cyonjan/wxhelper
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add script

Browse Source
This commit is contained in:
ttttupup
2024-07-31 18:02:39 +08:00
parent 7d290e454c
commit cfb4e9461f
7 changed files with 320 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
script/ghidra_script/3.9.11.25fid.fidb
BIN
View File
Binary file not shown.
script/ghidra_script/FindCallScript.java
+53
View File
@@ -0,0 +1,53 @@
import java.util.ArrayList;
import java.util.List;
import docking.widgets.filter.ContainsTextFilterFactory;
import docking.widgets.filter.TextFilter;
import docking.widgets.filter.TextFilterFactory;
import ghidra.app.script.GhidraScript;
import ghidra.program.model.symbol.Symbol;
import ghidra.program.model.symbol.SymbolIterator;
import ghidra.program.model.symbol.SymbolTable;
public class FindCallScript extends GhidraScript {
@Override
protected void run() throws Exception {
ContainsTextFilterFactory containsTextFilterFactory = new ContainsTextFilterFactory(false, true);
find_send_msg(containsTextFilterFactory);
}
void find_send_msg(ContainsTextFilterFactory factory) {
SymbolTable symbolTable = currentProgram.getSymbolTable();
List<Symbol> searchSymbol = searchSymbol(symbolTable,"SendMessageMgr::sendMsg",factory,"SendMessageMgr::sendMsg");
for (Symbol symbol : searchSymbol) {
println("found SendMessageMgr::sendMsg" + symbol.getAddress().toString());
println("=================copy source========================");
printf("const uint64_t kSendTextMsg = " + symbol.getAddress().toString() + "; \n");
}
}
void find_sendMessageMgr(ContainsTextFilterFactory factory) {
SymbolTable symbolTable = currentProgram.getSymbolTable();
List<Symbol> searchSymbol = searchSymbol(symbolTable,"SendMessageMgr::SendMessageMgr",factory,"SendMessageMgr::SendMessageMgr");
for (Symbol symbol : searchSymbol) {
}
}
List<Symbol> searchSymbol(SymbolTable symbolTable,String text,TextFilterFactory factory,String filterText) {
List<Symbol> list = new ArrayList<>();
TextFilter textFilter = factory.getTextFilter(filterText);
SymbolIterator symbols = symbolTable.getSymbols(text);
while (symbols.hasNext()) {
Symbol next = symbols.next();
if(textFilter.matches(next.getName())) {
list.add(next);
}
}
return list;
}
}
script/ghidra_script/FindSqliteCloseScript.java
+133
View File
@@ -0,0 +1,133 @@
import java.util.List;
import docking.widgets.filter.ContainsTextFilterFactory;
import docking.widgets.filter.TextFilter;
import ghidra.app.decompiler.DecompInterface;
import ghidra.app.decompiler.DecompileOptions;
import ghidra.app.script.GhidraScript;
import ghidra.feature.fid.hash.FidHashQuad;
import ghidra.feature.fid.service.FidService;
import ghidra.program.model.address.Address;
import ghidra.program.model.listing.CodeUnit;
import ghidra.program.model.listing.Function;
import ghidra.program.model.listing.FunctionManager;
import ghidra.program.model.mem.MemoryAccessException;
import ghidra.program.model.symbol.Reference;
import ghidra.program.model.symbol.ReferenceIterator;
import ghidra.program.model.symbol.ReferenceManager;
import ghidra.program.util.string.FoundString;
import ghidra.util.UndefinedFunction;
public class FindSqliteCloseScript extends GhidraScript {
FidService service;
DecompInterface decompiler;
long sql3close_full_hash = -1574752015815545339L;
long sql3close_spec_hash = -1262376715505923342L;
@Override
protected void run() throws Exception {
service = new FidService();
decompiler = new DecompInterface();
DecompileOptions decompileOptions = new DecompileOptions();
decompiler.setOptions(decompileOptions);
decompiler.openProgram(currentProgram);
List<FoundString> findStrings = findStrings(null, 5, 1, true, false);
ContainsTextFilterFactory containsTextFilterFactory = new ContainsTextFilterFactory(false, true);
find_sqlite3Close(findStrings,containsTextFilterFactory);
}
void find_sqlite3Close(List<FoundString> list, ContainsTextFilterFactory factory) throws MemoryAccessException {
int size = currentProgram.getLanguage().getLanguageDescription().getSize() / 8;
FunctionManager functionManager = currentProgram.getFunctionManager();
ReferenceManager referenceManager = currentProgram.getReferenceManager();
TextFilter textFilter = factory.getTextFilter("unable to close due to unfinalized statements or unfinished backups");
for (FoundString foundString : list) {
if(monitor.isCancelled()) {
break;
}
String string = foundString.getString(currentProgram.getMemory());
if(textFilter.matches(string)) {
Address address = foundString.getAddress();
println("=====text addr :"+address.toString() );
