Java Code Examples for ghidra.program.model.listing.Function#isThunk()

The following examples show how to use ghidra.program.model.listing.Function#isThunk() . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
Source File: FidProgramSeeker.java    From ghidra with Apache License 2.0 5 votes vote down vote up
public static ArrayList<Function> getChildren(Function function,boolean followThunks) {
		Program program = function.getProgram();
		FunctionManager functionManager = program.getFunctionManager();
		ReferenceManager referenceManager = program.getReferenceManager();
		HashSet<Address> alreadyDone = new HashSet<Address>();
		ArrayList<Function> funcList = new ArrayList<Function>();
		AddressIterator referenceIterator =
				referenceManager.getReferenceSourceIterator(function.getBody(), true);
		for (Address address : referenceIterator) {
//			monitor.checkCanceled();
			Reference[] referencesFrom = referenceManager.getReferencesFrom(address);
			for (Reference reference : referencesFrom) {
				Address toAddress = reference.getToAddress();
				if (reference.getReferenceType().isCall() && !alreadyDone.contains(toAddress)) {
					Function child = functionManager.getFunctionContaining(toAddress);
					if (child != null) {
						if (followThunks && child.isThunk()) {
							child = child.getThunkedFunction(true);
						}
						funcList.add(child);
						alreadyDone.add(toAddress);
					}
				}
			}
		}
		return funcList;
	}
 
Example 2
Source File: FunctionSignatureTableColumn.java    From ghidra with Apache License 2.0 5 votes vote down vote up
private void thunk(Function function, Settings settings, StringBuilder buffy) {
	if (!function.isThunk()) {
		return;
	}

	boolean showThunk = THUNK.getValue(settings);
	if (!showThunk) {
		return;
	}

	buffy.append("thunk ");
}
 
Example 3
Source File: NXProgramBuilder.java    From Ghidra-Switch-Loader with ISC License 4 votes vote down vote up
private void evaluateElfSymbol(ElfSymbol elfSymbol, Address address, boolean isFakeExternal)
{
    try
    {
        if (elfSymbol.isSection()) {
            // Do not add section symbols to program symbol table
            return;
        }

        String name = elfSymbol.getNameAsString();
        if (name == null || name.isEmpty()) {
            return;
        }

        boolean isPrimary = (elfSymbol.getType() == ElfSymbol.STT_FUNC) ||
            (elfSymbol.getType() == ElfSymbol.STT_OBJECT) || (elfSymbol.getSize() != 0);
        // don't displace existing primary unless symbol is a function or object symbol
        if (name.contains("@")) {
            isPrimary = false; // do not make version symbol primary
        }
        else if (!isPrimary && (elfSymbol.isGlobal() || elfSymbol.isWeak())) {
            Symbol existingSym = program.getSymbolTable().getPrimarySymbol(address);
            isPrimary = (existingSym == null);
        }

        this.createSymbol(address, name, isPrimary, elfSymbol.isAbsolute(), null);

        // NOTE: treat weak symbols as global so that other programs may link to them.
        // In the future, we may want additional symbol flags to denote the distinction
        if ((elfSymbol.isGlobal() || elfSymbol.isWeak()) && !isFakeExternal) 
        {
            program.getSymbolTable().addExternalEntryPoint(address);
        }
        
        if (elfSymbol.getType() == ElfSymbol.STT_FUNC) 
        {
            Function existingFunction = program.getFunctionManager().getFunctionAt(address);
            if (existingFunction == null) {
                Function f = createOneByteFunction(null, address, false);
                if (f != null) {
                    if (isFakeExternal && !f.isThunk()) {
                        ExternalLocation extLoc = program.getExternalManager().addExtFunction(Library.UNKNOWN, name, null, SourceType.IMPORTED);
                        f.setThunkedFunction(extLoc.getFunction());
                        // revert thunk function symbol to default source
                        Symbol s = f.getSymbol();
                        if (s.getSource() != SourceType.DEFAULT) {
                            program.getSymbolTable().removeSymbolSpecial(f.getSymbol());
                        }
                    }
                }
            }
        }
    }
    catch (DuplicateNameException | InvalidInputException e)
    {
        e.printStackTrace();
    }
}
 
