yetangitu/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2025-10-04 18:29:37 +02:00
Code Issues Releases Wiki Activity

GP-3674 updated RTTI script to work in headless mode.

Browse source
This commit is contained in:
ghidra007 2023-07-31 18:55:59 +00:00
parent d33dc66594
commit 84705bb8fb
2 changed files with 75 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

59
Ghidra/Features/Decompiler/ghidra_scripts/RecoverClassesFromRTTIScript.java
View file

@ -54,10 +54,18 @@
import java.io.File; import java.io.File;
import java.io.PrintWriter; import java.io.PrintWriter;
import java.util.*; import java.util.ArrayList;
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.stream.Collectors; import java.util.stream.Collectors;
import classrecovery.*; import classrecovery.DecompilerScriptUtils;
import classrecovery.RTTIClassRecoverer;
import classrecovery.RTTIGccClassRecoverer;
import classrecovery.RTTIWindowsClassRecoverer;
import classrecovery.RecoveredClass;
import classrecovery.RecoveredClassHelper;
import generic.theme.GThemeDefaults.Colors.Palette; import generic.theme.GThemeDefaults.Colors.Palette;
import ghidra.app.decompiler.DecompInterface; import ghidra.app.decompiler.DecompInterface;
import ghidra.app.plugin.core.analysis.AutoAnalysisManager; import ghidra.app.plugin.core.analysis.AutoAnalysisManager;
@ -75,13 +83,30 @@ import ghidra.app.util.importer.MessageLog;
import ghidra.app.util.opinion.PeLoader; import ghidra.app.util.opinion.PeLoader;
import ghidra.framework.options.Options; import ghidra.framework.options.Options;
import ghidra.framework.plugintool.PluginTool; import ghidra.framework.plugintool.PluginTool;
import ghidra.program.model.address.*; import ghidra.program.model.address.Address;
import ghidra.program.model.data.*; import ghidra.program.model.address.AddressSet;
import ghidra.program.model.listing.*; import ghidra.program.model.address.AddressSetView;
import ghidra.program.model.data.CategoryPath;
import ghidra.program.model.data.DataType;
import ghidra.program.model.data.DataTypeComponent;
import ghidra.program.model.data.DataTypeManager;
import ghidra.program.model.data.Structure;
import ghidra.program.model.listing.Function;
import ghidra.program.model.listing.Parameter;
import ghidra.program.model.listing.Program;
import ghidra.program.model.mem.MemoryBlock; import ghidra.program.model.mem.MemoryBlock;
import ghidra.program.model.symbol.Symbol; import ghidra.program.model.symbol.Symbol;
import ghidra.program.util.GhidraProgramUtilities; import ghidra.program.util.GhidraProgramUtilities;
import ghidra.service.graph.*; import ghidra.service.graph.AttributedEdge;
import ghidra.service.graph.AttributedGraph;
import ghidra.service.graph.AttributedVertex;
import ghidra.service.graph.GraphDisplay;
import ghidra.service.graph.GraphDisplayOptions;
import ghidra.service.graph.GraphDisplayOptionsBuilder;
import ghidra.service.graph.GraphDisplayProvider;
import ghidra.service.graph.GraphType;
import ghidra.service.graph.GraphTypeBuilder;
import ghidra.service.graph.VertexShape;
import ghidra.util.exception.CancelledException; import ghidra.util.exception.CancelledException;
import ghidra.util.exception.GraphException; import ghidra.util.exception.GraphException;
import ghidra.util.task.TaskMonitor; import ghidra.util.task.TaskMonitor;
@ -196,8 +221,16 @@ public class RecoverClassesFromRTTIScript extends GhidraScript {
else if (isPE() && isGcc()){ else if (isPE() && isGcc()){
println("Program is a gcc compiled PE."); println("Program is a gcc compiled PE.");
boolean runGcc = askYesNo("Gcc Class Recovery Still Under Development",
"I understand that Gcc class recovery is still under development and my results will be incomplete but want to run this anyway."); boolean runGcc;
if (isRunningHeadless()) {
runGcc = true;
}
else {
runGcc = askYesNo("Gcc Class Recovery Still Under Development",
"I understand that Gcc class recovery is still under development and my " +
"results will be incomplete but want to run this anyway.");
}
if (!runGcc) { if (!runGcc) {
return; return;
} }
@ -209,8 +242,16 @@ public class RecoverClassesFromRTTIScript extends GhidraScript {
nameVfunctions, hasDebugSymbols, monitor); nameVfunctions, hasDebugSymbols, monitor);
} }
else if (isGcc()) { else if (isGcc()) {
boolean runGcc= askYesNo("Gcc Class Recovery Still Under Development",
boolean runGcc;
if (isRunningHeadless()) {
runGcc = true;
}
else {
runGcc = askYesNo("Gcc Class Recovery Still Under Development",
"I understand that Gcc class recovery is still under development and my results will be incomplete but want to run this anyway."); "I understand that Gcc class recovery is still under development and my results will be incomplete but want to run this anyway.");
}
if (!runGcc) { if (!runGcc) {
return; return;

11
Ghidra/Features/Decompiler/ghidra_scripts/classrecovery/DecompilerScriptUtils.java
View file

@ -59,13 +59,22 @@ public class DecompilerScriptUtils {
DecompileOptions options; DecompileOptions options;
options = new DecompileOptions(); options = new DecompileOptions();
if (tool == null) {
options.grabFromProgram(program);
}
else {
OptionsService service = tool.getService(OptionsService.class); OptionsService service = tool.getService(OptionsService.class);
if (service != null) { if (service != null) {
ToolOptions opt = service.getOptions("Decompiler"); ToolOptions opt = service.getOptions("Decompiler");
options.grabFromToolAndProgram(null, opt, program); options.grabFromToolAndProgram(null, opt, program);
} }
decompInterface.setOptions(options); else {
options.grabFromProgram(program);
}
}
decompInterface.setOptions(options);
decompInterface.toggleCCode(true); decompInterface.toggleCCode(true);
decompInterface.toggleSyntaxTree(true); decompInterface.toggleSyntaxTree(true);
decompInterface.setSimplificationStyle("decompile"); decompInterface.setSimplificationStyle("decompile");