Java Code Examples for ghidra.program.model.listing.Listing#createData()

The following examples show how to use ghidra.program.model.listing.Listing#createData() . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
Source File: FollowFlowProgramBuilder.java    From ghidra with Apache License 2.0 6 votes vote down vote up
private int createPointer(int from, int to) throws Exception {
	int thisPointerSize = 4;

	byte[] bytes = new byte[thisPointerSize];
	dataConverter.getBytes(to, bytes);

	String fromString = "0x" + Integer.toHexString(from);
	String endString = "0x" + Integer.toHexString(from + thisPointerSize - 1);

	clearCodeUnits(fromString, endString, false);
	setBytes(fromString, bytes, false);
	startTransaction();
	Listing listing = getProgram().getListing();
	listing.createData(addr(from), new Pointer32DataType());
	endTransaction();

	return thisPointerSize; // pointer size in bytes.
}
 
Example 2
Source File: AnalyzerBase.java    From gotools with MIT License 5 votes vote down vote up
/**
 * Creates a new defined Data object at the given address.
 *
 * @param address  the address at which to create a new Data object.
 * @param datatype the Data Type that describes the type of Data object to
 *                 create.
 * @return the newly created Data object
 */
final Data createData(Program p, Address address, DataType datatype) throws Exception {
  Listing listing = p.getListing();
  Data d = listing.getDefinedDataAt(address);
  if (d != null) {
    if (d.getDataType().isEquivalent(datatype)) {
      return d;
    }
    throw new CodeUnitInsertionException("Data conflict at address " + address);
  }
  return listing.createData(address, datatype);
}
 
Example 3
Source File: DemangledAddressTableTest.java    From ghidra with Apache License 2.0 5 votes vote down vote up
/**
 * Test that the DemangledAddressTable will not create a sequence of data 
 * pointers due to a data collision.  This test deals with the case where primitive types have been 
 * previously created. End of block considered end of address table.
 */
@Test
public void testApply_NoNextSymbol_DataCollision() throws Exception {

	// this is: vtable for UnqiueSpace
	String mangled = "_ZTV11UniqueSpace";
	Address addr = addr("0x0110");

	SymbolTable symbolTable = program.getSymbolTable();
	symbolTable.createLabel(addr, mangled, SourceType.IMPORTED);

	Listing listing = program.getListing();
	listing.createData(addr("0x114"), Undefined4DataType.dataType);
	listing.createData(addr("0x118"), Undefined4DataType.dataType);
	listing.createData(addr("0x120"), DWordDataType.dataType);

	DemangledObject demangled = DemanglerUtil.demangle(mangled);
	assertTrue(demangled instanceof DemangledAddressTable);

	assertTrue(demangled.applyTo(program, addr, new DemanglerOptions(), TaskMonitor.DUMMY));

	// expected: UniqueSpace::vtable
	Symbol[] symbols = symbolTable.getSymbols(addr);
	assertEquals(2, symbols.length);
	assertEquals("vtable", symbols[0].getName());
	assertEquals(mangled, symbols[1].getName());

	Namespace ns = symbols[0].getParentNamespace();
	assertEquals("UniqueSpace", ns.getName(false));

	// should fail to create pointers since table region (to end of block) contains
	// data other than pointer or undefined
	assertPointersAt(3, 0);
}
 
Example 4
Source File: DemangledAddressTableTest.java    From ghidra with Apache License 2.0 5 votes vote down vote up
/**
 * Test that the DemangledAddressTable will properly create a sequence of data 
 * pointers.  This test deals with the case where primitive types have been 
 * previously created. Next label considered end of address table.
 */
@Test
public void testApply_WithNextSymbol_UndefinedData() throws Exception {

	// this is: vtable for UnqiueSpace
	String mangled = "_ZTV11UniqueSpace";
	Address addr = addr("0x0110");

	SymbolTable symbolTable = program.getSymbolTable();
	symbolTable.createLabel(addr, mangled, SourceType.IMPORTED);

	Listing listing = program.getListing();
	listing.createData(addr("0x114"), Undefined4DataType.dataType);
	listing.createData(addr("0x118"), Undefined4DataType.dataType);
	listing.createData(addr("0x120"), DWordDataType.dataType);

	symbolTable.createLabel(addr("0x120"), "NextLabel", SourceType.IMPORTED);

	DemangledObject demangled = DemanglerUtil.demangle(mangled);
	assertTrue(demangled instanceof DemangledAddressTable);

	assertTrue(demangled.applyTo(program, addr, new DemanglerOptions(), TaskMonitor.DUMMY));

	// expected: UniqueSpace::vtable
	Symbol[] symbols = symbolTable.getSymbols(addr);
	assertEquals(2, symbols.length);
	assertEquals("vtable", symbols[0].getName());
	assertEquals(mangled, symbols[1].getName());

