XFE Git
XFE Studio Git
Git 首页 全局搜索
XFE 主站 文档 NuGet

XFEEDToolBox

【WinUI】XFE精英危险工具箱

公开
关注 0 Fork 0 Star 0
UTF-8
// Static references in the existing pinned-image database; no process access.
import ghidra.app.script.GhidraScript;
import ghidra.program.model.address.Address;
import ghidra.program.model.listing.Function;
import ghidra.program.model.symbol.Reference;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.charset.StandardCharsets;

public class FindPinnedImageReferences extends GhidraScript {
    public void run() throws Exception {
        if(getScriptArgs().length!=2||currentProgram.getImageBase().getOffset()!=0x140000000L||!currentProgram.getName().equals("EliteDangerous64.exe"))
            throw new IllegalArgumentException("Expected the dedicated pinned image, output file and fixed-RVA manifest.");
        StringBuilder out=new StringBuilder("[\n");boolean first=true;
        var rows=Files.readAllLines(Path.of(getScriptArgs()[1]),StandardCharsets.UTF_8);
        if(rows.size()>64)throw new IllegalArgumentException("Reference manifest too large");
        for(String row:rows){
            if(!row.matches("0x[0-9a-fA-F]{6,8}"))throw new IllegalArgumentException("Expected fixed PE RVA");
            long rva=Long.parseLong(row.substring(2),16);Address address=currentProgram.getImageBase().add(rva);
            for(Reference ref:getReferencesTo(address)){
                monitor.checkCancelled();if(!first)out.append(",\n");first=false;
                Address source=ref.getFromAddress();Function function=getFunctionContaining(source);
                out.append("  {\"targetRva\":\"0x").append(Long.toHexString(rva)).append("\",\"sourceRva\":\"0x")
                    .append(Long.toHexString(source.getOffset()-0x140000000L)).append("\",\"functionRva\":");
                if(function==null)out.append("null");else out.append("\"0x").append(Long.toHexString(function.getEntryPoint().getOffset()-0x140000000L)).append("\"");
                out.append(",\"type\":\"").append(ref.getReferenceType()).append("\"}");
            }
        }
        out.append("\n]\n");Files.writeString(Path.of(getScriptArgs()[0]),out.toString(),StandardCharsets.UTF_8);
        println("Wrote offline reference inventory");
    }
}