// GhidraScript: DecompileBySymbol.java // Usage (headless): // analyzeHeadless -process -noanalysis -readOnly \ // -scriptPath -postScript DecompileBySymbol.java ... import ghidra.app.decompiler.DecompInterface; import ghidra.app.decompiler.DecompileResults; import ghidra.app.script.GhidraScript; import ghidra.program.model.listing.Function; import ghidra.program.model.listing.FunctionIterator; public class DecompileBySymbol extends GhidraScript { @Override public void run() throws Exception { String[] args = getScriptArgs(); if (args == null || args.length == 0) { printerr("DecompileBySymbol: needs one or more symbol-name fragments"); return; } DecompInterface decomp = new DecompInterface(); decomp.openProgram(currentProgram); for (String query : args) { boolean found = false; FunctionIterator functions = currentProgram.getFunctionManager().getFunctions(true); while (functions.hasNext()) { Function function = functions.next(); String name = function.getName(true); if (!name.contains(query)) { continue; } found = true; println("================================================================================"); println("query: " + query); println("function: " + name + " @ " + function.getEntryPoint()); DecompileResults result = decomp.decompileFunction(function, 60, monitor); if (!result.decompileCompleted()) { println("(decompile failed)"); continue; } println(result.getDecompiledFunction().getC()); } if (!found) { println("No function matched: " + query); } } } }