with memory block:address " + memBlockName + ":" + addr.toString());
|
||||
CodeUnit myCodeUnit = currentProgram.getListing().getCodeUnitContaining(addr);
|
||||
String comment = myCodeUnit.getComment(0);
|
||||
if (comment == null) {
|
||||
myCodeUnit.setComment(0,
|
||||
this.getScriptName() + ": File offset: " + Long.toHexString(fileOffset) +
|
||||
", Memory block:address " + memBlockName + ":" + addr.toString());
|
||||
}
|
||||
else {
|
||||
myCodeUnit.setComment(0,
|
||||
comment + ", " + this.getScriptName() + ": File offset: " +
|
||||
Long.toHexString(fileOffset) + ", Memory block:address " + memBlockName + ":" +
|
||||
addr.toString());
|
||||
}
|
||||
}
|
||||
}
|
|
@ -0,0 +1,64 @@
|
|||
## ###
|
||||
# IP: GHIDRA
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
##
|
||||
# This example script locates a memory address for a file offset.
|
||||
#Prompt user for a file offset.
|
||||
#Print the associated memory address to the Ghidra console
|
||||
#Print the file offset as a Ghidra comment at the memory address in the Ghidra Listing
|
||||
#If multiple addresses are located, then print the addresses to the console (do not set a Ghidra comment)
|
||||
# @category Examples
|
||||
|
||||
import sys
|
||||
from ghidra.program.model.address import Address
|
||||
from ghidra.program.model.listing import CodeUnit
|
||||
from ghidra.program.model.listing import Listing
|
||||
from ghidra.program.model.mem import Memory
|
||||
from java.util import Set
|
||||
|
||||
def getFileOffset():
|
||||
userFileOffset = askString('File offset', 'Please provide a hexadecimal file offset')
|
||||
try:
|
||||
int(userFileOffset,16)
|
||||
except ValueError:
|
||||
raise ValueError('Please provide a hexadecimal file offset.')
|
||||
myFileOffset = long(userFileOffset,16) #specify base 16 since we expect address in hex
|
||||
if myFileOffset < 0:
|
||||
raise ValueError('Offset cannot be a negative value.')
|
||||
return myFileOffset
|
||||
|
||||
def processAddress(addr, memBlockName, fileOffset):
|
||||
println('File offset ' + hex(fileOffset) + ' is associated with memory block:address ' + memBlockName + ':' + addr.toString());
|
||||
myCodeUnit = currentProgram.getListing().getCodeUnitContaining(addr)
|
||||
comment = myCodeUnit.getComment(0)
|
||||
if not comment:
|
||||
myCodeUnit.setComment(0, getScriptName() + ': File offset: ' + hex(fileOffset) +
|
||||
', Memory block:address ' + memBlockName + ':'+ addr.toString())
|
||||
else:
|
||||
myCodeUnit.setComment(0, comment + ' ' + getScriptName() + ': File offset: ' + hex(fileOffset) +
|
||||
', Memory block:address ' + memBlockName + ':' + addr.toString())
|
||||
|
||||
myFileOffset = getFileOffset()
|
||||
mem = currentProgram.getMemory()
|
||||
addressSet = mem.locateAddressesForFileOffset(myFileOffset)
|
||||
if addressSet.isEmpty():
|
||||
println('No memory address found for: ' + hex(myFileOffset))
|
||||
elif addressSet.size() == 1:
|
||||
address = addressSet.iterator().next()
|
||||
processAddress(address, mem.getBlock(address).getName(), myFileOffset)
|
||||
#file offset matches to multiple addresses. Let the user decide which address they want.
|
||||
else:
|
||||
println('Possible memory block:address are:')
|
||||
for addr in addressSet:
|
||||
println(mem.getBlock(addr).getName() + ":" + addr.toString())
|
|
@ -17,7 +17,7 @@ package ghidra.program.model.mem;
|
|||
|
||||
import java.io.IOException;
|
||||
import java.io.InputStream;
|
||||
import java.util.List;
|
||||
import java.util.*;
|
||||
|
||||
import ghidra.framework.store.LockException;
|
||||
import ghidra.program.database.mem.*;
|
||||
|
@ -247,9 +247,8 @@ public interface Memory extends AddressSetView {
|
|||
* @throws IllegalArgumentException if invalid block name
|
||||
*/
|
||||
public MemoryBlock createByteMappedBlock(String name, Address start, Address mappedAddress,
|
||||
long length, ByteMappingScheme byteMappingScheme, boolean overlay)
|
||||
throws LockException, MemoryConflictException, AddressOverflowException,
|
||||
IllegalArgumentException;
|
||||
long length, ByteMappingScheme byteMappingScheme, boolean overlay) throws LockException,
|
||||
MemoryConflictException, AddressOverflowException, IllegalArgumentException;
|
||||
|
||||
/**
|
||||
* Create a memory block that uses the bytes located at a different location with a 1:1
|
||||
|
@ -271,8 +270,7 @@ public interface Memory extends AddressSetView {
|
|||
*/
|
||||
default public MemoryBlock createByteMappedBlock(String name, Address start,
|
||||
Address mappedAddress, long length, boolean overlay) throws LockException,
|
||||
MemoryConflictException,
|
||||
AddressOverflowException, IllegalArgumentException {
|
||||
MemoryConflictException, AddressOverflowException, IllegalArgumentException {
|
||||
return createByteMappedBlock(name, start, mappedAddress, length, null, overlay);
|
||||
}
|
||||
|
||||
|
@ -830,4 +828,23 @@ public interface Memory extends AddressSetView {
|
|||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets a {@link Set} of {@link Address addresses} that correspond to the given file offset.
