diff --git a/.gitattributes b/.gitattributes index 6b704f6..4aad274 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,4 +1,5 @@ * text eol=lf +*.png binary *.dd32 binary *.parquet filter=lfs diff=lfs merge=lfs -text profile/*/x64dbg/game.* -diff diff --git a/ghidra/MSVCExportSymbolsScript.py b/ghidra/MSVCExportSymbolsScript.py new file mode 100644 index 0000000..c425442 --- /dev/null +++ b/ghidra/MSVCExportSymbolsScript.py @@ -0,0 +1,90 @@ +#Export all autoanalysis MSVC functions to a Binana symbol file +# @runtime Jython +# @category Binana +# @author Thunderbrew +# @menupath +# @toolbar logo.png + +from ghidra.program.model.symbol import SymbolType +from java.awt import Toolkit +from java.awt.datatransfer import StringSelection +from ghidra.app.decompiler import DecompInterface +from ghidra.util.task import ConsoleTaskMonitor +from ghidra.program.model.symbol.SourceType import * +from ghidra.program.model.symbol import SourceType + +functionManager = currentProgram.getFunctionManager() + +file_location = askFile("Choose a file to save your Binana symbols to", "Go") + +listing = currentProgram.getListing() + +decomp_interface = DecompInterface() +decomp_interface.openProgram(currentProgram) + +def get_function_type(func): + """Uses the Decompiler to get the refined signature.""" + if func is None: + return "" + + results = decomp_interface.decompileFunction(func, 30, ConsoleTaskMonitor()) + high_func = results.getHighFunction() + + if high_func is None: + return "" + + ret_type = high_func.getFunctionPrototype().getReturnType().getName().replace(" *", "*") + + call_conv = high_func.getFunctionPrototype().getModelName() + + params = [] + num_params = high_func.getFunctionPrototype().getNumParams() + for i in range(num_params): + p = high_func.getFunctionPrototype().getParam(i) + params.append("{} {}".format(p.getDataType().getName().replace(" *", "*"), p.getName())) + + param_str = "(" + (", ".join(params)) + ")" + return ret_type + " " + call_conv + " func" + param_str + +def get_symbol_entry_for_function(func): + name = func.getName() + + entry_addr = func.getEntryPoint().toString().upper()[-8:] + body = func.getBody() + end_addr = (body.getMaxAddress().add(1)).toString().upper()[-8:] + + func_type = get_function_type(func) + # func_type = "" + + if func_type == "": + output = "{} {} f end={} auto".format(name, entry_addr, end_addr) + else: + output = "{} {} f end={} type=\"{}\" auto".format( + name, + entry_addr, + end_addr, + func_type + ) + return output + +def export_function_symbols(file): + monitor.setMessage("Exporting MSVC autoanalysis function symbols...") + + for f in functionManager.getFunctionsNoStubs(1): + monitor.checkCanceled() # throws exception if canceled + + if f.isExternal() or f.isThunk(): + continue + + symbol = f.getSymbol() + if symbol.getSource() == SourceType.ANALYSIS: + func_line = get_symbol_entry_for_function(f) + monitor.setMessage(func_line) + + file.write(func_line + "\n") + + return + +with open(file_location.absolutePath, "w") as file: + export_function_symbols(file) + file.close() diff --git a/ghidra/SuperExportSymbolsScript.py b/ghidra/SuperExportSymbolsScript.py new file mode 100644 index 0000000..4033340 --- /dev/null +++ b/ghidra/SuperExportSymbolsScript.py @@ -0,0 +1,87 @@ +#Export all functions in the database to a Binana symbol file +# @runtime Jython +# @category Binana +# @author Thunderbrew +# @keybinding Shift-E +# @menupath +# @toolbar logo.png + +from ghidra.program.model.symbol import SymbolType +from java.awt import Toolkit +from java.awt.datatransfer import StringSelection +from ghidra.app.decompiler import DecompInterface +from ghidra.util.task import ConsoleTaskMonitor +from ghidra.program.model.symbol.SourceType import * + +functionManager = currentProgram.getFunctionManager() + +file_location = askFile("Choose a file to save your Binana symbols ot", "Go") + +listing = currentProgram.getListing() + +decomp_interface = DecompInterface() +decomp_interface.openProgram(currentProgram) + +def get_function_type(func): + """Uses the Decompiler to get the refined signature.""" + if func is None: + return "" + + results = decomp_interface.decompileFunction(func, 30, ConsoleTaskMonitor()) + high_func = results.getHighFunction() + + if high_func is None: + return "" + + ret_type = high_func.getFunctionPrototype().getReturnType().getName().replace(" *", "*") + + call_conv = high_func.getFunctionPrototype().getModelName() + + params = [] + num_params = high_func.getFunctionPrototype().getNumParams() + for i in range(num_params): + p = high_func.getFunctionPrototype().getParam(i) + params.append("{} {}".format(p.getDataType().getName().replace(" *", "*"), p.getName())) + + param_str = "(" + (", ".join(params)) + ")" + return ret_type + " " + call_conv + " func" + param_str + +def get_symbol_entry_for_function(func): + name = func.getName() + + entry_addr = func.getEntryPoint().toString().upper()[-8:] + body = func.getBody() + end_addr = (body.getMaxAddress().add(1)).toString().upper()[-8:] + + func_type = get_function_type(func) + + if func_type == "": + output = "{} {} f end={}".format(name, entry_addr, end_addr) + else: + output = "{} {} f end={} type=\"{}\"".format( + name, + entry_addr, + end_addr, + func_type + ) + return output + +def export_function_symbols(file): + monitor.setMessage("Exporting function symbols...") + + for f in functionManager.getFunctionsNoStubs(1): + monitor.checkCanceled() # throws exception if canceled + + if f.isExternal() or f.isThunk(): + continue + + func_line = get_symbol_entry_for_function(f) + monitor.setMessage(func_line) + + file.write(func_line + "\n") + + return + +with open(file_location.absolutePath, "w") as file: + export_function_symbols(file) + file.close() diff --git a/ghidra/YankCurrentFunctionSymbol.py b/ghidra/YankCurrentFunctionSymbol.py new file mode 100644 index 0000000..d3aa8b2 --- /dev/null +++ b/ghidra/YankCurrentFunctionSymbol.py @@ -0,0 +1,75 @@ +#Copy the current function as a Binana symbol entry to your clipboard +# @runtime Jython +# @category Binana +# @author Thunderbrew +# @keybinding Shift-F +# @menupath +# @toolbar logo.png + +from ghidra.program.model.symbol import SymbolType +from java.awt import Toolkit +from java.awt.datatransfer import StringSelection +from ghidra.app.decompiler import DecompInterface +from ghidra.util.task import ConsoleTaskMonitor + +def yank_to_clipboard(text): + selection = StringSelection(text) + clipboard = Toolkit.getDefaultToolkit().getSystemClipboard() + clipboard.setContents(selection, None) + +def get_high_function_signature(func): + """Uses the Decompiler to get the refined signature.""" + if func is None: + return "" + + iface = DecompInterface() + iface.openProgram(currentProgram) + + results = iface.decompileFunction(func, 30, ConsoleTaskMonitor()) + high_func = results.getHighFunction() + + if high_func is None: + return + + ret_type = high_func.getFunctionPrototype().getReturnType().getName().replace(" *", "*") + + call_conv = high_func.getFunctionPrototype().getModelName() + + params = [] + num_params = high_func.getFunctionPrototype().getNumParams() + for i in range(num_params): + p = high_func.getFunctionPrototype().getParam(i) + params.append("{} {}".format(p.getDataType().getName().replace(" *", "*"), p.getName())) + + param_str = "(" + (", ".join(params)) + ")" + return ret_type + " " + call_conv + " func" + param_str + +def get_symbol_entry_for_function(func): + name = func.getName() + + entry_addr = func.getEntryPoint().toString().upper()[-8:] + body = func.getBody() + end_addr = (body.getMaxAddress().add(1)).toString().upper()[-8:] + + full_signature = get_high_function_signature(func) + + output = "{} {} f end={} type=\"{}\"".format( + name, + entry_addr, + end_addr, + full_signature + ) + return output + +def yank_current_function_symbol(): + listing = currentProgram.getListing() + func = listing.getFunctionContaining(currentAddress) + + if func is None: + print("No function found at the current cursor position.") + return + output = get_symbol_entry_for_function(func) + yank_to_clipboard(output) + print("Copied to clipboard: {}".format(output)) + +yank_current_function_symbol() diff --git a/ghidra/logo.png b/ghidra/logo.png new file mode 100755 index 0000000..5959088 Binary files /dev/null and b/ghidra/logo.png differ