Snippets.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "8ea48829",
   "metadata": {},
   "source": [
    "# Ghidra Snippets Kotlin\n",
    "\n",
    "*Ghidra Snippets Kotlin* is a collection of Kotlin examples showing how to work with [Ghidra](https://ghidra-sre.org/) APIs. There are three primary APIs covered here, the [Flat Program API][1], the [Flat Decompiler API][2], and everything else (\"Complex API\"). The Flat APIs are 'simple' versions of the full fledged Complex Ghidra API. They are a great starting point for anyone looking to develop Ghidra modules and/or scripts.\n",
    "\n",
    "At some point however, you need to reach outside of the Flat APIs to do really interesting things. Everything here is just a mashup to get the job done. There's more than one way to accomplish each task so make sure you ask yourself if these snippets are really what you need before copy/pasta."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "d990be2f",
   "metadata": {},
   "outputs": [],
   "source": [
    "fun type(variable: Any) = variable::class.simpleName"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "18e5a395",
   "metadata": {},
   "source": [
    "## Latest Release & API Docs\n",
    "* Loooking for the latest release of Ghidra? [Download it here][0]. \n",
    "* Loooking for the latest API Docs? In Ghidra's UI, select **Help** -> **Ghidra API Help** to unpack the docs and view them.\n",
    "* Just want a quick online API reference? [Ghidra.re](https://ghidra.re/) hosts an online version of the [API docs](https://ghidra.re/ghidra_docs/api/index.html) (may not be up to date)."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "21e4ea32",
   "metadata": {},
   "source": [
    "# Contributing\n",
    "\n",
    "Feel free to submit pull requests to master on this repo with any modifications you see fit. Most of these snippets are meant to be verbose, but if you know of a better way to do something, please share it via pull request or submitting an issue. Thanks!"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "88c17d7f",
   "metadata": {},
   "source": [
    "## Working with Projects\n",
    "A Ghidra *Project* (class [GhidraProject][4]) contains a logical set of program binaries related to a reverse engineering effort. Projects can be shared (collaborative) or non-shared (private). The snippets in this section deal with bulk import and analysis, locating project files on disk, and more.\n",
    "\n",
    "### Get the name and location on disk of the current project\n",
    "If you're looking to automate analysis using headless scripts you'll likley have to deal with project management. This includes adding binaries to existing projects, cleaning up old projects, or perhaps syncing analysis to shared projects."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "e94e6d10",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "type(state):           GhidraState\n",
      "type(project):         DefaultProject\n",
      "type(program):         ProgramDB\n",
      "type(locator):         ProjectLocator\n",
      "Project Name:          KotlinScript\n",
      "Files in this project: 10\n",
      "Is a remote project:   false\n",
      "Project location:      /home/sciver/Work/ghidraKotlinScript\n",
      "Project directory:     /home/sciver/Work/ghidraKotlinScript/KotlinScript.rep\n",
      "Lock file:             /home/sciver/Work/ghidraKotlinScript/KotlinScript.lock\n",
      "Marker file:           /home/sciver/Work/ghidraKotlinScript/KotlinScript.gpr\n",
      "Project URL:           ghidra:/home/sciver/Work/ghidraKotlinScript/KotlinScript\n"
     ]
    }
   ],
   "source": [
    "val state = getState()\n",
    "val project = state.getProject()\n",
    "val program = state.getCurrentProgram()\n",
    "val locator = project.getProjectData().getProjectLocator()\n",
    "println(\"type(state):           %s\".format(type(state)))\n",
    "println(\"type(project):         %s\".format(type(project)))\n",
    "println(\"type(program):         %s\".format(type(program)))\n",
    "println(\"type(locator):         %s\".format(type(locator)))\n",
    "println(\"Project Name:          %s\".format(locator.getName()))\n",
    "println(\"Files in this project: %s\".format(project.getProjectData().getFileCount()))\n",
    "println(\"Is a remote project:   %s\".format(locator.isTransient()))\n",
    "println(\"Project location:      %s\".format(locator.getLocation()))\n",
    "println(\"Project directory:     %s\".format(locator.getProjectDir()))\n",
    "println(\"Lock file:             %s\".format(locator.getProjectLockFile()))\n",
    "println(\"Marker file:           %s\".format(locator.getMarkerFile()))\n",
    "println(\"Project URL:           %s\".format(locator.getURL()))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "6f4c3835",
   "metadata": {},
   "source": [
    "### List all programs in the current project\n",
