// GhidraScript: FindScalarWindow.java // Usage: // analyzeHeadless -process -noanalysis -readOnly \ // -scriptPath tools/ghidra_scripts -postScript FindScalarWindow.java 0xb0 [minAddr] [maxAddr] [maxHits] import ghidra.app.script.GhidraScript; import ghidra.program.model.address.Address; import ghidra.program.model.listing.Function; import ghidra.program.model.listing.Instruction; import ghidra.program.model.scalar.Scalar; public class FindScalarWindow extends GhidraScript { private boolean hasScalar(Instruction ins, long want) { for (int op = 0; op < ins.getNumOperands(); op++) { for (Object obj : ins.getOpObjects(op)) { if (obj instanceof Scalar) { Scalar s = (Scalar)obj; if (s.getUnsignedValue() == want || s.getSignedValue() == want) return true; } } } return false; } private boolean inRange(Address addr, Address min, Address max) { if (min != null && addr.compareTo(min) < 0) return false; if (max != null && addr.compareTo(max) > 0) return false; return true; } @Override public void run() throws Exception { String[] args = getScriptArgs(); if (args == null || args.length == 0) { printerr("FindScalarWindow: needs scalar, optional minAddr maxAddr maxHits"); return; } long want = Long.decode(args[0]); Address min = args.length > 1 ? toAddr(Long.decode(args[1])) : null; Address max = args.length > 2 ? toAddr(Long.decode(args[2])) : null; int maxHits = args.length > 3 ? Integer.decode(args[3]) : 120; println("=== scalar window " + args[0] + " ==="); int hits = 0; for (Instruction ins : currentProgram.getListing().getInstructions(true)) { if (!inRange(ins.getAddress(), min, max)) continue; if (!hasScalar(ins, want)) continue; hits++; Function f = getFunctionContaining(ins.getAddress()); String fs = f == null ? "(no func)" : f.getName() + " @ " + f.getEntryPoint(); println(""); println("HIT " + hits + " " + ins.getAddress() + " " + fs); Instruction cur = ins; for (int i = 0; i < 8; i++) { Instruction prev = cur.getPrevious(); if (prev == null) break; cur = prev; } for (int i = 0; i < 17 && cur != null; i++) { String mark = cur.getAddress().equals(ins.getAddress()) ? "=>" : " "; println(mark + " " + cur.getAddress() + " " + cur); cur = cur.getNext(); } if (hits >= maxHits) { println("(truncated at " + maxHits + " hits)"); break; } if (monitor.isCancelled()) break; } println("hits: " + hits); } }