	Namespace ns = symbols[0].getParentNamespace();
	assertEquals("UniqueSpace", ns.getName(false));

	assertPointersAt(1, 0, "0x110", "0x114", "0x118", "0x11c");
}
 
Example 5
Source File: DemangledAddressTableTest.java    From ghidra with Apache License 2.0 5 votes vote down vote up
/**
 * Test that the DemangledAddressTable will properly create a sequence of data 
 * pointers.  This test deals with the case where primitive types have been 
 * previously created where the first is an undefined array which dictates the 
 * extent of the address table. Next label beyond end of address table.
 */
@Test
public void testApply_WithUndefinedArray() throws Exception {

	// this is: vtable for UnqiueSpace
	String mangled = "_ZTV11UniqueSpace";
	Address addr = addr("0x0110");

	SymbolTable symbolTable = program.getSymbolTable();
	symbolTable.createLabel(addr, mangled, SourceType.IMPORTED);

	Listing listing = program.getListing();
	listing.createData(addr("0x110"), Undefined.getUndefinedDataType(12));
	listing.createData(addr("0x11c"), Undefined4DataType.dataType);
	listing.createData(addr("0x120"), DWordDataType.dataType);

	symbolTable.createLabel(addr("0x120"), "NextLabel", SourceType.IMPORTED);

	DemangledObject demangled = DemanglerUtil.demangle(mangled);
	assertTrue(demangled instanceof DemangledAddressTable);

	assertTrue(demangled.applyTo(program, addr, new DemanglerOptions(), TaskMonitor.DUMMY));

	// expected: UniqueSpace::vtable
	Symbol[] symbols = symbolTable.getSymbols(addr);
	assertEquals(2, symbols.length);
	assertEquals("vtable", symbols[0].getName());
	assertEquals(mangled, symbols[1].getName());

	Namespace ns = symbols[0].getParentNamespace();
	assertEquals("UniqueSpace", ns.getName(false));

	assertPointersAt(2, 0, "0x110", "0x114", "0x118");
}
 
Example 6
Source File: FollowFlowProgramBuilder.java    From ghidra with Apache License 2.0 5 votes vote down vote up
private int createStructureWithPointer(String name, int startOfStruct, int to) throws Exception {
	int thisStructureSize = 12;
	int thisPointerSize = 4;
	int pointerOffset = 4;

	byte[] bytes = new byte[thisPointerSize];
	dataConverter.getBytes(to, bytes);

	String structureStart = "0x" + Integer.toHexString(startOfStruct);
	String pointerStart = "0x" + Integer.toHexString(startOfStruct + pointerOffset);
	String structureEnd = "0x" + Integer.toHexString(startOfStruct + thisStructureSize - 1);
	String toAddress = "0x" + Integer.toHexString(to);

	clearCodeUnits(structureStart, structureEnd, false);
	setBytes(pointerStart, bytes, false);
	startTransaction();
	ProgramDB program = getProgram();
	Listing listing = program.getListing();
	Structure struct = new StructureDataType(name, thisStructureSize, program.getDataTypeManager());
	struct.replaceAtOffset(0, new FloatDataType(), 4, null, null);
	struct.replaceAtOffset(pointerOffset, new Pointer32DataType(), 4, null, null);
	listing.createData(addr(startOfStruct), struct);
	createMemoryReference(pointerStart, toAddress, RefType.DATA, SourceType.ANALYSIS, 0);
	endTransaction();

	return thisPointerSize; // pointer size in bytes.
}
 
Example 7
Source File: FollowFlowProgramBuilder.java    From ghidra with Apache License 2.0 5 votes vote down vote up
private int createStructureWith2Pointers(String name, int startOfStruct, int to, int secondTo)
		throws Exception {
	int thisStructureSize = 12;
	int pointerSize = 4;
	int pointerOffset = 4;

	byte[] bytes = new byte[pointerSize];
	dataConverter.getBytes(to, bytes);

	String structureStart = "0x" + Integer.toHexString(startOfStruct);
	String pointerStart = "0x" + Integer.toHexString(startOfStruct + pointerOffset);
	String pointer2Start =
		"0x" + Integer.toHexString(startOfStruct + pointerOffset + pointerSize);
	String structureEnd = "0x" + Integer.toHexString(startOfStruct + thisStructureSize - 1);
	String toAddress = "0x" + Integer.toHexString(to);
	String toAddress2 = "0x" + Integer.toHexString(secondTo);

	clearCodeUnits(structureStart, structureEnd, false);
	setBytes(pointerStart, bytes, false);
	dataConverter.getBytes(secondTo, bytes);
	setBytes(pointerStart + pointerSize, bytes, false);
	startTransaction();
	ProgramDB program = getProgram();
	Listing listing = program.getListing();
	Structure struct = new StructureDataType(name, thisStructureSize, program.getDataTypeManager());
	struct.replaceAtOffset(0, new FloatDataType(), 4, null, null);
	struct.replaceAtOffset(pointerOffset, new Pointer32DataType(), 4, null, null);
	struct.replaceAtOffset(pointerOffset + pointerSize, new Pointer32DataType(), 4, null, null);
	listing.createData(addr(startOfStruct), struct);
	createMemoryReference(pointerStart, toAddress, RefType.DATA, SourceType.ANALYSIS, 0);
	createMemoryReference(pointer2Start, toAddress2, RefType.DATA, SourceType.ANALYSIS, 0);
	endTransaction();

	return pointerSize; // pointer size in bytes.
}
 
Example 8
Source File: CondenseRepeatingBytes.java    From ghidra with Apache License 2.0 4 votes vote down vote up
@Override
   public void run() throws Exception {
	
	if (currentAddress == null) {
            println("No Location.");
            return;
        }
	MemoryBlock currentMemoryBlock = currentProgram.getMemory().getBlock(currentAddress);
	if(!currentMemoryBlock.isInitialized()){
		println("Script cannot run in uninitialized memory.");
		return;
	}
		
	Listing listing = currentProgram.getListing();
	Address currentAddr = currentAddress;
	byte repeatingByte = currentProgram.getMemory().getByte(currentAddr);
	int repeatLen = 1;
	currentAddr = currentAddr.addNoWrap(1);
	byte nextByte;		
	boolean sameMemoryBlock;
	if(currentProgram.getMemory().getBlock(currentAddr).equals(currentMemoryBlock)) {
		nextByte = currentProgram.getMemory().getByte(currentAddr);
		sameMemoryBlock = true;
	}
	else{
		sameMemoryBlock = false;
		return;
	}
	
	boolean noCollisions = true;
	
	while((sameMemoryBlock) && (nextByte == repeatingByte) && (noCollisions)){
		repeatLen++;
		currentAddr = currentAddr.addNoWrap(1);
		if(currentProgram.getMemory().getBlock(currentAddr) != currentMemoryBlock){
			sameMemoryBlock = false;				
		}
		else{
			nextByte = currentProgram.getMemory().getByte(currentAddr);
			noCollisions = listing.isUndefined(currentAddr,currentAddr);
		}			
	}
	

	listing.createData(currentAddress, new AlignmentDataType(), repeatLen);				
	
	println("Applied Alignment datatype at " + currentAddress.toString());				
		
}
 
Example 9
Source File: CondenseRepeatingBytesAtEndOfMemory.java    From ghidra with Apache License 2.0 4 votes vote down vote up
@Override
   public void run() throws Exception {		
		
	if (currentAddress == null) {
		println("No Location.");
	    return;
	}
	MemoryBlock memoryBlock = currentProgram.getMemory().getBlock(currentAddress);
	if(!memoryBlock.isInitialized()){
		println("Script cannot run in uninitialized memory.");
		return;
	}
	Listing listing = currentProgram.getListing();
	

	Address currentAddr = currentAddress;        
	
	boolean isInitializedBlock = memoryBlock.isInitialized();
	if(isInitializedBlock){
		currentAddr = memoryBlock.getEnd();
		println("end of byte addr is " + currentAddr);
		byte repeatingByte = currentProgram.getMemory().getByte(currentAddr);
		
	
		MemoryBlock currentMemoryBlock = null;		
	
		
		// search for next repeatedByte from the end of memory
		// until it hits defined area or different byte		
					
		byte prevByte = repeatingByte;
		int repeatLen = 0;
		boolean noCollisions = listing.isUndefined(currentAddr,currentAddr);
		boolean hasLabels = currentProgram.getSymbolTable().hasSymbol(currentAddr);
		println("no collisions at end = " + noCollisions);
		currentMemoryBlock = currentProgram.getMemory().getBlock(currentAddr);
		while((prevByte == repeatingByte) && (noCollisions) && (currentMemoryBlock.equals(memoryBlock)) && (!hasLabels)){
			repeatLen++;
			currentAddr = currentAddr.addNoWrap(-1);
			prevByte = currentProgram.getMemory().getByte(currentAddr);
			noCollisions = listing.isUndefined(currentAddr,currentAddr);
			hasLabels = currentProgram.getSymbolTable().hasSymbol(currentAddr);
			currentMemoryBlock = currentProgram.getMemory().getBlock(currentAddr);					
		}
		if(repeatLen > 0){
		// this takes care of the last one tested that failed
		currentAddr = currentAddr.addNoWrap(1);												
		listing.createData(currentAddr, new AlignmentDataType(), repeatLen);				
		
		println("Applied Alignment datatype at " + currentAddr.toString());												
		 
		}
		else{
			println("No repeating bytes OR data already defined at end of " + memoryBlock);
		}
	}
	else{
		println("Cannot condense uninitialized memory.");
	}		
}