Package ghidra.program.util

Class ProgramMemoryUtil

  • public class ProgramMemoryUtil
extends java.lang.Object
    ProgramMemoryUtil contains some static methods for checking Memory block data.

    • Constructor Detail

      • ProgramMemoryUtil

        public ProgramMemoryUtil()

    • Method Detail

      • copyBytesInRanges

        public static void copyBytesInRanges​(Program toProgram,
                                     Program fromProgram,
                                     Address minAddr,
                                     Address maxAddr)
                              throws MemoryAccessException
        Copies the bytes to one program from another for the specified address range.
        Parameters:
        toProgram - program that the bytes are copied to.
        fromProgram - program the bytes are copied from.
        minAddr - the minimum address of the range to be copied. This address should be derived from the toProgram.
        maxAddr - the maximum address of the range to be copied. This address should be derived from the toProgram.
        Throws:
        MemoryAccessException - if bytes can't be copied.

      • copyBytesInRanges

        public static void copyBytesInRanges​(Program toProgram,
                                     Program fromProgram,
                                     AddressSetView addrSet,
                                     TaskMonitor monitor)
                              throws MemoryAccessException,
                                     CancelledException
        Copies the bytes to one program from another for the specified set of address ranges.
        Parameters:
        toProgram - program that the bytes are copied to.
        fromProgram - program the bytes are copied from.
        addrSet - the set of address ranges to be copied. The addresses in this set are derived from the "to program".
        Throws:
        MemoryAccessException - if bytes can't be copied.
        CancelledException - if user cancels copy bytes via the monitor.

      • getMemBlocks

        public static MemoryBlock[] getMemBlocks​(Program program,
                                         boolean withBytes)
        Gets the program memory blocks of the indicated type for the specified program.
        Parameters:
        program - the program whose memory blocks we want.
        withBytes - if true include blocks that have their own bytes. If false, include only blocks that don't have their own bytes (this includes bit and byte mapped blocks)
        Returns:
        an array of program memory blocks

      • getAddressSet

        public static AddressSetView getAddressSet​(Program program)
        Gets the address set for the specified program.
        Parameters:
        program - the program whose address set we want.
        Returns:
        the address set

      • getAddressSet

        public static AddressSet getAddressSet​(Program program,
                                       boolean blocksWithBytes)
        Gets a new address set indicating all addresses of the indicated memory type in the specified program.
        Parameters:
        program - the program whose address set we want.
        blocksWithBytes - if true, include memory blocks that have their own bytes.
        Returns:
        the memory's address set of the indicated type.

      • getOverlayAddresses

        public static AddressSet getOverlayAddresses​(Program program)
        Gets an address set with the overlay addresses that are in the specified program.
        Parameters:
        program - the program
        Returns:
        the overlay addresses within the specified program.

      • loadDirectReferenceList

        public static void loadDirectReferenceList​(Program program,
                                           int alignment,
                                           Address toAddress,
                                           AddressSetView toAddressSet,
                                           java.util.List<ghidra.app.plugin.core.analysis.ReferenceAddressPair> directReferenceList,
                                           TaskMonitor monitor)
                                    throws CancelledException
        Checks a programs memory for direct references to the addresses indicated in the toAddressSet. Direct references are only found at addresses that match the indicated alignment. Each direct reference is added to the directReferenceList as a from/to address pair.
        Parameters:
        program - the program whose memory is to be checked.
        alignment - direct references are to only be found at the indicated alignment in memory.
        toAddress - address that we are interested in finding references to.
        toAddressSet - address set indicating the addresses that we are interested in finding directly referred to in memory. Null if only interested in finding references to the toAddress.
        directReferenceList - the list to be populated with possible direct references
        monitor - a task monitor for progress or to allow cancelling.
        Throws:
        CancelledException - if the user cancels via the monitor.

      • loadDirectReferenceList

        public static void loadDirectReferenceList​(Program program,
                                           int alignment,
                                           Address toAddress,
                                           AddressSetView toAddressSet,
                                           Accumulator<ghidra.app.plugin.core.analysis.ReferenceAddressPair> accumulator,
                                           TaskMonitor monitor)
                                    throws CancelledException
        Checks a programs memory for direct references to the addresses indicated in the toAddressSet. Direct references are only found at addresses that match the indicated alignment. Each direct reference is added to the directReferenceList as a from/to address pair.
        Parameters:
        program - the program whose memory is to be checked.
        alignment - direct references are to only be found at the indicated alignment in memory.
        toAddress - address that we are interested in finding references to.
        toAddressSet - address set indicating the addresses that we are interested in finding directly referred to in memory. Null if only interested in finding references to the toAddress.
        accumulator - the datastructure to be populated with possible direct references
        monitor - a task monitor for progress or to allow cancelling.
        Throws:
        CancelledException - if the user cancels via the monitor.

      • findDirectReferencesCodeUnit

        public static java.util.List<Address> findDirectReferencesCodeUnit​(Program program,
                                                                   int alignment,
                                                                   CodeUnit codeUnit,
                                                                   TaskMonitor monitor)
        Checks a programs memory for direct references to the CodeUnit indicated. Direct references are only found at addresses that match the indicated alignment.
        Parameters:
        program - the program whose memory is to be checked.
        alignment - direct references are to only be found at the indicated alignment in memory.
        codeUnit - the code unit to to search for references to.
        monitor - a task monitor for progress or to allow canceling.
        Returns:
        list of addresses referring directly to the toAddress.

      • findDirectReferences

        public static java.util.Set<Address> findDirectReferences​(Program program,
                                                          int alignment,
                                                          Address toAddress,
                                                          TaskMonitor monitor)
                                                   throws CancelledException
        Checks a programs memory for direct references to the address indicated. Direct references are only found at addresses that match the indicated alignment.
        Parameters:
        program - the program whose memory is to be checked.
        alignment - direct references are to only be found at the indicated alignment in memory.
        toAddress - address that we are interested in finding references to.
        monitor - a task monitor for progress or to allow canceling.
        Returns:
        list of addresses referring directly to the toAddress
        Throws:
        CancelledException - if the user cancels via the monitor.

      • findDirectReferences

        public static java.util.Set<Address> findDirectReferences​(Program program,
                                                          java.util.List<MemoryBlock> blocks,
                                                          int alignment,
                                                          Address toAddress,
                                                          TaskMonitor monitor)
                                                   throws CancelledException
        Checks a programs memory for direct references to the address indicated within the listed memory blocks. If null is passed for the list of memory blocks then all of the program's memory blocks will be checked.
        Direct references are only found at addresses that match the indicated alignment.
        Parameters:
        program - the program whose memory is to be checked.
        blocks - the only memory blocks to be checked. A null value indicates all memory blocks should be checked.
        alignment - direct references are to only be found at the indicated alignment in memory.
        toAddress - address that we are interested in finding references to.
        monitor - a task monitor for progress or to allow canceling.
        Returns:
        list of addresses referring directly to the toAddress
        Throws:
        CancelledException - if the user cancels via the monitor.

      • getDirectAddressBytes

        public static byte[] getDirectAddressBytes​(Program program,
                                           Address toAddress)
        Get a representation of an address as it would appear in bytes in memory.
        Parameters:
        program - program
        toAddress - target address
        Returns:
        byte representation of toAddress

      • getShiftedDirectAddressBytes

        public static byte[] getShiftedDirectAddressBytes​(Program program,
                                                  Address toAddress)
        returns shifted address bytes if they are different than un-shifted
        Parameters:
        program - program
        toAddress - target address
        Returns:
        shifted bytes, null if same as un-shifted

      • getImageBaseOffsets32Bytes

        public static byte[] getImageBaseOffsets32Bytes​(Program program,
                                                int alignment,
                                                Address toAddress)

      • findImageBaseOffsets32

        public static java.util.Set<Address> findImageBaseOffsets32​(Program program,
                                                            int alignment,
                                                            Address toAddress,
                                                            TaskMonitor monitor)
                                                     throws CancelledException
        Checks a programs memory for 32 bit image base offset references to the address indicated. These relative references are only found at addresses that match the indicated alignment.
        Parameters:
        program - the program whose memory is to be checked.
        alignment - 32 bit image base offset relative references are to only be found at the indicated alignment in memory.
        toAddress - address that we are interested in finding references to.
        monitor - a task monitor for progress or to allow canceling.
        Returns:
        list of addresses with 32 bit image base offset relative references to the toAddress
        Throws:
        CancelledException - if the user cancels via the monitor.

      • findString

        public static java.util.List<Address> findString​(java.lang.String searchString,
                                                 Program program,
                                                 java.util.List<MemoryBlock> blocks,
                                                 AddressSetView set,
                                                 TaskMonitor monitor)
                                          throws CancelledException
        Finds the string in memory indicated by the searchString limited to the indicated memory blocks and address set.
        Parameters:
        searchString - the string to find
        program - the program to search
        blocks - the only blocks to search
        set - a set of the addresses to limit the results
        monitor - a task monitor to allow
        Returns:
        a list of addresses where the string was found
        Throws:
        CancelledException - if the user cancels

      • locateString

        public static void locateString​(java.lang.String searchString,
                                TerminatingConsumer<Address> foundLocationConsumer,
                                Program program,
                                java.util.List<MemoryBlock> blocks,
                                AddressSetView set,
                                TaskMonitor monitor)
                         throws CancelledException
        Finds the string in memory indicated by the searchString limited to the indicated memory blocks and address set. Each found location calls the foundLocationConsumer.consume(addr) method. If the search should terminate, (ie. enough results found), then terminateRequested() should return true. Requesting termination is different than a cancellation from the task monitor.
        Parameters:
        searchString - the string to find
        foundLocationConsumer - location consumer with consumer.accept(Address addr) routine defined
        program - the program to search
        blocks - the only blocks to search
        set - a set of the addresses to limit the results
        monitor - a task monitor to allow
        Throws:
        CancelledException - if the user cancels

      • getMemoryBlocksStartingWithName

        public static java.util.List<MemoryBlock> getMemoryBlocksStartingWithName​(Program program,
                                                                          AddressSetView set,
                                                                          java.lang.String name,
                                                                          TaskMonitor monitor)
                                                                   throws CancelledException
        Gets a list of memory blocks whose name starts with the indicated name. Only memory blocks that are initialized and part of the indicated address set will be returned.
        Parameters:
        program - the program for obtaining the memory blocks
        set - the address set to use to limit the blocks returned
        name - the text which the memory block's name must start with.
        monitor - a status monitor that allows the operation to be cancelled
        Returns:
        the list of memory blocks
        Throws:
        CancelledException - if the user cancels