    "A Ghidra project is a logical collection binaries that relate to a specific RE effort. This might be a single executable with multiple shared objects, or multiple executables with numerous third-party libraries, kernel modules, and drivers."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "165a9e25",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "type(state):           GhidraState\n",
      "type(project):         DefaultProject\n",
      "type(projectMgr):      GhidraProjectManager\n",
      "type(activeProject):   DefaultProject\n",
      "type(projectData):     ProjectFileManager\n",
      "type(rootFolder):      RootGhidraFolder\n",
      "The project 'KotlinScript' has 10 files in it:\n"
     ]
    }
   ],
   "source": [
    "val state = getState()\n",
    "val project = state.getProject()\n",
    "val locator = project.getProjectData().getProjectLocator()\n",
    "val projectMgr = project.getProjectManager()\n",
    "val activeProject = projectMgr.getActiveProject()\n",
    "val projectData = activeProject.getProjectData()\n",
    "val rootFolder = projectData.getRootFolder()\n",
    "\n",
    "println(\"type(state):           %s\".format(type(state)))\n",
    "println(\"type(project):         %s\".format(type(project)))\n",
    "println(\"type(projectMgr):      %s\".format(type(projectMgr)))\n",
    "println(\"type(activeProject):   %s\".format(type(activeProject)))\n",
    "println(\"type(projectData):     %s\".format(type(projectData)))\n",
    "println(\"type(rootFolder):      %s\".format(type(rootFolder)))\n",
    "\n",
    "val projectName = locator.getName()\n",
    "val fileCount = projectData.getFileCount()\n",
    "val files = rootFolder.getFiles()\n",
    "\n",
    "println(\"The project '%s' has %s files in it:\".format(projectName, fileCount))\n",
    "for(file in files) {\n",
    "\tprintln(\"\\t%s\".format(file))\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "8c863aa6",
   "metadata": {},
   "source": [
    "## Working with Programs\n",
    "A *Program* is a binary component within a Ghidra Project. The snippets in this section deal with gathering information about the Programs within a Project."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c3fc1cc7",
   "metadata": {},
   "source": [
    "### List the current program name and location on disk"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "b43631a6",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "The currently loaded program is: 'control.elf'\n",
      "Its location on disk is: '/home/sciver/Work/ghidraKotlinScript/demo/bin/debug/control.elf'\n"
     ]
    }
   ],
   "source": [
    "val state = getState()\n",
    "val currentProgram = state.getCurrentProgram()\n",
    "val name = currentProgram.getName()\n",
    "val location = currentProgram.getExecutablePath()\n",
    "println(\"The currently loaded program is: '%s'\".format(name))\n",
    "println(\"Its location on disk is: '%s'\".format(location))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e9af45b0",
   "metadata": {},
   "source": [
    "### List the name and size of program sections"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "75f6a4c1",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Name: segment_2.1, Size: 792\n",
      "Name: .interp, Size: 28\n",
      "Name: .note.gnu.property, Size: 32\n",
      "Name: .note.gnu.build-id, Size: 36\n",
      "Name: .note.ABI-tag, Size: 32\n",
      "Name: .gnu.hash, Size: 36\n",
      "Name: .dynsym, Size: 192\n",
      "Name: .dynstr, Size: 137\n",
      "Name: .gnu.version, Size: 16\n",
      "Name: .gnu.version_r, Size: 32\n",
      "Name: .rela.dyn, Size: 192\n",
      "Name: .rela.plt, Size: 48\n",
      "Name: .init, Size: 27\n",
      "Name: .plt, Size: 48\n",
      "Name: .plt.got, Size: 16\n",
      "Name: .plt.sec, Size: 32\n",
      "Name: .text, Size: 517\n",
      "Name: .fini, Size: 13\n",
      "Name: .rodata, Size: 25\n",
      "Name: .eh_frame_hdr, Size: 68\n",
      "Name: .eh_frame, Size: 264\n",
      "Name: .init_array, Size: 8\n",
      "Name: .fini_array, Size: 8\n",
      "Name: .dynamic, Size: 496\n",
      "Name: .got, Size: 80\n",
      "Name: .data, Size: 16\n",
      "Name: .bss, Size: 8\n",
      "Name: EXTERNAL, Size: 56\n",
      "Name: .comment, Size: 43\n",
      "Name: .debug_abbrev, Size: 221\n",
      "Name: .debug_aranges, Size: 48\n",
      "Name: .debug_info, Size: 783\n",
      "Name: .debug_line, Size: 332\n",
      "Name: .debug_str, Size: 692\n",
      "Name: .shstrtab, Size: 346\n",
      "Name: .strtab, Size: 537\n",
      "Name: .symtab, Size: 1704\n",
      "Name: _elfSectionHeaders, Size: 2304\n"
     ]
    }
   ],
   "source": [
    "val blocks = currentProgram.getMemory().getBlocks()\n",
    "for(block in blocks) {\n",
    "    println(\"Name: %s, Size: %s\".format(block.getName(), block.getSize()))\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "d47ddae0",
