# Decompile addresses from the persistent Ghidra project (ghidra/sacred.gpr). # .\tools\decompile.ps1 0x6322b0 0x62ae70 [-Out file.c] [-ReadOnly] # Prints the C to stdout (and keeps it in -Out, default ghidra\last.c). # Without -ReadOnly, functions created for vtable-only methods are saved. param( [Parameter(Mandatory, ValueFromRemainingArguments)][string[]]$Addresses, [string]$Out = "", [switch]$ReadOnly ) $ErrorActionPreference = "Stop" $root = Split-Path $PSScriptRoot if (-not $Out) { $Out = Join-Path $root "ghidra\last.c" } $ghidra = if ($env:GHIDRA_INSTALL_DIR) { $env:GHIDRA_INSTALL_DIR } else { "E:\Coding\Ghidra\ghidra_12.1.4_PUBLIC" } if (-not $env:JAVA_HOME) { $env:JAVA_HOME = "C:\Program Files\Java\jdk-21" } $arguments = @( (Join-Path $root "ghidra"), "sacred", "-process", "sacred.exe", "-noanalysis", "-scriptPath", (Join-Path $PSScriptRoot "ghidra"), "-postScript", "Decompile.java", $Out ) + $Addresses if ($ReadOnly) { $arguments += "-readOnly" } & (Join-Path $ghidra "support\analyzeHeadless.bat") @arguments *> (Join-Path $root "ghidra\decompile.out") if ($LASTEXITCODE -ne 0) { Get-Content (Join-Path $root "ghidra\decompile.out") -Tail 30; exit $LASTEXITCODE } Get-Content $Out