decompiled agent_release

decomp/scripts/VTableMap.java

@@ -0,0 +1,39 @@
+// Map virtual methods to classes via RTTI-labelled vftables.
+// Usage (postScript): VTableMap.java <outFile.tsv>
+// Writes: class, vftable_address, slot, function_address, function_name
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.*;
+import ghidra.program.model.listing.*;
+import ghidra.program.model.symbol.*;
+import java.io.*;
+import java.nio.file.*;
+
+public class VTableMap extends GhidraScript {
+    @Override
+    public void run() throws Exception {
+        Path out = Paths.get(getScriptArgs()[0]);
+        int ptr = currentProgram.getDefaultPointerSize();
+        Listing listing = currentProgram.getListing();
+        SymbolTable st = currentProgram.getSymbolTable();
+        try (PrintWriter w = new PrintWriter(Files.newBufferedWriter(out))) {
+            w.println("class\tvftable\tslot\tfunction\tname");
+            for (Symbol s : st.getSymbols("vftable")) {
+                String cls = s.getParentNamespace().getName(true);
+                Address a = s.getAddress();
+                for (int slot = 0; slot < 512; slot++) {
+                    Address p = a.add((long) slot * ptr);
+                    if (slot > 0 && st.getPrimarySymbol(p) != null
+                        && st.getPrimarySymbol(p).getSource() != SourceType.DEFAULT) break; // next labelled object
+                    long v = currentProgram.getMemory().getLong(p);
+                    Address t;
+                    try { t = currentProgram.getAddressFactory().getDefaultAddressSpace().getAddress(v); }
+                    catch (Exception e) { break; }
+                    Function f = getFunctionAt(t);
+                    if (f == null) break;
+                    w.println(cls + "\t0x" + a + "\t" + slot + "\t0x" + t + "\t" + f.getName(true));
+                }
+            }
+        }
+        println("vtable map written");
+    }
+}