Example 4
Source File: DumpFunctionPatternInfoScript.java    From ghidra with Apache License 2.0 4 votes vote down vote up
@Override
protected void run() throws Exception {
	if (!isRunningHeadless()) {
		totalFuncs = 0;
		programsAnalyzed = 0;
	}

	int numFirstBytes = askInt("Number of first bytes", "bytes");
	int numFirstInstructions = askInt("Number of first instructions", "instructions");
	int numPreBytes = askInt("Number of pre bytes", "bytes");
	int numPreInstructions = askInt("Number of pre instructions", "instructions");
	int numReturnBytes = askInt("Number of return bytes", "bytes");
	int numReturnInstructions = askInt("Number of return instructions", "instructions");
	String saveDirName = askString("Directory to save results", "directory");
	String contextRegsCSV = askString("Context register csv", "csv");

	File saveDir = new File(saveDirName);
	if (!saveDir.isDirectory()) {
		Msg.info(this, "Invalid save directory: " + saveDirName);
		return;
	}

	List<String> contextRegisters = DataGatheringParams.getContextRegisterList(contextRegsCSV);

	programsAnalyzed++;
	if (currentProgram == null) {
		Msg.info(this, "null current program: try again with the -process option");
		return;
	}

	if (currentProgram.getFunctionManager().getFunctionCount() == 0) {
		Msg.info(this, "No functions found in " + currentProgram.getName() + ", skipping.");
		return;
	}

	FunctionIterator fIter = currentProgram.getFunctionManager().getFunctions(true);
	DataGatheringParams params = new DataGatheringParams();
	params.setNumPreBytes(numPreBytes);
	params.setNumFirstBytes(numFirstBytes);
	params.setNumReturnBytes(numReturnBytes);
	params.setNumPreInstructions(numPreInstructions);
	params.setNumFirstInstructions(numFirstInstructions);
	params.setNumReturnInstructions(numReturnInstructions);
	params.setContextRegisters(contextRegisters);

	FileBitPatternInfo funcPatternList = new FileBitPatternInfo();
	funcPatternList.setLanguageID(currentProgram.getLanguageID().getIdAsString());
	funcPatternList.setGhidraURL("TODO: url");
	funcPatternList.setNumPreBytes(numPreBytes);
	funcPatternList.setNumPreInstructions(numPreInstructions);
	funcPatternList.setNumFirstBytes(numFirstBytes);
	funcPatternList.setNumFirstInstructions(numFirstInstructions);
	funcPatternList.setNumReturnBytes(numReturnBytes);
	funcPatternList.setNumReturnInstructions(numReturnInstructions);

	AddressSetView initialized = currentProgram.getMemory().getLoadedAndInitializedAddressSet();
	while (fIter.hasNext()) {
		monitor.checkCanceled();
		Function func = fIter.next();
		if (func.isThunk()) {
			continue;
		}
		if (func.isExternal()) {
			continue;
		}
		if (!initialized.contains(func.getEntryPoint())) {
			continue;
		}
		if (currentProgram.getListing().getInstructionAt(func.getEntryPoint()) == null) {
			continue;
		}

		FunctionBitPatternInfo fStart =
			new FunctionBitPatternInfo(currentProgram, func, params);
		if (fStart.getFirstBytes() != null) {
			funcPatternList.getFuncBitPatternInfo().add(fStart);
			totalFuncs++;
		}
	}

	File savedFile = new File(saveDir.getAbsolutePath() + File.separator +
		currentProgram.getDomainFile().getPathname().replaceAll("/", "_") + "_" +
		currentProgram.getExecutableMD5() + "_funcInfo.xml");
	funcPatternList.toXmlFile(savedFile);
	Msg.info(this,
		"Programs analyzed: " + programsAnalyzed + "; total functions: " + totalFuncs);
}
 
Example 5
Source File: EditFunctionSignatureDialog.java    From ghidra with Apache License 2.0 2 votes vote down vote up
/**
 * Get the effective function to which changes will be made.  This
 * will be the same as function unless it is a thunk in which case
 * the returned function will be the ultimate non-thunk function.
 * @param f
 * @return non-thunk function
 */
protected Function getAffectiveFunction(Function f) {
	return f.isThunk() ? f.getThunkedFunction(true) : f;
}