Skip to content

Instantly share code, notes, and snippets.

@DRKV333
Last active August 13, 2023 17:45
Show Gist options
  • Save DRKV333/b4bb2e8e84de5c056629171bbaf3f190 to your computer and use it in GitHub Desktop.
Save DRKV333/b4bb2e8e84de5c056629171bbaf3f190 to your computer and use it in GitHub Desktop.
A Ghidra script for grabbing Otherland packet formats
import java.util.Iterator;
import ghidra.app.decompiler.DecompInterface;
import ghidra.app.decompiler.DecompileOptions;
import ghidra.app.decompiler.DecompileResults;
import ghidra.app.script.GhidraScript;
import ghidra.app.services.ConsoleService;
import ghidra.framework.plugintool.util.OptionsService;
import ghidra.program.model.address.Address;
import ghidra.program.model.listing.Bookmark;
import ghidra.program.model.listing.BookmarkManager;
import ghidra.program.model.listing.Function;
import ghidra.program.model.pcode.PcodeBlockBasic;
import ghidra.program.model.pcode.PcodeOp;
public class OtherprotoHelper extends GhidraScript {
private static final String BOOKMARK_OL_TYPE = "OLType";
private ConsoleService console;
private BookmarkManager bookmark;
private DecompInterface decomp;
@Override
protected void run() throws Exception {
console = state.getTool().getService(ConsoleService.class);
bookmark = currentProgram.getBookmarkManager();
setupDecomp();
processAtAddress(currentAddress);
}
private void setupDecomp() {
decomp = new DecompInterface();
DecompileOptions opts = new DecompileOptions();
OptionsService optsService = state.getTool().getService(OptionsService.class);
if (optsService != null) {
opts.grabFromToolAndProgram(null, optsService.getOptions("Decompiler"), currentProgram);
}
decomp.setOptions(opts);
decomp.toggleSyntaxTree(true);
decomp.toggleCCode(false);
decomp.setSimplificationStyle("normalize");
decomp.openProgram(currentProgram);
}
private void processAtAddress(Address address) {
Function func = getFunctionContaining(address);
processFunction(func);
}
private void processFunction(Function func) {
DecompileResults res = decomp.decompileFunction(func, 3600, monitor);
for (PcodeBlockBasic bb : res.getHighFunction().getBasicBlocks()) {
processBB(bb);
printSlim("...");
}
}
private void processBB(PcodeBlockBasic bb) {
Iterator<PcodeOp> iter = bb.getIterator();
while (iter.hasNext()) {
PcodeOp op = iter.next();
if (op.getOpcode() == PcodeOp.CALL)
printSlim("- type: " + getPrintType(op));
}
}
private String getPrintType(PcodeOp op) {
Address calleeAddress = op.getInput(0).getAddress();
Bookmark[] bookmarks = bookmark.getBookmarks(calleeAddress);
for (Bookmark bm : bookmarks) {
if (bm.getCategory().equals(BOOKMARK_OL_TYPE))
return replaceWithArgs(bm.getComment(), op);
}
String placeholder = "??? " + calleeAddress.toString();
Function callee = getFunctionAt(calleeAddress);
if (callee != null)
placeholder = placeholder + " (" + callee.getName() + ")";
return placeholder;
}
private String replaceWithArgs(String template, PcodeOp op) {
for (int i = 1; i < op.getNumInputs(); i++) {
template = template.replace("{" + (i - 1) + "}", Long.toString(op.getInput(i).getOffset()));
}
return template;
}
private void printSlim(String message) {
console.addMessage("", message);
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment