docs(ai): trace frequent handler thirty callback

1 files changed, 27 insertions, 0 deletions

diff --git a/tools/ghidra/FindAiVmHandler30Callback.java b/tools/ghidra/FindAiVmHandler30Callback.java
new file mode 100644
index 0000000..a6da0ad
--- /dev/null
+++ b/tools/ghidra/FindAiVmHandler30Callback.java
@@ -0,0 +1,27 @@
+// Finds writers and readers of Handler(30)'s callback pointer, then decompiles
+// their containing functions. Run headless; the original PE remains read only.
+import ghidra.app.decompiler.DecompInterface;
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Function;
+import ghidra.program.model.symbol.Reference;
+
+public class FindAiVmHandler30Callback extends GhidraScript {
+    private static final long ADDRESS = 0x100555e4L;
+
+    @Override
+    public void run() throws Exception {
+        Address address = currentProgram.getAddressFactory().getDefaultAddressSpace()
+            .getAddress(ADDRESS);
+        DecompInterface decompiler = new DecompInterface();
+        decompiler.openProgram(currentProgram);
+        for (Reference reference : currentProgram.getReferenceManager().getReferencesTo(address)) {
+            Function function = currentProgram.getFunctionManager()
+                .getFunctionContaining(reference.getFromAddress());
+            println("===== callback reference " + reference.getFromAddress() + " =====");
+            if (function == null) { println("no containing function"); continue; }
+            println(decompiler.decompileFunction(function, 60, monitor).getDecompiledFunction().getC());
+        }
+        decompiler.dispose();
+    }
+}