3 files changed, 75 insertions, 0 deletions
diff --git a/tools/ghidra/ExportAiScriptLoader.java b/tools/ghidra/ExportAiScriptLoader.java
new file mode 100644
index 0000000..1b457d4
--- /dev/null
+++ b/tools/ghidra/ExportAiScriptLoader.java
@@ -0,0 +1,23 @@
+// Emits the GOG AI script-bundle loader, discovered from references to
+// "MISSIONS\\SCRIPTS\\" and ".scr". Run headless; original input stays read only.
+import ghidra.app.decompiler.DecompInterface;
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Function;
+
+public class ExportAiScriptLoader extends GhidraScript {
+    private static final long ADDRESS = 0x10001000L;
+
+    @Override
+    public void run() throws Exception {
+        Address address = currentProgram.getAddressFactory().getDefaultAddressSpace()
+            .getAddress(ADDRESS);
+        Function function = currentProgram.getFunctionManager().getFunctionAt(address);
+        println("===== AI script loader =====");
+        if (function == null) { println("missing"); return; }
+        DecompInterface decompiler = new DecompInterface();
+        decompiler.openProgram(currentProgram);
+        println(decompiler.decompileFunction(function, 60, monitor).getDecompiledFunction().getC());
+        decompiler.dispose();
+    }
+}
diff --git a/tools/ghidra/ExportAiScriptPackageReader.java b/tools/ghidra/ExportAiScriptPackageReader.java
new file mode 100644
index 0000000..9365165
--- /dev/null
+++ b/tools/ghidra/ExportAiScriptPackageReader.java
@@ -0,0 +1,23 @@
+// Emits the immediate .scr package reader called by the AI script loader.
+// Run through Ghidra headless analysis; the original PE is never modified.
+import ghidra.app.decompiler.DecompInterface;
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Function;
+
+public class ExportAiScriptPackageReader extends GhidraScript {
+    private static final long ADDRESS = 0x10011B20L;
+
+    @Override
+    public void run() throws Exception {
+        Address address = currentProgram.getAddressFactory().getDefaultAddressSpace()
+            .getAddress(ADDRESS);
+        Function function = currentProgram.getFunctionManager().getFunctionAt(address);
+        println("===== AI .scr package reader =====");
+        if (function == null) { println("missing"); return; }
+        DecompInterface decompiler = new DecompInterface();
+        decompiler.openProgram(currentProgram);
+        println(decompiler.decompileFunction(function, 60, monitor).getDecompiledFunction().getC());
+        decompiler.dispose();
+    }
+}
diff --git a/tools/ghidra/FindAiScriptLoaderReferences.java b/tools/ghidra/FindAiScriptLoaderReferences.java
new file mode 100644
index 0000000..5aae152
--- /dev/null
+++ b/tools/ghidra/FindAiScriptLoaderReferences.java
@@ -0,0 +1,29 @@
+// Locates callers that reference the stable AI script-loader literals.
+// Run through Ghidra headless analysis; the original PE is read only.
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Function;
+import ghidra.program.model.mem.Memory;
+import ghidra.program.model.symbol.Reference;
+import ghidra.program.model.symbol.ReferenceManager;
+
+public class FindAiScriptLoaderReferences extends GhidraScript {
+    private static final String[] NEEDLES = {".scr", "MISSIONS\\SCRIPTS\\"};
+
+    @Override
+    public void run() throws Exception {
+        Memory memory = currentProgram.getMemory();
+        ReferenceManager references = currentProgram.getReferenceManager();
+        for (String needle : NEEDLES) {
+            byte[] bytes = (needle + "\0").getBytes("US-ASCII");
+            Address address = memory.findBytes(memory.getMinAddress(), memory.getMaxAddress(), bytes, null, true, monitor);
+            println("===== " + needle + " =====");
+            if (address == null) { println("missing"); continue; }
+            println("literal=" + address);
+            for (Reference reference : references.getReferencesTo(address)) {
+                Function caller = currentProgram.getFunctionManager().getFunctionContaining(reference.getFromAddress());
+                println("reference=" + reference.getFromAddress() + " caller=" + (caller == null ? "missing" : caller.getEntryPoint()));
+            }
+        }
+    }
+}