yetangitu/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2025-10-03 17:59:46 +02:00
Code Issues Releases Wiki Activity

GP-863 added table and defined constants per review suggestions.

Browse source
This commit is contained in:
ghidra007 2021-05-07 22:07:46 +00:00
parent 79e6799ef3
commit bc561a5bbd
1 changed files with 40 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

49
Ghidra/Features/Base/ghidra_scripts/SearchForImageBaseOffsetsScript.java
View file

@ -14,15 +14,25 @@
* limitations under the License. * limitations under the License.
*/ */
// This script searches for image base offset references of size 32 and 64 to the current cursor // This script searches for image base offset references of size 32 and 64 to the current cursor
// location. This script only works on programs of size 32 and 64. // location. This script only works on programs of size 32 and 64. The results are both printed to
// the console and are presented in a table with two tabs, one for each size. To apply data types to
// undefined ones that are found simply select the desired ones from the table then drag either the
// ImageBaseOffset32 or ImageBaseOffset64 data type, whichever is applicable, onto the selection in
// the listing from the Data Type Manager.
//
//@category Search //@category Search
import ghidra.app.script.GhidraScript; import ghidra.app.script.GhidraScript;
import ghidra.program.model.address.Address; import ghidra.program.model.address.*;
import ghidra.util.exception.CancelledException; import ghidra.util.exception.CancelledException;
public class SearchForImageBaseOffsetsScript extends GhidraScript { public class SearchForImageBaseOffsetsScript extends GhidraScript {
static final int POINTER_BYTE_LEN_64BIT = 8;
static final int POINTER_BYTE_LEN_32BIT = 4;
static final byte BYTE_MASK = (byte) 0xff;
static final int BITS_PER_BYTE = 8;
@Override @Override
public void run() throws Exception { public void run() throws Exception {
@ -46,13 +56,19 @@ public class SearchForImageBaseOffsetsScript extends GhidraScript {
long currentAddressIbo = imageBaseOffset ^ currentAddressOffset; long currentAddressIbo = imageBaseOffset ^ currentAddressOffset;
byte searchBytes[] = createSearchArray(currentAddressIbo, 8, isBigEndian); byte searchBytes[] =
createSearchArray(currentAddressIbo, POINTER_BYTE_LEN_64BIT, isBigEndian);
println("searching for possible ibo64 references to " + currentAddress.toString() + " ..."); println("searching for possible ibo64 references to " + currentAddress.toString() + " ...");
searchForByteArray(searchBytes); AddressSet ibo64refs = searchForByteArray(searchBytes);
printAddresses(ibo64refs);
searchBytes = createSearchArray(currentAddressIbo, 4, isBigEndian); searchBytes = createSearchArray(currentAddressIbo, POINTER_BYTE_LEN_32BIT, isBigEndian);
println("searching for possible ibo32 references to " + currentAddress.toString() + " ..."); println("searching for possible ibo32 references to " + currentAddress.toString() + " ...");
searchForByteArray(searchBytes); AddressSet ibo32refs = searchForByteArray(searchBytes);
printAddresses(ibo32refs);
show("64-bit ImageBaseOffset References", ibo64refs);
show("32-bit ImageBaseOffset References", ibo32refs);
} }
@ -87,7 +103,7 @@ public class SearchForImageBaseOffsetsScript extends GhidraScript {
for (int i = 0; i < numBytes; i++) { for (int i = 0; i < numBytes; i++) {
monitor.checkCanceled(); monitor.checkCanceled();
byteArray[i] = (byte) (value >> (8 * i) & 0xff); byteArray[i] = (byte) (value >> (BITS_PER_BYTE * i) & BYTE_MASK);
} }
return byteArray; return byteArray;
@ -117,15 +133,30 @@ public class SearchForImageBaseOffsetsScript extends GhidraScript {
* @param byteArray the given byte array * @param byteArray the given byte array
* @throws CancelledException if cancelled * @throws CancelledException if cancelled
*/ */
private void searchForByteArray(byte[] byteArray) throws CancelledException { private AddressSet searchForByteArray(byte[] byteArray) throws CancelledException {
AddressSet addressSet = new AddressSet();
Address start = currentProgram.getMinAddress(); Address start = currentProgram.getMinAddress();
Address found = find(start, byteArray); Address found = find(start, byteArray);
while (found != null) { while (found != null) {
monitor.checkCanceled(); monitor.checkCanceled();
println(found.toString()); addressSet.add(found);
start = found.add(1); start = found.add(1);
found = find(start, byteArray); found = find(start, byteArray);
} }
return addressSet;
}
private void printAddresses(AddressSet addressSet) throws CancelledException {
AddressIterator addresses = addressSet.getAddresses(true);
while (addresses.hasNext()) {
monitor.checkCanceled();
Address address = addresses.next();
println(address.toString());
}
} }
} }