ReferenceIterator referencesTo = referenceManager.getReferencesTo(address);
while (referencesTo.hasNext()) {
Reference ref = referencesTo.next();
Address sql3CloseAddr = ref.getFromAddress();
Function sql3CloseFunction = functionManager.getFunctionContaining(sql3CloseAddr);
if(null ==sql3CloseFunction ) {
continue;
}
FidHashQuad hashQuad = service.hashFunction(sql3CloseFunction);
if(hashQuad.getFullHash() == sql3close_full_hash && hashQuad.getSpecificHash() == sql3close_spec_hash) {
println("found sql3Close :" + sql3CloseFunction.getName() + " at " + sql3CloseFunction.getEntryPoint() +
" full hash " + hashQuad.getFullHash() + " specific hash " + hashQuad.getSpecificHash());
Address entryPoint = sql3CloseFunction.getEntryPoint();
ReferenceIterator referencesTo2 = referenceManager.getReferencesTo(entryPoint);
while (referencesTo2.hasNext()) {
Reference next = referencesTo2.next();
Address addr = next.getFromAddress();
Function sql_close_func = functionManager.getFunctionContaining(addr);
if(null !=sql_close_func ) {
continue;
}
CodeUnit codeUnitAt = currentProgram.getListing().getCodeUnitAt(addr);
if(null != codeUnitAt) {
String mnemonicString = codeUnitAt.getMnemonicString();
if("JMP".equals(mnemonicString)) {
CodeUnit codeUnitBefore = currentProgram.getListing().getCodeUnitBefore(addr);
String mnemonicString2 = codeUnitBefore.getMnemonicString();
Function function = UndefinedFunction.findFunction(currentProgram, addr, monitor);
if (null != function) {
Address entryPoint2 = function.getEntryPoint();
if("XOR".equals(mnemonicString2)) {
createFunction(entryPoint2, "sqlite3_close");
currentProgram.getListing().setComment(entryPoint2, CodeUnit.POST_COMMENT,
"auto define function: sqlite3_close");
println("sqlite3_close addr: " + entryPoint2.toString());
}else if ("MOV".equals(mnemonicString2)) {
createFunction(entryPoint2, "sqlite3_close_v2");
currentProgram.getListing().setComment(entryPoint2, CodeUnit.POST_COMMENT,
"auto define function : sqlite3_close_v2" );
println("sqlite3_close_v2 addr: " + entryPoint2.toString());
}
ReferenceIterator referencesTo3 = referenceManager.getReferencesTo(entryPoint2);
while (referencesTo3.hasNext()) {
Reference next2 = referencesTo3.next();
Address fromAddress = next2.getFromAddress();
if("XOR".equals(mnemonicString2)) {
long l = fromAddress.getOffset() - 16*size;
println("sqlite3_close xref:" + fromAddress.toString());
printf("sqlite3_api_routines addr: %x \n", l);
}else if ("MOV".equals(mnemonicString2)) {
long l = fromAddress.getOffset()- 179*size;
println("sqlite3_close_v2 xref:" +fromAddress.toString());
printf("sqlite3_api_routines addr: %x \n", l);
}
}
}
}
}
}
}
}
}
}
}
}
script/ghidra_script/NamedScript.java
+10 -15
View File
@@ -31,6 +31,7 @@ public class NamedScript extends GhidraScript {
FunctionManager functionManager = currentProgram.getFunctionManager();
ReferenceManager referenceManager = currentProgram.getReferenceManager();
AddressFactory addressFactory = currentProgram.getAddressFactory();
AddressSpace space = addressFactory.getDefaultAddressSpace();
AddressSpace[] addressSpaces = addressFactory.getAddressSpaces();
@@ -43,32 +44,26 @@ public class NamedScript extends GhidraScript {
Address funcAddress = selectAddress;
Function logFunction = functionManager.getFunctionAt(funcAddress);
// for (AddressSpace sp : addressSpaces) {
// funcAddress = sp.getAddress(selectAddress.getOffset());
// logFunction = functionManager.getFunctionAt(funcAddress);
// space = sp;
// if (null != logFunction) {
// break;
// }
// }
ReferenceIterator referenceIterator = referenceManager.getReferencesTo(logFunction.getEntryPoint());
for (Reference ref : referenceIterator) {
Address fromAddress = ref.getFromAddress();
// if (fromAddress.getOffset() != 0x18284bb19L) {
// continue;
// }
while(referenceIterator.hasNext()) {
monitor.checkCancelled();
Reference next = referenceIterator.next();
Address fromAddress = next.getFromAddress();
println("lookup address: " + fromAddress.toString());
handle(fromAddress, functionManager, decompiler, space, listing,selectAddress);
println("caller address: " + fromAddress);
println("caller address: " + fromAddress.toString());
}
}
private void handle(Address address, FunctionManager functionManager, DecompInterface decompiler,
AddressSpace space, Listing listing,Address selectAddress) {
Function functionContaining = functionManager.getFunctionContaining(address);
if (null == functionContaining) {
println("no found function: " + address);
println("no found function: " + address.toString());
return;
}
DecompileResults res = decompiler.decompileFunction(functionContaining, 20, null);