// GhidraScript: DecompileByAddr.java // Usage (headless): // analyzeHeadless -process -noanalysis -readOnly \ // -scriptPath -postScript DecompileByAddr.java 0x401000 0x... // // Prints decompiled C for the function at (or containing) each address. import ghidra.app.decompiler.DecompInterface; import ghidra.app.decompiler.DecompileResults; import ghidra.app.script.GhidraScript; import ghidra.program.model.address.Address; import ghidra.program.model.listing.Function; public class DecompileByAddr extends GhidraScript { @Override public void run() throws Exception { String[] args = getScriptArgs(); if (args == null || args.length == 0) { printerr("DecompileByAddr: needs one or more addresses, e.g. 0x63ea70"); return; } DecompInterface decomp = new DecompInterface(); decomp.openProgram(currentProgram); for (String a : args) { long va; try { va = Long.decode(a); } catch (Exception e) { printerr("bad address: " + a); continue; } Address addr = toAddr(va); if (addr == null) { printerr("addr not in program: " + a); continue; } Function f = getFunctionContaining(addr); if (f == null) f = getFunctionAt(addr); println("================================================================================"); println("addr: " + addr); if (f == null) { println("(no function found)"); continue; } println("function: " + f.getName() + " @ " + f.getEntryPoint()); DecompileResults res = decomp.decompileFunction(f, 60, monitor); if (!res.decompileCompleted()) { println("(decompile failed)"); continue; } String c = res.getDecompiledFunction().getC(); // Keep output reasonable in headless logs; truncate if huge. if (c != null && c.length() > 120000) { c = c.substring(0, 120000) + "\n/* ... truncated ... */\n"; } println(c); } } }