yetangitu/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2025-10-06 03:50:02 +02:00
Code Issues Releases Wiki Activity

GP-3952 Updated the script categories to simplify and reduce the number of folders.

Browse source
This commit is contained in:
ghidra_blue 2025-06-13 15:00:15 +00:00
parent 7772d98143
commit 7db176b2bd
82 changed files with 885 additions and 981 deletions
Download patch file Download diff file Expand all files Collapse all files

85
Ghidra/Features/FileFormats/ghidra_scripts/ResolveReferencesRelativeToEbxScript.java
View file

@ -1,13 +1,12 @@
/* ###
* IP: GHIDRA
* REVIEWED: YES
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
*
* http://www.apache.org/licenses/LICENSE-2.0
*
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@ -16,7 +15,7 @@
*/
//Resolves relative references computed off EBX.
//This will resolve references to strings in the "__cstring" section.
//@category Mac OS X
//@category Apple.Mac OS X
import ghidra.app.script.GhidraScript;
import ghidra.program.model.address.Address;
@ -38,19 +37,19 @@ public class ResolveReferencesRelativeToEbxScript extends GhidraScript {
FunctionIterator functions = currentProgram.getListing().getFunctions(true);
while ( functions.hasNext() ) {
while (functions.hasNext()) {
if ( monitor.isCancelled() ) {
if (monitor.isCancelled()) {
break;
}
Function function = functions.next();
monitor.setMessage( function.getName() );
monitor.setMessage(function.getName());
loopOverInstructionsInFunction( function );
loopOverInstructionsInFunction(function);
function = getFunctionAfter( function );
function = getFunctionAfter(function);
}
}
@ -59,49 +58,53 @@ public class ResolveReferencesRelativeToEbxScript extends GhidraScript {
long ebx = -1;
InstructionIterator instructions = currentProgram.getListing().getInstructions( function.getBody(), true ) ;
InstructionIterator instructions =
currentProgram.getListing().getInstructions(function.getBody(), true);
while ( instructions.hasNext() ) {
while (instructions.hasNext()) {
Instruction instruction = instructions.next();
if ( monitor.isCancelled() ) {
if (monitor.isCancelled()) {
break;
}
if ( ebx == -1 ) {
ebx = getValueForEBX( instruction );
if (ebx == -1) {
ebx = getValueForEBX(instruction);
}
if ( ebx == -1 ) {
if (ebx == -1) {
continue;
}
for (int i = 0 ; i < instruction.getNumOperands() ; ++i ) {
for (int i = 0; i < instruction.getNumOperands(); ++i) {
Object [] opObjects = instruction.getOpObjects(i);
Object[] opObjects = instruction.getOpObjects(i);
if ( opObjects.length == 2 ) {
if (opObjects.length == 2) {
if (opObjects[ 0 ] instanceof Scalar && opObjects[ 1 ] instanceof Register ) {
if (opObjects[0] instanceof Scalar && opObjects[1] instanceof Register) {
Scalar scalar = (Scalar) opObjects[ 0 ];
Scalar scalar = (Scalar) opObjects[0];
Register register = (Register) opObjects[ 1 ];
Register register = (Register) opObjects[1];
if ( register.equals( EBX ) ) {
if (register.equals(EBX)) {
Address address = toAddr( (ebx + scalar.getUnsignedValue()) & Conv.INT_MASK );
Address address =
toAddr((ebx + scalar.getUnsignedValue()) & Conv.INT_MASK);
if ( isValid( address ) ) {
if (isValid(address)) {
removeReferencesFrom(instruction);
Reference reference = createMemoryReference( instruction, 1, address, RefType.DATA );
Reference reference =
createMemoryReference(instruction, 1, address, RefType.DATA);
setReferencePrimary( reference );
setReferencePrimary(reference);
println( "Creating reference from " + instruction.getMinAddress() + " to " + address );
println("Creating reference from " + instruction.getMinAddress() +
" to " + address);
}
}
}
@ -112,43 +115,43 @@ public class ResolveReferencesRelativeToEbxScript extends GhidraScript {
private boolean isValid(Address address) {
Instruction instruction = getInstructionContaining( address );
if ( instruction != null ) {
Instruction instruction = getInstructionContaining(address);
if (instruction != null) {
Address min = instruction.getMinAddress();
if ( address.compareTo( min ) > 0 ) {
if (address.compareTo(min) > 0) {
return false; //off-cut
}
}
Data data = getDataContaining( address );
if ( data != null ) {
Data data = getDataContaining(address);
if (data != null) {
Address min = data.getMinAddress();
if ( address.compareTo( min ) > 0 ) {
if (address.compareTo(min) > 0) {
return false; //off-cut
}
}
return currentProgram.getMemory().contains( address );
return currentProgram.getMemory().contains(address);
}
private void removeReferencesFrom(Instruction instruction) {
Reference [] referencesFrom = instruction.getReferencesFrom();
Reference[] referencesFrom = instruction.getReferencesFrom();
for (Reference reference : referencesFrom) {
removeReference( reference );
removeReference(reference);
}
}
private long getValueForEBX(Instruction instruction) {
if ( instruction.getMnemonicString().equals( "CALL" ) ) {
if (instruction.getMnemonicString().equals("CALL")) {
Address nextInstructionAddress = instruction.getMaxAddress().add( 1 );
Address nextInstructionAddress = instruction.getMaxAddress().add(1);
Reference [] referencesFrom = instruction.getReferencesFrom();
Reference[] referencesFrom = instruction.getReferencesFrom();
if ( referencesFrom.length == 1) {
if (referencesFrom.length == 1) {
if ( referencesFrom[0].getToAddress().equals( nextInstructionAddress ) ) {
if (referencesFrom[0].getToAddress().equals(nextInstructionAddress)) {
return nextInstructionAddress.getOffset();
}