# tools

Node tools need `npm install` here once (iced-x86). Paths to sacred.exe are
passed explicitly.

| Tool | Purpose |
|---|---|
| `disasm.mjs <exe> <va> [n]` | disassemble at an address, ignoring Ghidra's function boundaries |
| `find-imm.mjs <exe> <value...>` | every instruction using an immediate value (e.g. `1024 768`) |
| `find-imm.mjs <exe> /regex/` | every instruction whose text matches (e.g. `/96AB0h\]/`) |
| `rtti.mjs <exe> <Class>` | vtables of an MSVC class via RTTI |
| `decompile.ps1 <addr...>` | decompile from the persistent Ghidra project `ghidra/` |

## Persistent Ghidra project (`ghidra/`, not in git)

Created once (about 7 minutes):

```powershell
$env:GHIDRA_HEADLESS_MAXMEM = "8G"
& "$env:GHIDRA_INSTALL_DIR\support\analyzeHeadless.bat" ghidra sacred -import "<Sacred Gold>\sacred.exe"
& "$env:GHIDRA_INSTALL_DIR\support\analyzeHeadless.bat" ghidra sacred -process sacred.exe -scriptPath tools\ghidra -postScript ApplyRtti.java
```

`ApplyRtti.java` recovers the MSVC 6 RTTI that Ghidra's own script misses:
410 vtables, ~1200 extra functions, methods named `Class::vfNN`.