Skip to content

Instantly share code, notes, and snippets.

@b2ag
Last active April 28, 2023 22:47
Show Gist options
  • Save b2ag/1eb9cafb0e269165191339fc9395b5e0 to your computer and use it in GitHub Desktop.
Save b2ag/1eb9cafb0e269165191339fc9395b5e0 to your computer and use it in GitHub Desktop.
Ghidra import_memory_map_from_other_program (assumes tool as program loaded and another program named 'FragmentBundle_F.prx' exists)
def import_memory_map_from_other_program( program2_name ):
program2_file = state.getProject().getProjectData().getRootFolder().getFile(program2_name)
program2 = program2_file.getImmutableDomainObject(currentProgram,ghidra.framework.model.DomainFile.DEFAULT_VERSION,monitor)
try:
# process each memory block from program2
for memblock in program2.getMemory().getBlocks():
#memblock = program2.getMemory().getBlocks()[0]
if memblock.isOverlay() or not memblock.isInitialized():
print('Memblock "{}" of "{}" is overlay or not initialized. Skipping.'.format(memblock.getName(),program2_name))
continue
membock_file_offset = program2.getMemory().getAddressSourceInfo( memblock.getStart() ).getFileOffset()
memblock_filename = program2.getMemory().getAddressSourceInfo( memblock.getStart() ).getFileName()
print('Processing memory block "{}" of "{}" with start "0x{}", end "0x{}" and file offset "0x{:x}".'.format(memblock.getName(),program2_name,memblock.getStart(),memblock.getEnd(),membock_file_offset))
if currentProgram.getMemory().getAddressSourceInfo( memblock.getStart() ) or currentProgram.getMemory().getAddressSourceInfo( memblock.getEnd() ):
print('Memblock "{}" of "{}" collides with memory in current program. Skipping.'.format(memblock.getName(),program2_name))
#newmemblock = currentProgram.getMemory().getAddressSourceInfo( memblock.getStart() ).getMemoryBlockSourceInfo().getMemoryBlock()
continue
# check if filebytes mapping already exists for memblock_filename
filebytes = [ x for x in currentProgram.getMemory().getAllFileBytes() if x.getFilename() == memblock_filename ]
if filebytes:
filebytes = filebytes[0]
else:
try:
newfileinputstream = java.io.FileInputStream( memblock_filename )
except java.io.FileNotFoundException as error:
# couldn't open memblock_filename, so try with program2.getExecutablePath()
if program2.getExecutablePath().endswith( memblock_filename ):
newfileinputstream = java.io.FileInputStream( program2.getExecutablePath() )
else:
raise error
badly_guessed_file_size = newfileinputstream.available()
#FileBytes createFileBytes​(java.lang.String filename, long offset, long size, java.io.InputStream is, TaskMonitor monitor)
filebytes = currentProgram.getMemory().createFileBytes( memblock_filename, 0, badly_guessed_file_size, newfileinputstream, monitor )
#createInitializedBlock​(java.lang.String name, Address start, filebytes, long offset, long size, boolean overlay)
try:
newmemblock = currentProgram.getMemory().createInitializedBlock( memblock.getName(), memblock.getStart(), filebytes, membock_file_offset, memblock.getSize(), False )
except java.lang.IndexOutOfBoundsException:
# badly workaround section extending past file bounds
newmemblock = currentProgram.getMemory().createInitializedBlock( memblock.getName(), memblock.getStart(), filebytes, membock_file_offset, filebytes.getSize() - membock_file_offset, False )
newmemblock.setPermissions( memblock.isRead(), memblock.isWrite(), memblock.isExecute() )
if memblock.getName():
newmemblock.setName( '{}: {}'.format( memblock_filename, memblock.getName() ) )
if memblock.getSourceName():
newmemblock.setSourceName( '{}: {}'.format( memblock_filename, memblock.getSourceName() ) )
else:
newmemblock.setSourceName( memblock_filename )
if memblock.getComment():
newmemblock.setComment( '{}: {}'.format( memblock_filename, memblock.getComment() ) )
finally:
# cleanup
program2.release(currentProgram)
import_memory_map_from_other_program( "FragmentBundle_F.prx" )
import_memory_map_from_other_program( "libkernel.prx" )
import_memory_map_from_other_program( "libSceVideoOut.prx" )
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment