Map the world view sizing; add RE tooling
- docs/widescreen.md: render-thread frame, cWorldView0 layout and methods, view size = zoom * 1024.0/768.0 float constants and all their users, ortho projection extents, open questions (activity radius, buffers). - tools: find-imm (immediate/regex instruction search), rtti (vtables via MSVC RTTI), decompile.ps1 + Ghidra scripts for a persistent project; ApplyRtti recovers 410 vtables / ~1200 functions Ghidra misses. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
khallaandClaude Opus 5.5 committed
1 parent
1549464af6
commit
b2dc1338d2
8 files changed
+493
No files matched your search
@@ -0,0 +1,138 @@
|
||||
// Recover MSVC 6 RTTI in sacred.exe: for every class with a TypeDescriptor
|
||||
// (".?AV<Name>@@"), find its CompleteObjectLocators and vtables, create a
|
||||
// function for every vtable entry and name default-named ones
|
||||
// "<Class>::vfNN" (NN = byte offset in the vtable). Labels the vtables
|
||||
// "<Class>::vftable" (plus "_at_<offset>" for secondary base subobjects).
|
||||
//
|
||||
// Ghidra's own RecoverClassesFromRTTIScript finds nothing in this binary.
|
||||
// Run once, headless, without -readOnly (see tools/README.md).
|
||||
// @category sacred_re
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.HashMap;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
|
||||
import ghidra.app.cmd.disassemble.DisassembleCommand;
|
||||
import ghidra.app.script.GhidraScript;
|
||||
import ghidra.program.model.address.Address;
|
||||
import ghidra.program.model.listing.Function;
|
||||
import ghidra.program.model.mem.Memory;
|
||||
import ghidra.program.model.mem.MemoryBlock;
|
||||
import ghidra.program.model.symbol.Namespace;
|
||||
import ghidra.program.model.symbol.SourceType;
|
||||
import ghidra.program.model.symbol.SymbolTable;
|
||||
|
||||
public class ApplyRtti extends GhidraScript {
|
||||
|
||||
private Memory memory;
|
||||
|
||||
@Override
|
||||
protected void run() throws Exception {
|
||||
memory = currentProgram.getMemory();
|
||||
MemoryBlock text = memory.getBlock(".text");
|
||||
MemoryBlock rdata = memory.getBlock(".rdata");
|
||||
SymbolTable symbols = currentProgram.getSymbolTable();
|
||||
|
||||
// 1. TypeDescriptors: the mangled name sits 8 bytes in. Search all blocks.
|
||||
Map<Long, String> typeDescriptors = new HashMap<>();
|
||||
byte[] prefix = ".?AV".getBytes("ISO-8859-1");
|
||||
for (MemoryBlock block : memory.getBlocks()) {
|
||||
if (!block.isInitialized()) {
|
||||
continue;
|
||||
}
|
||||
Address cursor = block.getStart();
|
||||
while (cursor != null && cursor.compareTo(block.getEnd()) < 0) {
|
||||
Address hit = memory.findBytes(cursor, block.getEnd(), prefix, null, true, monitor);
|
||||
if (hit == null) {
|
||||
break;
|
||||
}
|
||||
String mangled = readCString(hit, 512);
|
||||
if (mangled.endsWith("@@")) {
|
||||
typeDescriptors.put(hit.getOffset() - 8, mangled.substring(4, mangled.length() - 2));
|
||||
}
|
||||
cursor = hit.add(1);
|
||||
}
|
||||
}
|
||||
println("type descriptors: " + typeDescriptors.size());
|
||||
|
||||
// 2. CompleteObjectLocators in .rdata: {0, offset, cdOffset, pTD, pCHD}.
|
||||
Map<Long, long[]> locators = new HashMap<>(); // col -> {td, subobjectOffset}
|
||||
long rdataStart = rdata.getStart().getOffset();
|
||||
long rdataEnd = rdata.getEnd().getOffset();
|
||||
for (long a = rdataStart; a + 20 <= rdataEnd; a += 4) {
|
||||
if (readU32(a) != 0) {
|
||||
continue;
|
||||
}
|
||||
long td = readU32(a + 12);
|
||||
if (typeDescriptors.containsKey(td)) {
|
||||
locators.put(a, new long[] {td, readU32(a + 4)});
|
||||
}
|
||||
}
|
||||
println("object locators: " + locators.size());
|
||||
|
||||
// 3. vtables: a dword in .rdata pointing at a COL; entries follow it.
|
||||
int vtables = 0;
|
||||
int created = 0;
|
||||
int named = 0;
|
||||
for (long a = rdataStart; a + 8 <= rdataEnd; a += 4) {
|
||||
long[] locator = locators.get(readU32(a));
|
||||
if (locator == null) {
|
||||
continue;
|
||||
}
|
||||
String className = typeDescriptors.get(locator[0]);
|
||||
long vtable = a + 4;
|
||||
Namespace namespace = symbols.getOrCreateNameSpace(currentProgram.getGlobalNamespace(),
|
||||
className, SourceType.ANALYSIS);
|
||||
String suffix = locator[1] == 0 ? "" : String.format("_at_%x", locator[1]);
|
||||
symbols.createLabel(toAddr(vtable), "vftable" + suffix, namespace, SourceType.ANALYSIS);
|
||||
vtables++;
|
||||
|
||||
List<Long> entries = new ArrayList<>();
|
||||
for (long e = vtable; e + 4 <= rdataEnd; e += 4) {
|
||||
long target = readU32(e);
|
||||
if (!text.contains(toAddr(target))) {
|
||||
break;
|
||||
}
|
||||
if (e != vtable && locators.containsKey(target)) {
|
||||
break;
|
||||
}
|
||||
entries.add(target);
|
||||
}
|
||||
for (int i = 0; i < entries.size(); i++) {
|
||||
Address entry = toAddr(entries.get(i));
|
||||
Function function = getFunctionAt(entry);
|
||||
if (function == null) {
|
||||
new DisassembleCommand(entry, null, true).applyTo(currentProgram, monitor);
|
||||
function = createFunction(entry, null);
|
||||
if (function == null) {
|
||||
continue;
|
||||
}
|
||||
created++;
|
||||
}
|
||||
if (function.getSymbol().getSource() == SourceType.DEFAULT) {
|
||||
function.setName(String.format("vf%02x%s", i * 4, suffix), SourceType.ANALYSIS);
|
||||
function.setParentNamespace(namespace);
|
||||
named++;
|
||||
}
|
||||
}
|
||||
}
|
||||
println("vtables: " + vtables + ", functions created: " + created + ", named: " + named);
|
||||
}
|
||||
|
||||
private long readU32(long address) throws Exception {
|
||||
return memory.getInt(toAddr(address)) & 0xffffffffL;
|
||||
}
|
||||
|
||||
private String readCString(Address address, int max) throws Exception {
|
||||
StringBuilder text = new StringBuilder();
|
||||
for (int i = 0; i < max; i++) {
|
||||
byte b = memory.getByte(address.add(i));
|
||||
if (b == 0) {
|
||||
break;
|
||||
}
|
||||
text.append((char) (b & 0xff));
|
||||
}
|
||||
return text.toString();
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,65 @@
|
||||
// Decompile functions of the persistent sacred.exe Ghidra project.
|
||||
//
|
||||
// Headless usage (see tools/decompile.ps1):
|
||||
// analyzeHeadless <projectDir> sacred -process sacred.exe -noanalysis
|
||||
// -scriptPath tools/ghidra -postScript Decompile.java <outFile> <addr> [addr...]
|
||||
//
|
||||
// Addresses without a function (e.g. methods only reachable via a vtable) get
|
||||
// one created first; run without -readOnly to keep those in the project.
|
||||
// @category sacred_re
|
||||
|
||||
import java.io.File;
|
||||
import java.io.PrintWriter;
|
||||
|
||||
import ghidra.app.cmd.disassemble.DisassembleCommand;
|
||||
import ghidra.app.decompiler.DecompInterface;
|
||||
import ghidra.app.decompiler.DecompileOptions;
|
||||
import ghidra.app.decompiler.DecompileResults;
|
||||
import ghidra.app.script.GhidraScript;
|
||||
import ghidra.program.model.address.Address;
|
||||
import ghidra.program.model.listing.Function;
|
||||
|
||||
public class Decompile extends GhidraScript {
|
||||
|
||||
@Override
|
||||
protected void run() throws Exception {
|
||||
String[] args = getScriptArgs();
|
||||
if (args.length < 2) {
|
||||
printerr("usage: Decompile.java <outFile> <address> [address...]");
|
||||
return;
|
||||
}
|
||||
|
||||
DecompInterface decompiler = new DecompInterface();
|
||||
decompiler.setOptions(new DecompileOptions());
|
||||
decompiler.openProgram(currentProgram);
|
||||
|
||||
try (PrintWriter out = new PrintWriter(new File(args[0]), "UTF-8")) {
|
||||
for (int i = 1; i < args.length; i++) {
|
||||
Address address = toAddr(args[i]);
|
||||
Function function = getFunctionAt(address);
|
||||
if (function == null) {
|
||||
function = getFunctionContaining(address);
|
||||
}
|
||||
if (function == null) {
|
||||
new DisassembleCommand(address, null, true).applyTo(currentProgram, monitor);
|
||||
function = createFunction(address, null);
|
||||
}
|
||||
out.println("// ==== " + args[i] + " ====");
|
||||
if (function == null) {
|
||||
out.println("// could not create a function here");
|
||||
continue;
|
||||
}
|
||||
out.println("// " + function.getName(true) + " @ " + function.getEntryPoint()
|
||||
+ " (" + function.getCallingConventionName() + ")");
|
||||
DecompileResults result = decompiler.decompileFunction(function, 120, monitor);
|
||||
if (result.decompileCompleted()) {
|
||||
out.println(result.getDecompiledFunction().getC());
|
||||
} else {
|
||||
out.println("// decompile failed: " + result.getErrorMessage());
|
||||
}
|
||||
}
|
||||
} finally {
|
||||
decompiler.dispose();
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user