63 lines
2.3 KiB
Java
63 lines
2.3 KiB
Java
// GhidraScript: FindVtableOffsetCalls.java
|
|
// Usage:
|
|
// analyzeHeadless <projDir> <projName> -process <progName> -noanalysis -readOnly \
|
|
// -scriptPath tools/ghidra_scripts -postScript FindVtableOffsetCalls.java 0xb0
|
|
|
|
import ghidra.app.script.GhidraScript;
|
|
import ghidra.program.model.address.Address;
|
|
import ghidra.program.model.listing.Function;
|
|
import ghidra.program.model.listing.Instruction;
|
|
import ghidra.program.model.scalar.Scalar;
|
|
|
|
public class FindVtableOffsetCalls extends GhidraScript {
|
|
private boolean hasScalar(Instruction ins, long want) {
|
|
for (int op = 0; op < ins.getNumOperands(); op++) {
|
|
for (Object obj : ins.getOpObjects(op)) {
|
|
if (obj instanceof Scalar) {
|
|
Scalar s = (Scalar)obj;
|
|
if (s.getUnsignedValue() == want || s.getSignedValue() == want) return true;
|
|
}
|
|
}
|
|
}
|
|
return false;
|
|
}
|
|
|
|
@Override
|
|
public void run() throws Exception {
|
|
String[] args = getScriptArgs();
|
|
if (args == null || args.length == 0) {
|
|
printerr("FindVtableOffsetCalls: needs one or more vtable offsets, e.g. 0xb0");
|
|
return;
|
|
}
|
|
|
|
for (String arg : args) {
|
|
long want = Long.decode(arg);
|
|
println("=== vtable call offset " + arg + " ===");
|
|
int hits = 0;
|
|
for (Instruction ins : currentProgram.getListing().getInstructions(true)) {
|
|
if (!"CALL".equals(ins.getMnemonicString())) continue;
|
|
if (!hasScalar(ins, want)) continue;
|
|
|
|
hits++;
|
|
Function f = getFunctionContaining(ins.getAddress());
|
|
String fs = f == null ? "(no func)" : f.getName() + " @ " + f.getEntryPoint();
|
|
println("");
|
|
println(ins.getAddress() + " " + fs + " " + ins);
|
|
|
|
Instruction prev = ins;
|
|
for (int i = 0; i < 10; i++) {
|
|
prev = prev.getPrevious();
|
|
if (prev == null) break;
|
|
println(" " + prev.getAddress() + " " + prev);
|
|
}
|
|
if (hits >= 300) {
|
|
println("(truncated at 300 hits)");
|
|
break;
|
|
}
|
|
if (monitor.isCancelled()) break;
|
|
}
|
|
println("hits: " + hits);
|
|
}
|
|
}
|
|
}
|