|
||||
*
|
||||
* @param fileOffset the file offset that will be used to locate the corresponding memory
|
||||
* addresses
|
||||
* @return a {@link Set} of {@link Address}es that are associated with the provided file offset
|
||||
*/
|
||||
public default Set<Address> locateAddressesForFileOffset(long fileOffset) {
|
||||
Set<Address> set = new HashSet<>();
|
||||
for (MemoryBlock memBlock : getBlocks()) {
|
||||
for (MemoryBlockSourceInfo info : memBlock.getSourceInfos()) {
|
||||
Address addr = info.locateAddressForFileOffset(fileOffset);
|
||||
if (addr != null) {
|
||||
set.add(addr);
|
||||
}
|
||||
}
|
||||
}
|
||||
return set;
|
||||
}
|
||||
}
|
||||
|
|
|
@ -59,16 +59,17 @@ public interface MemoryBlockSourceInfo {
|
|||
Optional<FileBytes> getFileBytes();
|
||||
|
||||
/**
|
||||
* Returns the offset into the {@link FileBytes} object where this section starts getting its bytes or
|
||||
* -1 if this SourceInfo does not have an associated {@link FileBytes}
|
||||
* Returns the offset into the underlying {@link FileBytes} object where this sub-block
|
||||
* starts getting its bytes from or -1 if this sub-block does not have an associated {@link FileBytes}
|
||||
* or a complex bit/byte-mapping is used.
|
||||
* @return the offset into the {@link FileBytes} object where this section starts getting its bytes.
|
||||
*/
|
||||
long getFileBytesOffset();
|
||||
|
||||
/**
|
||||
* Returns the offset into the {@link FileBytes} object for the given address or
|
||||
* -1 if this MemoryBlockSourceInfo does not have an associated {@link FileBytes} or the address doesn't
|
||||
* belong to this MemoryBlockSourceInfo.
|
||||
* -1 if this sub-block if address is out of range or this sub-block does not have
|
||||
* an associated {@link FileBytes}, or a complex bit/byte-mapping is used.
|
||||
*
|
||||
* @param address the address for which to get an offset into the {@link FileBytes} object.
|
||||
* @return the offset into the {@link FileBytes} object for the given address.
|
||||
|
@ -103,4 +104,42 @@ public interface MemoryBlockSourceInfo {
|
|||
*/
|
||||
boolean contains(Address address);
|
||||
|
||||
/**
|
||||
* Determine if this block source contains the specified file offset.
|
||||
*
|
||||
* @param fileOffset file offset within underlying FileBytes (if applicable) within the loaded
|
||||
* range associated with this source info.
|
||||
* @return true if file offset is within the loaded range of the corresponding FileBytes, else
|
||||
* false if method is not supported by the sub-block type (e.g., bit/byte-mapped sub-block).
|
||||
*/
|
||||
default boolean containsFileOffset(long fileOffset) {
|
||||
long startOffset = getFileBytesOffset();
|
||||
if (startOffset < 0 || fileOffset < 0) {
|
||||
return false;
|
||||
}
|
||||
// NOTE: logic does not handle bit/byte-mapped blocks (assumes 1:1 mapping)
|
||||
long endOffset = startOffset + (getLength() - 1);
|
||||
return (fileOffset >= startOffset) && (fileOffset <= endOffset);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the Address within this sub-block which corresponds to the specified file offset.
|
||||
*
|
||||
* @param fileOffset file offset
|
||||
* @return {@link Address} within this sub-block or null if file offset is out of range
|
||||
* or method is not supported by the sub-block type (e.g., bit/byte-mapped sub-block).
|
||||
*/
|
||||
default Address locateAddressForFileOffset(long fileOffset) {
|
||||
long startOffset = getFileBytesOffset();
|
||||
if (!containsFileOffset(fileOffset)) {
|
||||
return null;
|
||||
}
|
||||
// NOTE: logic does not handle bit/byte-mapped blocks (assumes 1:1 mapping)
|
||||
long offset = fileOffset - startOffset;
|
||||
if (offset >= getLength()) {
|
||||
return null;
|
||||
}
|
||||
return getMinAddress().add(offset);
|
||||
}
|
||||
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue