From ea09804778ba7b1855b37fa21865bd6762e81638 Mon Sep 17 00:00:00 2001 From: Valentin Popov Date: Sat, 18 Jul 2026 21:27:39 +0400 Subject: docs(ai): trace frequent handler thirty callback --- tools/ghidra/FindAiVmHandler30Callback.java | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 tools/ghidra/FindAiVmHandler30Callback.java (limited to 'tools/ghidra/FindAiVmHandler30Callback.java') diff --git a/tools/ghidra/FindAiVmHandler30Callback.java b/tools/ghidra/FindAiVmHandler30Callback.java new file mode 100644 index 0000000..a6da0ad --- /dev/null +++ b/tools/ghidra/FindAiVmHandler30Callback.java @@ -0,0 +1,27 @@ +// Finds writers and readers of Handler(30)'s callback pointer, then decompiles +// their containing functions. Run headless; the original PE remains read only. +import ghidra.app.decompiler.DecompInterface; +import ghidra.app.script.GhidraScript; +import ghidra.program.model.address.Address; +import ghidra.program.model.listing.Function; +import ghidra.program.model.symbol.Reference; + +public class FindAiVmHandler30Callback extends GhidraScript { + private static final long ADDRESS = 0x100555e4L; + + @Override + public void run() throws Exception { + Address address = currentProgram.getAddressFactory().getDefaultAddressSpace() + .getAddress(ADDRESS); + DecompInterface decompiler = new DecompInterface(); + decompiler.openProgram(currentProgram); + for (Reference reference : currentProgram.getReferenceManager().getReferencesTo(address)) { + Function function = currentProgram.getFunctionManager() + .getFunctionContaining(reference.getFromAddress()); + println("===== callback reference " + reference.getFromAddress() + " ====="); + if (function == null) { println("no containing function"); continue; } + println(decompiler.decompileFunction(function, 60, monitor).getDecompiledFunction().getC()); + } + decompiler.dispose(); + } +} -- cgit v1.2.3