Java Code Examples for ghidra.program.model.address.Address#subtract()

@Override
		public Long getValue(VTMarkupItem markupItem, Settings settings, Program program,
				ServiceProvider serviceProvider) throws IllegalArgumentException {

			Address sourceAddress = markupItem.getSourceAddress();
			Address destinationAddress = markupItem.getDestinationAddress();
			if (destinationAddress == null || destinationAddress == Address.NO_ADDRESS) {
				return null;
			}

//			VTMarkupType markupType = markupItem.getMarkupType();
//			if ((markupType instanceof FunctionParameterMarkupType) ||
//				(markupType instanceof FunctionLocalVariableMarkupType)) {
//				return Long.valueOf(0);
//			}

			VTAssociation association = markupItem.getAssociation();
			Address sourceMatchAddress = association.getSourceAddress();
			Address destinationMatchAddress = association.getDestinationAddress();

			long relativeSourceOffset = sourceAddress.subtract(sourceMatchAddress);
			long relativeDestinationOffset = destinationAddress.subtract(destinationMatchAddress);
			return relativeDestinationOffset - relativeSourceOffset;

		}
 

private boolean handleGenerically32(Program program, Relocation relocation,
		Address oldImageBase, Address newImageBase) throws MemoryAccessException,
		CodeUnitInsertionException {

	long diff = newImageBase.subtract(oldImageBase);

	Address address = relocation.getAddress();
	Memory memory = program.getMemory();
	long value = memory.getInt(address) & 0xffffffff;
	int newValue = (int) (value + diff);
	Address candiateRelocationValue = newImageBase.getNewAddress(newValue);
	if (hasMatchingReference(program, address, candiateRelocationValue)) {
		return process32BitRelocation(program, relocation, oldImageBase, newImageBase);
	}
	return false;
}
 

/**
 * If necessary, create an external block to hold external symbols for this file 
 * @param program is the program representing the file
 * @param log for error messages
 * @param externalAddress is the address of the first byte of the external block
 * @param externalAddressStart is the address of the last byte (+1)
 */
private void createExternalBlock(Program program, MessageLog log, Address externalAddress,
		Address externalAddressStart) {
	//create an artificial block for the external symbols
	if (!externalAddressStart.equals(externalAddress)) {
		long size = externalAddress.subtract(externalAddressStart);
		try {
			MemoryBlock block = program.getMemory().createUninitializedBlock("EXTERNAL",
				externalAddressStart, size, false);

			// assume any value in external is writable.
			block.setWrite(true);

			Address current = externalAddressStart;
			while (current.compareTo(externalAddress) < 0) {
				createUndefined(program.getListing(), program.getMemory(), current,
					externalAddress.getAddressSpace().getPointerSize());
				current = current.add(externalAddress.getAddressSpace().getPointerSize());
			}
		}
		catch (Exception e) {
			log.appendMsg("Error creating external memory block: " + " - " + e.getMessage());
		}
	}
}
 

private void updateMatch(FoundString existingString, FoundString newString) {
	Address existingAddr = existingString.getAddress();
	Address newAddr = newString.getAddress();

	if (existingAddr.equals(newAddr) && existingString.getLength() <= newString.getLength()) {
		existingString.setDefinedState(DefinedState.DEFINED);
		return;
	}

	Address existingEndAddr = existingString.getEndAddress();
	Address newEndAddr = newString.getEndAddress();

	Address minAddress = getMinAddress(existingAddr, newAddr);
	Address maxAddress = getMaxAddress(existingEndAddr, newEndAddr);
	length = (int) maxAddress.subtract(minAddress) + 1;

	existingString.setAddress(minAddress);
	existingString.setLength(length);
	existingString.setDefinedState(DefinedState.PARTIALLY_DEFINED);
}
 

@Test
public void testFindAndApplyMarkupItem_AddAsPrimary_SingleSourceLabel_WithSingleExistingDuplicateLabels()
		throws Exception {
	Address labelAddress = addr("0x01002d06", sourceProgram);

	Symbol sourceSymbol1 = addLabel(labelAddress, sourceProgram);

	Symbol[] sourceSymbols = new Symbol[1];
	sourceSymbols[0] = sourceSymbol1;

	// put label with duplicate name at address other than applied address
	Address someOtherAddress = labelAddress.subtract(1);
	addLabel(sourceSymbol1.getName(), someOtherAddress, destinationProgram);
	Symbol destinationSymbol1 = addLabel(labelAddress, destinationProgram);
	Symbol[] destinationSymbols = new Symbol[] { destinationSymbol1 };

	Symbol[] expectedSymbols = null;

	LabelValidator validator =
		new LabelValidator("0x01002cf5", "0x01002cf5", labelAddress, sourceSymbols,
			destinationSymbols, expectedSymbols, LabelChoices.ADD_AS_PRIMARY, sourceSymbols[0]);
	doTestFindAndApplyMarkupItem_ApplyFails(validator);
}
 

private static boolean hasRelocation(Mask mask,Address minAddress,Address maxAddress,RelocationTable relocationTable) {
	byte[] bytes = mask.getBytes();
	for (byte b : bytes) {
		if (b != 0) {
			break;
		}
		minAddress = minAddress.addWrap(1);
	}
	for (int jj = bytes.length - 1; jj >= 0; --jj) {
		if (bytes[jj] != 0) {
			break;
		}
		maxAddress = maxAddress.subtract(1);
	}
	if (minAddress.compareTo(maxAddress) <= 0) {
		AddressSet range = new AddressSet(minAddress, maxAddress);
		Iterator<Relocation> relocations = relocationTable.getRelocations(range);
		if (relocations.hasNext()) {
			return true;
		}
	}
	return false;
}
 

private byte[] getBytesAgainstFlow(int numBytes, Memory memory, Address start) {
	MemoryBlock currentBlock = memory.getBlock(start);

	if (currentBlock == null) {
		return null;  //there are no bytes immediately before the function
	}

	byte[] bytes = new byte[numBytes];
	Address pre = start.subtract(numBytes - 1);
	//don't want to extend into another section
	MemoryBlock preBlock = memory.getBlock(pre);
	if ((preBlock == null) || (currentBlock.compareTo(preBlock) != 0)) {
		bytes = null;
	}
	else {
		try {
			memory.getBytes(pre, bytes);
		}
		catch (MemoryAccessException e) {
			Msg.info(this, "MemoryAccessException for address" + pre.toString());
			bytes = null;
		}
	}
	return bytes;
}
 

private int subtract(Address bigAddress, Address smallAddress) {
	if (bigAddress.getAddressSpace() != smallAddress.getAddressSpace()) {
		return Integer.MAX_VALUE;
	}
	long diff = bigAddress.subtract(smallAddress);
	if (diff > Integer.MAX_VALUE) {
		return Integer.MAX_VALUE;
	}
	return (int) diff;
}
 

private String[] getFlexArrayComment(Data data, Address addr) {

		int levelsToIgnore = 0;
		String label = null;

		int[] cpath = data.getComponentPath();
		if (cpath != null && cpath.length > 0) {
			// check previous sibling data within composite
			if (cpath[cpath.length - 1] <= 0) {
				return null; // case not handled
			}
			data = data.getParent().getComponent(cpath[cpath.length - 1] - 1);
			if (data == null || !data.isStructure()) {
				return null;
			}
			levelsToIgnore = cpath.length - 1;
		}
		else {
			Program p = data.getProgram();
			data = p.getListing().getDefinedDataContaining(addr);
			if (data == null || !data.isStructure()) {
				return null;
			}
			Symbol s = p.getSymbolTable().getPrimarySymbol(data.getAddress());
			label = s != null ? s.getName(true) : data.getDataType().getName();
		}

		// locate deepest structure containing addr which will be checked for flex array
		while (true) {
			int offset = (int) addr.subtract(data.getMinAddress());
			Data component = data.getComponentAt(offset);
			if (component == null || !component.isStructure()) {
				break;
			}
			data = component;
		}

		return buildFlexArrayComment(data, levelsToIgnore, label);
	}
 

private Color getHighlightColor(Address highlightStart, int highlightLength) {
	ProgramLocation location = navigatable != null ? navigatable.getLocation() : null;
	if (location instanceof BytesFieldLocation) {
		BytesFieldLocation byteLoc = (BytesFieldLocation) location;
		Address byteAddress = byteLoc.getAddressForByte();
		long diff = byteAddress.subtract(highlightStart);
		if (diff >= 0 && diff < highlightLength) {
			return activeHighlightColor;
		}
	}
	return defaultHighlightColor;
}
 

private Varnode expandVarnode(Varnode varnode, int sizeIncrease, VariableStorage curStorage,
		int newSize, DataType type) throws InvalidInputException {

	Address addr = varnode.getAddress();
	if (addr.isStackAddress()) {
		return resizeStackVarnode(varnode, varnode.getSize() + sizeIncrease, curStorage,
			newSize, type);
	}
	int size = varnode.getSize() + sizeIncrease;
	boolean bigEndian = program.getMemory().isBigEndian();
	Register reg = program.getRegister(varnode);
	Address vnAddr = varnode.getAddress();
	if (reg != null) {
		// Register expansion
		Register newReg = reg;
		while ((newReg.getMinimumByteSize() < size)) {
			newReg = newReg.getParentRegister();
			if (newReg == null) {
				throw new InvalidInputException("Current storage can't be expanded to " +
					newSize + " bytes: " + curStorage.toString());
			}
		}
		if (bigEndian) {
			vnAddr = vnAddr.add(newReg.getMinimumByteSize() - size);
			return new Varnode(vnAddr, size);
		}
	}
	boolean complexDt = (type instanceof Composite) || (type instanceof Array);
	if (bigEndian && !complexDt) {
		return new Varnode(vnAddr.subtract(sizeIncrease), size);
	}
	return new Varnode(vnAddr, size);
}
 

private static Varnode expandVarnode(Varnode varnode, int sizeIncrease,
		VariableStorage curStorage, int newSize, DataType dataType, boolean alignStack,
		Function function) throws InvalidInputException {

	Address addr = varnode.getAddress();
	if (addr.isStackAddress()) {
		return resizeStackVarnode(varnode, varnode.getSize() + sizeIncrease, curStorage,
			newSize, dataType, alignStack, function);
	}
	int size = varnode.getSize() + sizeIncrease;
	boolean bigEndian = function.getProgram().getMemory().isBigEndian();
	Register reg = function.getProgram().getRegister(varnode);
	Address vnAddr = varnode.getAddress();
	if (reg != null) {
		// Register expansion
		Register newReg = reg;
		while ((newReg.getMinimumByteSize() < size)) {
			newReg = newReg.getParentRegister();
			if (newReg == null) {
				throw new InvalidInputException("Storage can't be expanded to " + newSize +
					" bytes: " + curStorage.toString());
			}
		}
		
		vnAddr = newReg.getAddress();
		if (bigEndian) {
			vnAddr = vnAddr.add(newReg.getMinimumByteSize() - size);
			return new Varnode(vnAddr, size);
		}
	}
	boolean complexDt = (dataType instanceof Composite) || (dataType instanceof Array);
	if (bigEndian && !complexDt) {
		return new Varnode(vnAddr.subtract(sizeIncrease), size);
	}
	return new Varnode(vnAddr, size);
}
 

/**
 * Perform a best guess at the length of an address table assuming that 
 * another label (or end of block) can be used to identify the end.
 * @param program the program
 * @param address start of address table
 * @return maximum length of table or -1 if address does not reside 
 * within an initialized memory block
 */
private static int guessTableLength(Program program, Address address) {
	MemoryBlock block = program.getMemory().getBlock(address);
	if (block == null || !block.isInitialized()) {
		return -1;
	}
	Address endAddr = block.getEnd();
	Symbol nextsym = findNextImportedSymbol(program, address);
	if (nextsym != null && nextsym.getAddress().compareTo(endAddr) < 0) {
		endAddr = nextsym.getAddress();
	}
	return (int) endAddr.subtract(address);
}
 

@Test
public void testFindAndApplyMarkupItem_Add_MultipleSourceLabel_WithSingleExistingDuplicateLabel()
		throws Exception {
	Address labelAddress = addr("0x01002d06", sourceProgram);

	Symbol sourceSymbol1 = addLabel(labelAddress, sourceProgram);
	Symbol sourceSymbol2 = addLabel(labelAddress, sourceProgram);
	Symbol sourceSymbol3 = addLabel(labelAddress, sourceProgram);

	Symbol[] sourceSymbols = new Symbol[3];
	sourceSymbols[0] = sourceSymbol1;
	sourceSymbols[1] = sourceSymbol2;
	sourceSymbols[2] = sourceSymbol3;

	// put label with duplicate name at address other than applied address
	Address someOtherAddress = labelAddress.subtract(1);
	addLabel(sourceSymbol3.getName(), someOtherAddress, destinationProgram);
	Symbol destinationSymbol1 = addLabel(labelAddress, destinationProgram);
	Symbol[] destinationSymbols = new Symbol[] { destinationSymbol1 };

	Symbol[] expectedSymbols = sourceSymbols;

	LabelValidator validator =
		new LabelValidator("0x01002cf5", "0x01002cf5", labelAddress, sourceSymbols,
			destinationSymbols, expectedSymbols, LabelChoices.ADD, destinationSymbols[0]);
	doTestFindAndApplyMarkupItem_ApplyFails(validator);
}
 

/**
 * Updates the blob at the given address with the new blob.
 * 
 * @param updatedBlob The updated blob.
 * @param addr The address of the blob to update.
 * @param program The program that will get the update.
 */
public boolean updateBlob(CliBlob updatedBlob, Address addr, Program program) {

	// Get and validate the containing structure at the given address
	Data containingData = program.getListing().getDefinedDataContaining(addr);
	if (containingData == null || !containingData.isStructure()) {
		Msg.error(this, "Containing data of " + updatedBlob.getName() + " at address " + addr +
			" is not a structure.");
		return false;
	}
	Structure containingStructure = (Structure) containingData.getDataType();

	// Make sure there is an old blob at the given address
	int structureOffset = (int) addr.subtract(containingData.getAddress());
	DataTypeComponent oldBlobDataComponent = containingStructure.getComponentAt(structureOffset);
	if (oldBlobDataComponent == null) {
		Msg.error(this, "Existing blob at address " + addr + " was not found.");
		return false;
	}
	
	// Make sure the old blob has the same size as the new blob
	DataType oldBlobDataType = oldBlobDataComponent.getDataType();
	DataType newBlobDataType = updatedBlob.toDataType();
	if (oldBlobDataType.getLength() != newBlobDataType.getLength()) {
		Msg.error(this, "Cannot replace existing blob at address " + addr + " with " +
			updatedBlob.getName() + " because they have different sizes.");
		return false;
	}

	// Update the blob
	containingStructure.replaceAtOffset(structureOffset, newBlobDataType, updatedBlob.getSize(),
		updatedBlob.getName(), updatedBlob.getContentsComment());

	return true;
}
 

private Address getChunkStartAddress(MemoryBlock block, Address address) {
	long offset = address.subtract(block.getStart());
	long chunk = offset / chunkSize;
	return block.getStart().add(chunk * chunkSize);
}
 

@Override
	public void run() throws Exception {
		listing = currentProgram.getListing();
		symbolTable = currentProgram.getSymbolTable();

		// Find .toc symbol
		Symbol toc = SymbolUtilities.getExpectedLabelOrFunctionSymbol(currentProgram, ".toc",
			err -> Msg.error(this, err));
		if (toc == null) {
			return;
		}
		Address tocAddress = toc.getAddress();

		// Get direct refs to .toc
		monitor.setMessage("Finding references to .toc");
		FindReferencesTableModel refs =
			new FindReferencesTableModel(tocAddress, state.getTool(), currentProgram);
		while (refs.isBusy()) {
			if (monitor.isCancelled()) {
				break;
			}
		}

		// Loop through refs to find functions
		for (int i = 0; i < refs.getRowCount(); ++i) {
			monitor.setMessage("Finding functions");
			if (monitor.isCancelled()) {
				break;
			}

			// Make them pointers to .toc
			Address refAddr = refs.getAddress(i);
			listing.clearCodeUnits(refAddr, refAddr, false);
			listing.createData(refAddr, new PointerDataType());

			// Make previous code unit (addr-addrSize) a pointer
			Address codeAddr = refAddr.subtract(addrSize);
			listing.clearCodeUnits(codeAddr, codeAddr, false);
			CreateDataCmd cmd = new CreateDataCmd(codeAddr, new PointerDataType());
			cmd.applyTo(currentProgram);
// 	 		listing.createData(codeAddr, new PointerDataType());

			currentProgram.flushEvents();
		}

		popup("Script complete.\n\nNote:  Auto analyzer may still be running.\n" +
			"(Depending on the size of the binary, analysis may take a while...see Ghidra's progress bar.)");

	}
 

/**
 * Clear the internal parts of a structure
 */
private boolean clearStructure(Program program, ProgramLocation start, ProgramLocation end) {
	// get data at start
	boolean commit = false;
	int id = program.startTransaction("Clear Structure");
	try {
		Address dataAddr = start.getByteAddress();
		Data data = program.getListing().getDefinedDataContaining(dataAddr);
		if (data == null) {
			return false;
		}

		// get the structure to clear, make sure it is a structure
		Data compData = data.getComponent(start.getComponentPath());
		if (compData == null) {
			return false;
		}

		DataType dataType = compData.getParent().getBaseDataType();
		if (!(dataType instanceof Composite)) {
			return false;
		}

		// don't allow clearing the last component from a union
		if (dataType instanceof Union && ((Composite) dataType).getNumComponents() <= 1) {
			return false;
		}

