Package ghidra.program.util

Class ProgramMemoryUtil

java.lang.Object
ghidra.program.util.ProgramMemoryUtil
public class ProgramMemoryUtil extends Object
ProgramMemoryUtil contains some static methods for checking Memory block data.

  • Constructor Details

    • ProgramMemoryUtil

      public ProgramMemoryUtil()

  • Method Details

    • copyBytesInRanges

      public static void copyBytesInRanges(Program toProgram, Program fromProgram, Address minAddr, Address maxAddr) throws MemoryAccessException
      Copies the bytes to one program from another for the specified address range.
      Parameters:
      toProgram - program that the bytes are copied to.
      fromProgram - program the bytes are copied from.
      minAddr - the minimum address of the range to be copied. This address should be derived from the toProgram.
      maxAddr - the maximum address of the range to be copied. This address should be derived from the toProgram.
      Throws:
      MemoryAccessException - if bytes can't be copied.

    • copyBytesInRanges

      public static void copyBytesInRanges(Program toProgram, Program fromProgram, AddressSetView addrSet, TaskMonitor monitor) throws MemoryAccessException, CancelledException
      Copies the bytes to one program from another for the specified set of address ranges.
      Parameters:
      toProgram - program that the bytes are copied to.
      fromProgram - program the bytes are copied from.
      addrSet - the set of address ranges to be copied. The addresses in this set are derived from the "to program".
      Throws:
      MemoryAccessException - if bytes can't be copied.
      CancelledException - if user cancels copy bytes via the monitor.

    • getMemBlocks

      public static MemoryBlock[] getMemBlocks(Program program, boolean withBytes)
      Gets the program memory blocks of the indicated type for the specified program.
      Parameters:
      program - the program whose memory blocks we want.
      withBytes - if true include blocks that have their own bytes. If false, include only blocks that don't have their own bytes (this includes bit and byte mapped blocks)
      Returns:
      an array of program memory blocks

    • getAddressSet

      public static AddressSetView getAddressSet(Program program)
      Gets the address set for the specified program.
      Parameters:
      program - the program whose address set we want.
      Returns:
      the address set

    • getAddressSet

      public static AddressSet getAddressSet(Program program, boolean blocksWithBytes)
      Gets a new address set indicating all addresses of the indicated memory type in the specified program.
      Parameters:
      program - the program whose address set we want.
      blocksWithBytes - if true, include memory blocks that have their own bytes.
      Returns:
      the memory's address set of the indicated type.

    • getOverlayAddresses

      public static AddressSet getOverlayAddresses(Program program)
      Gets an address set with the overlay addresses that are in the specified program.
      Parameters:
      program - the program
      Returns:
      the overlay addresses within the specified program.

    • loadDirectReferenceList

      public static void loadDirectReferenceList(Program program, int alignment, Address toAddress, AddressSetView toAddressSet, List<ghidra.app.plugin.core.analysis.ReferenceAddressPair> directReferenceList, TaskMonitor monitor) throws CancelledException
      Checks a programs memory for direct references to the addresses indicated in the toAddressSet. Direct references are only found at addresses that match the indicated alignment. Each direct reference is added to the directReferenceList as a from/to address pair.
      Parameters:
      program - the program whose memory is to be checked.
      alignment - direct references are to only be found at the indicated alignment in memory.
      toAddress - address that we are interested in finding references to.
      toAddressSet - address set indicating the addresses that we are interested in finding directly referred to in memory. Null if only interested in finding references to the toAddress.
      directReferenceList - the list to be populated with possible direct references
      monitor - a task monitor for progress or to allow cancelling.
      Throws:
      CancelledException - if the user cancels via the monitor.

    • loadDirectReferenceList

      public static void loadDirectReferenceList(Program program, int alignment, Address toAddress, AddressSetView toAddressSet, Accumulator<ghidra.app.plugin.core.analysis.ReferenceAddressPair> accumulator, TaskMonitor monitor) throws CancelledException
      Checks a programs memory for direct references to the addresses indicated in the toAddressSet. Direct references are only found at addresses that match the indicated alignment. Each direct reference is added to the directReferenceList as a from/to address pair.
      Parameters:
      program - the program whose memory is to be checked.
      alignment - direct references are to only be found at the indicated alignment in memory.
      toAddress - address that we are interested in finding references to.
      toAddressSet - address set indicating the addresses that we are interested in finding directly referred to in memory. Null if only interested in finding references to the toAddress.
      accumulator - the datastructure to be populated with possible direct references
      monitor - a task monitor for progress or to allow cancelling.
      Throws:
      CancelledException - if the user cancels via the monitor.

    • findDirectReferencesCodeUnit

      public static List<Address> findDirectReferencesCodeUnit(Program program, int alignment, CodeUnit codeUnit, TaskMonitor monitor)
      Checks a programs memory for direct references to the CodeUnit indicated. Direct references are only found at addresses that match the indicated alignment.
      Parameters:
      program - the program whose memory is to be checked.
      alignment - direct references are to only be found at the indicated alignment in memory.
      codeUnit - the code unit to to search for references to.
      monitor - a task monitor for progress or to allow canceling.
      Returns:
      list of addresses referring directly to the toAddress.

    • findDirectReferences

      public static Set<Address> findDirectReferences(Program program, int alignment, Address toAddress, TaskMonitor monitor) throws CancelledException
      Checks a programs memory for direct references to the address indicated. Direct references are only found at addresses that match the indicated alignment.
      Parameters:
      program - the program whose memory is to be checked.
      alignment - direct references are to only be found at the indicated alignment in memory.
      toAddress - address that we are interested in finding references to.
      monitor - a task monitor for progress or to allow canceling.
      Returns:
      list of addresses referring directly to the toAddress
      Throws:
      CancelledException - if the user cancels via the monitor.

    • findDirectReferences

      public static Set<Address> findDirectReferences(Program program, List<MemoryBlock> blocks, int alignment, Address toAddress, TaskMonitor monitor) throws CancelledException
      Checks a programs memory for direct references to the address indicated within the listed memory blocks. If null is passed for the list of memory blocks then all of the program's memory blocks will be checked.
      Direct references are only found at addresses that match the indicated alignment.
      Parameters:
      program - the program whose memory is to be checked.
      blocks - the only memory blocks to be checked. A null value indicates all memory blocks should be checked.
      alignment - direct references are to only be found at the indicated alignment in memory.
      toAddress - address that we are interested in finding references to.
      monitor - a task monitor for progress or to allow canceling.
      Returns:
      list of addresses referring directly to the toAddress
      Throws:
      CancelledException - if the user cancels via the monitor.

    • getDirectAddressBytes

      public static byte[] getDirectAddressBytes(Program program, Address toAddress)
      Get a representation of an address as it would appear in bytes in memory.
      Parameters:
      program - program
      toAddress - target address
      Returns:
      byte representation of toAddress

    • getShiftedDirectAddressBytes

      public static byte[] getShiftedDirectAddressBytes(Program program, Address toAddress)
      returns shifted address bytes if they are different than un-shifted
      Parameters:
      program - program
      toAddress - target address
      Returns:
      shifted bytes, null if same as un-shifted

    • getImageBaseOffsets32Bytes

      public static byte[] getImageBaseOffsets32Bytes(Program program, int alignment, Address toAddress)

    • findImageBaseOffsets32

      public static Set<Address> findImageBaseOffsets32(Program program, int alignment, Address toAddress, TaskMonitor monitor) throws CancelledException
      Checks a programs memory for 32 bit image base offset references to the address indicated. These relative references are only found at addresses that match the indicated alignment.
      Parameters:
      program - the program whose memory is to be checked.
      alignment - 32 bit image base offset relative references are to only be found at the indicated alignment in memory.
      toAddress - address that we are interested in finding references to.
      monitor - a task monitor for progress or to allow canceling.
      Returns:
      list of addresses with 32 bit image base offset relative references to the toAddress
      Throws:
      CancelledException - if the user cancels via the monitor.

    • findString

      public static List<Address> findString(String searchString, Program program, List<MemoryBlock> blocks, AddressSetView set, TaskMonitor monitor) throws CancelledException
      Finds the string in memory indicated by the searchString limited to the indicated memory blocks and address set.
      Parameters:
      searchString - the string to find
      program - the program to search
      blocks - the only blocks to search
      set - a set of the addresses to limit the results
      monitor - a task monitor to allow
      Returns:
      a list of addresses where the string was found
      Throws:
      CancelledException - if the user cancels

    • locateString

      public static void locateString(String searchString, TerminatingConsumer<Address> foundLocationConsumer, Program program, List<MemoryBlock> blocks, AddressSetView set, TaskMonitor monitor) throws CancelledException
      Finds the string in memory indicated by the searchString limited to the indicated memory blocks and address set. Each found location calls the foundLocationConsumer.consume(addr) method. If the search should terminate, (ie. enough results found), then terminateRequested() should return true. Requesting termination is different than a cancellation from the task monitor.
      Parameters:
      searchString - the string to find
      foundLocationConsumer - location consumer with consumer.accept(Address addr) routine defined
      program - the program to search
      blocks - the only blocks to search
      set - a set of the addresses to limit the results
      monitor - a task monitor to allow
      Throws:
      CancelledException - if the user cancels

    • getMemoryBlocksStartingWithName

      public static List<MemoryBlock> getMemoryBlocksStartingWithName(Program program, AddressSetView set, String name, TaskMonitor monitor) throws CancelledException
      Gets a list of memory blocks whose name starts with the indicated name. Only memory blocks that are initialized and part of the indicated address set will be returned.
      Parameters:
      program - the program for obtaining the memory blocks
      set - the address set to use to limit the blocks returned
      name - the text which the memory block's name must start with.
      monitor - a status monitor that allows the operation to be cancelled
      Returns:
      the list of memory blocks
      Throws:
      CancelledException - if the user cancels