Skip to content

Improvement on "Analyzing function arguments at cross references" #4

@gipi

Description

@gipi

In the snippet regarding the extraction of arguments, if I'm understanding the code correctly, is iterating through all the instructions until it reaches a CALL and then check again that the address is the one we are interested in, but it's possible to ask for the opcode directly from an address passing it as an argument to getPcodeOps()

From the help:

>>> help(high_func.getPcodeOps)
Searching API for ghidra.program.model.pcode.HighFunction.getPcodeOps()...
Searching API for ghidra.program.model.pcode.PcodeSyntaxTree.getPcodeOps()...
-----------------------------------------------------
Iterator getPcodeOps()
  return all PcodeOps (alive or dead) ordered by SequenceNumber

  @return java.util.Iterator<ghidra.program.model.pcode.PcodeOpAST>: -- Iterator to PcodeOps

-----------------------------------------------------
-----------------------------------------------------
Iterator getPcodeOps(Address addr)
  return all PcodeOps associated with a particular instruction Address

  @param addr (ghidra.program.model.address.Address): -- Address of instruction generating PcodeOps
  @return java.util.Iterator<ghidra.program.model.pcode.PcodeOpAST>: -- Iterator to PcodeOps

-----------------------------------------------------

From a terminal session

>>> from ghidra.app.decompiler import DecompileOptions
>>> from ghidra.app.decompiler import DecompInterface
>>> from ghidra.util.task import ConsoleTaskMonitor
>>> monitor = ConsoleTaskMonitor()
>>> ifc = DecompInterface()
>>> options = DecompileOptions()
>>> ifc.setOptions(options)
True
>>> ifc.openProgram(currentProgram)
True
>>> func = getFunctionContaining(currentAddress)
>>> func
KeyboardBridgeServer::connectedChanged
>>> res = ifc.decompileFunction(func, 60, monitor)
>>> res
ghidra.app.decompiler.DecompileResults@46c33206
>>> high_func = res.getHighFunction()
>>> high_func.getPcodeOps(toAddr(0x00c8d64))
java.util.AbstractMap$2$1@4511ac6b
>>> pcodeops = high_func.getPcodeOps(toAddr(0x00c8d64))
>>> op = pcodeops.next()
>>> op
 ---  CALL (ram, 0x3b0e0, 8) , (unique, 0x10000009, 4) , (unique, 0x1000000d, 4) , (const, 0x0, 4) , (const, 0x0, 4)
>>> op.getInputs()
array(ghidra.program.model.pcode.Varnode, [(ram, 0x3b0e0, 8), (unique, 0x10000009, 4), (unique, 0x1000000d, 4), (const, 0x0, 4), (cons

In this way you can avoid a lot of overhead.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions