// GhidraScript: find decompiled functions containing text, optionally limiting // qualified function names to a second substring. // Usage: DecompileAllSearch.java 0x6458 GameScene import ghidra.app.decompiler.DecompInterface; import ghidra.app.decompiler.DecompileResults; import ghidra.app.script.GhidraScript; import ghidra.program.model.listing.Function; import ghidra.program.model.listing.FunctionIterator; public class DecompileAllSearch extends GhidraScript { @Override public void run() throws Exception { String[] args = getScriptArgs(); if (args == null || args.length == 0) { printerr("DecompileAllSearch: needs text and optional function-name substring"); return; } String needle = args[0]; String nameNeedle = args.length > 1 ? args[1] : ""; DecompInterface decompiler = new DecompInterface(); decompiler.openProgram(currentProgram); FunctionIterator functions = currentProgram.getFunctionManager().getFunctions(true); while (functions.hasNext() && !monitor.isCancelled()) { Function function = functions.next(); if (!nameNeedle.isEmpty() && !function.getName(true).contains(nameNeedle)) continue; DecompileResults result = decompiler.decompileFunction(function, 20, monitor); if (!result.decompileCompleted() || result.getDecompiledFunction() == null) continue; String code = result.getDecompiledFunction().getC(); if (code == null || !code.contains(needle)) continue; println(function.getEntryPoint() + " " + function.getName(true)); for (String line : code.split("\\R")) { if (line.contains(needle)) println(" " + line.trim()); } } } }