		// get the start offset into the data structure
		int index = compData.getComponentIndex();
		if (dataType instanceof Union) {
			((Union) dataType).delete(index);
		}
		else {
			// now clear it
			Address startAddress = start.getByteAddress();
			Address endAddress = (end != null) ? end.getByteAddress() : startAddress;
			Data parent = compData.getParent();
			Address parentAddress = parent.getAddress();
			int startOffset = (int) startAddress.subtract(parentAddress);
			int endOffset = (int) endAddress.subtract(parentAddress);
			Structure structure = (Structure) dataType;
			int startOrdinal = getOrdinalAtOrBefore(structure, startOffset);
			int endOrdinal = getOrdinalAtOrBefore(structure, endOffset);
			for (int ordinal = endOrdinal; ordinal >= 0 && ordinal >= startOrdinal; ordinal--) {
				structure.clearComponent(ordinal);
			}
		}
		commit = true;
	}
	catch (Exception e) {
		e.printStackTrace();
	}
	finally {
		program.endTransaction(id, commit);
	}
	return commit;
}
 

private Address findFrag(Address a) throws Exception {
	// looking for something like this:
	//    01e328e4   r3 80 00 20   blr           // end of prev func
	//    01e328e8   94            ??       94h
	//    01e328e9   21            ??       21h
	//    01e328ea   ff            ??       FFh
	//    01e328eb   e0            ??       E0h
	//    01e328ec   2c            ??       2Ch
	//    01e328ed   03            ??       03h
	//    01e328ee   00            ??       00h
	//    01e328ef   00            ??       00h
	//                  undefined FUN_01e328f0   // <-- Address a
	//    01e328f0   7c 08 02 a6   mfspr    r0,LR
	//    01e328f4   39 80 00 31   li       r12,0x31
	//    ...
	//
	// if there are 1-6 undefined instructions before Address a and
	// a "b" or "blr" instruction before that, then return the address
	// of the dword following the "b" or "blr" instruction -- else
	// return null

	Memory mem = currentProgram.getMemory();

	// save start address before we start scanning backward
	Address sa = a;
	Listing listing = currentProgram.getListing();

	// memory bounds checking is hard-coded -- yes...bad
	// try to find up to 6 undefined instructions before start address
	while (a.getOffset() > 0x1800000 && sa.getOffset() - a.getOffset() < 24 &&
		listing.isUndefined(a.subtract(4), a.subtract(1)) && isInstruction(a.subtract(4))) {
		if (monitor.isCancelled())
			return (null);
		a = a.subtract(4);
	}

	// if the dword we are pointing to isn't undefined, we didn't find frag
	if (!listing.isUndefined(a, a.add(3)))
		return (null);

	// if we didn't find an instruction, then we didn't find a frag
	if (listing.getInstructionAt(a.subtract(4)) == null)
		return (null);

	// if instruction isn't a "b" and isn't a "blr", we didn't find a frag
	int val = mem.getInt(a.subtract(4));
	if ((val & 0xfc000000) != 0x48000000 && val != 0x4e800020)
		return (null);

	// at this point, assume that we found a frag, starting at a
	return (a);
}
 

private Address findHead(Address a) throws Exception {
	// looking for something like this:
	//                  undefined FUN_01e328e8
	//    01e328e8   94 21 ff e0   stwu     r1,-0x20(r1)
	//    01e328ec   2c 03 00 00   cmpwi    r3,0x0
	//                  undefined FUN_01e328f0   // <-- Address a
	//    01e328f0   7c 08 02 a6   mfspr    r0,LR
	//    01e328f4   39 80 00 31   li       r12,0x31
	//    ...
	// if there are 1-6 defined instructions before Address a, none
	// of them are "b" or "blr", and the first one is defined as the
	// start of a function, then return the address defined as the
	// start of a function -- else return null

	Memory mem = currentProgram.getMemory();

	// save start address before we start scanning backward
	Address sa = a;
	Listing listing = currentProgram.getListing();

	// memory bounds checking is hard-coded -- yes...bad
	// try to find up to 6 instructions before start address that don't
	// include "b" or "blr" and start with instruction defined as start
	// of function
	int val = mem.getInt(a.subtract(4));
	while (a.getOffset() > 0x1800000 && sa.getOffset() - a.getOffset() < 24 &&
		listing.getInstructionAt(a.subtract(4)) != null &&
		((val & 0xfc000000) != 0x48000000 && val != 0x4e800020) &&
		listing.getFunctionAt(a.subtract(4)) == null) {
		if (monitor.isCancelled())
			return (null);
		a = a.subtract(4);
		val = mem.getInt(a.subtract(4));
	}

	// if we found a "b" or "blr", we didn't find a function header
	if ((val & 0xfc000000) == 0x48000000 || val == 0x4e800020)
		return (null);

	// if the instruction before the one we are pointing to isn't
	// a function entry point, we didn't find a function header
	if (listing.getFunctionAt(a.subtract(4)) == null)
		return (null);

	// at this point, assume that we found a function header, starting at a-4
	return (a.subtract(4));
}