diff options
| author | Valentin Popov <valentin@popov.link> | 2026-07-18 20:53:09 +0300 |
|---|---|---|
| committer | Valentin Popov <valentin@popov.link> | 2026-07-18 20:53:09 +0300 |
| commit | 5d40ba3968d73bbe08808ff0b64daf6661b137f8 (patch) | |
| tree | 43af3426bb61611ece81790763fa58d20e7d7bac /tools/ghidra | |
| parent | d1edf4ba65e46546e4a2c1ef6792e68d19d247fd (diff) | |
| download | fparkan-5d40ba3968d73bbe08808ff0b64daf6661b137f8.tar.xz fparkan-5d40ba3968d73bbe08808ff0b64daf6661b137f8.zip | |
feat(script): resolve handler eight states
Diffstat (limited to 'tools/ghidra')
| -rw-r--r-- | tools/ghidra/ExportAiVmHandler8.java | 23 | ||||
| -rw-r--r-- | tools/ghidra/ExportAiVmHandler8Callees.java | 25 | ||||
| -rw-r--r-- | tools/ghidra/ExportAiVmHandler8Transitions.java | 25 |
3 files changed, 73 insertions, 0 deletions
diff --git a/tools/ghidra/ExportAiVmHandler8.java b/tools/ghidra/ExportAiVmHandler8.java new file mode 100644 index 0000000..4539629 --- /dev/null +++ b/tools/ghidra/ExportAiVmHandler8.java @@ -0,0 +1,23 @@ +// Emits Handler(8), a frequent non-sentinel selector in the GOG compiled +// script corpus. Run headless; the original PE remains read only. +import ghidra.app.decompiler.DecompInterface; +import ghidra.app.script.GhidraScript; +import ghidra.program.model.address.Address; +import ghidra.program.model.listing.Function; + +public class ExportAiVmHandler8 extends GhidraScript { + private static final long ADDRESS = 0x10009b0dL; + + @Override + public void run() throws Exception { + Address address = currentProgram.getAddressFactory().getDefaultAddressSpace() + .getAddress(ADDRESS); + Function function = currentProgram.getFunctionManager().getFunctionAt(address); + println("===== AI VM Handler(8) ====="); + if (function == null) { println("missing"); return; } + DecompInterface decompiler = new DecompInterface(); + decompiler.openProgram(currentProgram); + println(decompiler.decompileFunction(function, 60, monitor).getDecompiledFunction().getC()); + decompiler.dispose(); + } +} diff --git a/tools/ghidra/ExportAiVmHandler8Callees.java b/tools/ghidra/ExportAiVmHandler8Callees.java new file mode 100644 index 0000000..6ddf317 --- /dev/null +++ b/tools/ghidra/ExportAiVmHandler8Callees.java @@ -0,0 +1,25 @@ +// Emits the two non-trivial local callees reached by Handler(8). Run headless; +// the original PE remains read only. +import ghidra.app.decompiler.DecompInterface; +import ghidra.app.script.GhidraScript; +import ghidra.program.model.address.Address; +import ghidra.program.model.listing.Function; + +public class ExportAiVmHandler8Callees extends GhidraScript { + private static final long[] ADDRESSES = {0x10002e90L, 0x10005710L}; + + @Override + public void run() throws Exception { + DecompInterface decompiler = new DecompInterface(); + decompiler.openProgram(currentProgram); + for (long value : ADDRESSES) { + Address address = currentProgram.getAddressFactory().getDefaultAddressSpace() + .getAddress(value); + Function function = currentProgram.getFunctionManager().getFunctionAt(address); + println("===== AI Handler(8) callee " + address + " ====="); + if (function == null) { println("missing"); continue; } + println(decompiler.decompileFunction(function, 60, monitor).getDecompiledFunction().getC()); + } + decompiler.dispose(); + } +} diff --git a/tools/ghidra/ExportAiVmHandler8Transitions.java b/tools/ghidra/ExportAiVmHandler8Transitions.java new file mode 100644 index 0000000..2eee9a8 --- /dev/null +++ b/tools/ghidra/ExportAiVmHandler8Transitions.java @@ -0,0 +1,25 @@ +// Emits the state-transition helpers selected by Handler(8). Run headless; +// the original PE remains read only. +import ghidra.app.decompiler.DecompInterface; +import ghidra.app.script.GhidraScript; +import ghidra.program.model.address.Address; +import ghidra.program.model.listing.Function; + +public class ExportAiVmHandler8Transitions extends GhidraScript { + private static final long[] ADDRESSES = {0x10005010L, 0x10005040L}; + + @Override + public void run() throws Exception { + DecompInterface decompiler = new DecompInterface(); + decompiler.openProgram(currentProgram); + for (long value : ADDRESSES) { + Address address = currentProgram.getAddressFactory().getDefaultAddressSpace() + .getAddress(value); + Function function = currentProgram.getFunctionManager().getFunctionAt(address); + println("===== AI Handler(8) transition " + address + " ====="); + if (function == null) { println("missing"); continue; } + println(decompiler.decompileFunction(function, 60, monitor).getDecompiledFunction().getC()); + } + decompiler.dispose(); + } +} |
