XFE Git
XFE Studio Git
Git 首页 全局搜索
XFE 主站 文档 NuGet

XFEEDToolBox

【WinUI】XFE精英危险工具箱

公开
关注 0 Fork 0 Star 0
UTF-8
import ghidra.app.script.GhidraScript;
import ghidra.app.decompiler.DecompInterface;
import java.nio.file.Files;
import java.nio.file.Path;

// Fixed, offline inspection of the already-installed translation component.
// Never loads the DLL, attaches to the game or exports package key material.
public class TranslationResourceDecompile extends GhidraScript {
    public void run() throws Exception {
        if(getScriptArgs().length!=1||!currentProgram.getExecutableSHA256().equalsIgnoreCase("9e0c0ab1d854521918e59800496ff56d9bf97b436ad145f1ee88ffb33ea721fa"))throw new IllegalArgumentException("Unexpected local translation component.");
        Path output=Path.of(getScriptArgs()[0]);Files.createDirectories(output);
        DecompInterface decompiler=new DecompInterface();
        try {
            decompiler.openProgram(currentProgram);
            for(long rva:new long[]{0xB930,0x3EC80,0x3F080}) {
                var address=currentProgram.getImageBase().add(rva);
                if(getFunctionAt(address)==null){disassemble(address);createFunction(address,"resource_"+Long.toHexString(rva));}
                var result=decompiler.decompileFunction(getFunctionAt(address),45,monitor);
                if(!result.decompileCompleted())throw new IllegalStateException(result.getErrorMessage());
                Files.writeString(output.resolve(Long.toHexString(rva)+".c"),result.getDecompiledFunction().getC());
                println("Offline translation resource function "+Long.toHexString(rva));
            }
        } finally {decompiler.dispose();}
    }
}