65 lines
2.4 KiB
Java
65 lines
2.4 KiB
Java
// GhidraScript: FindScalarOps.java
|
|
// Usage:
|
|
// analyzeHeadless <projDir> <projName> -process <progName> -noanalysis -readOnly \
|
|
// -scriptPath tools/ghidra_scripts -postScript FindScalarOps.java 0x3b 0x3f800000
|
|
|
|
import ghidra.app.script.GhidraScript;
|
|
import ghidra.program.model.listing.Function;
|
|
import ghidra.program.model.listing.Instruction;
|
|
import ghidra.program.model.scalar.Scalar;
|
|
|
|
import java.util.LinkedHashSet;
|
|
|
|
public class FindScalarOps extends GhidraScript {
|
|
@Override
|
|
public void run() throws Exception {
|
|
String[] args = getScriptArgs();
|
|
if (args == null || args.length == 0) {
|
|
printerr("FindScalarOps: needs one or more scalar values");
|
|
return;
|
|
}
|
|
|
|
for (String arg : args) {
|
|
long want;
|
|
try {
|
|
want = Long.decode(arg);
|
|
} catch (Exception e) {
|
|
printerr("bad scalar: " + arg);
|
|
continue;
|
|
}
|
|
|
|
println("=== scalar " + arg + " ===");
|
|
int hits = 0;
|
|
LinkedHashSet<String> funcs = new LinkedHashSet<>();
|
|
for (Instruction ins : currentProgram.getListing().getInstructions(true)) {
|
|
int n = ins.getNumOperands();
|
|
boolean matched = false;
|
|
for (int op = 0; op < n; op++) {
|
|
for (Object obj : ins.getOpObjects(op)) {
|
|
if (obj instanceof Scalar) {
|
|
Scalar s = (Scalar)obj;
|
|
long v = s.getUnsignedValue();
|
|
long sv = s.getSignedValue();
|
|
if (v == want || sv == want) {
|
|
matched = true;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
if (matched) break;
|
|
}
|
|
if (!matched) continue;
|
|
hits++;
|
|
Function f = getFunctionContaining(ins.getAddress());
|
|
String fs = f == null ? "(no func)" : f.getName() + " @ " + f.getEntryPoint();
|
|
funcs.add(fs);
|
|
if (hits <= 250) println(ins.getAddress() + " " + fs + " " + ins);
|
|
if (monitor.isCancelled()) break;
|
|
}
|
|
println("hits: " + hits);
|
|
for (String fs : funcs) println(" " + fs);
|
|
println("");
|
|
}
|
|
}
|
|
}
|