   "metadata": {},
   "source": [
    "## Working with Functions\n",
    "A *Function* is a subroutine within an Program. The snippets in this section deal with gathering information about Functions and modifying them within an Program.\n",
    "\n",
    "### Enumerate all functions printing their name and address\n",
    "There are at least two ways to do this. The output is the same for each method."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "id": "a3d22938",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Function: _init @ 0x00101000\n",
      "Function: FUN_00101020 @ 0x00101020\n",
      "Function: __cxa_finalize @ 0x00101050\n",
      "Function: puts @ 0x00101060\n",
      "Function: printf @ 0x00101070\n",
      "Function: _start @ 0x00101080\n",
      "Function: deregister_tm_clones @ 0x001010b0\n",
      "Function: register_tm_clones @ 0x001010e0\n",
      "Function: __do_global_dtors_aux @ 0x00101120\n",
      "Function: frame_dummy @ 0x00101160\n",
      "Function: main @ 0x00101169\n",
      "Function: __libc_csu_init @ 0x00101210\n",
      "Function: __libc_csu_fini @ 0x00101280\n",
      "Function: _fini @ 0x00101288\n",
      "Function: _ITM_deregisterTMCloneTable @ 0x00105000\n",
      "Function: puts @ 0x00105008\n",
      "Function: printf @ 0x00105010\n",
      "Function: __libc_start_main @ 0x00105018\n",
      "Function: __gmon_start__ @ 0x00105020\n",
      "Function: _ITM_registerTMCloneTable @ 0x00105028\n",
      "Function: __cxa_finalize @ 0x00105030\n",
      "Function: _init @ 0x00101000\n",
      "Function: FUN_00101020 @ 0x00101020\n",
      "Function: __cxa_finalize @ 0x00101050\n",
      "Function: puts @ 0x00101060\n",
      "Function: printf @ 0x00101070\n",
      "Function: _start @ 0x00101080\n",
      "Function: deregister_tm_clones @ 0x001010b0\n",
      "Function: register_tm_clones @ 0x001010e0\n",
      "Function: __do_global_dtors_aux @ 0x00101120\n",
      "Function: frame_dummy @ 0x00101160\n",
      "Function: main @ 0x00101169\n",
      "Function: __libc_csu_init @ 0x00101210\n",
      "Function: __libc_csu_fini @ 0x00101280\n",
      "Function: _fini @ 0x00101288\n",
      "Function: _ITM_deregisterTMCloneTable @ 0x00105000\n",
      "Function: puts @ 0x00105008\n",
      "Function: printf @ 0x00105010\n",
      "Function: __libc_start_main @ 0x00105018\n",
      "Function: __gmon_start__ @ 0x00105020\n",
      "Function: _ITM_registerTMCloneTable @ 0x00105028\n",
      "Function: __cxa_finalize @ 0x00105030\n"
     ]
    }
   ],
   "source": [
    "// Method 1:\n",
    "var func = getFirstFunction()\n",
    "while(func != null) {\n",
    "    println(\"Function: ${func.name} @ 0x${func.entryPoint}\")\n",
    "    func = getFunctionAfter(func)\n",
    "}\n",
    "// Method 2:\n",
    "val fm = currentProgram.getFunctionManager()\n",
    "val funcs = fm.getFunctions(true)\n",
    "funcs?.forEach {\n",
    "    println(\"Function: ${it?.name} @ 0x${it?.entryPoint}\")\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "0f34ef4a",
   "metadata": {},
   "source": [
    "### Get a function name by address\n",
    "This snippet will help you correlate addresses with associated function names."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "id": "d985fa99",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "null\n",
      "true\n",
      "__do_global_dtors_aux\n"
     ]
    }
   ],
   "source": [
    "// helper function to get a Ghidra Address type\n",
    "fun getAddress(offset:Long) = currentProgram.getAddressFactory().getDefaultAddressSpace().getAddress(offset)\n",
    "\n",
    "//get a FunctionManager reference for the current program\n",
    "val functionManager = currentProgram.getFunctionManager()\n",
    "\n",
    "//  getFunctionAt() only works with function entryPoint addresses!\n",
    "//  returns `null` if address is not the address of the first\n",
    "//  instruction in a defined function. Consider using\n",
    "//  getFunctionContaining() method instead.\n",
    "var addr = getAddress(0x101140)\n",
    "val funcName = functionManager.getFunctionAt(addr)?.getName()\n",
    "println(funcName)\n",
    "\n",
    "// check if a specific address resides in a function\n",
    "addr = getAddress(0x101149)\n",
    "println(functionManager.isInFunction(addr))\n",
    "\n",
    "// get the function an address belongs to, returns `None` if the address\n",
    "//  is not part of a defined function.\n",
    "addr = getAddress(0x101149)\n",
    "println(functionManager.getFunctionContaining(addr))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e1af8569",
   "metadata": {},
   "source": [
    "### Get a function address by name\n",
    "Have a name for a function but want the entry point address for it? This will help you do that. Just remember that two or more functions can share the same name (due to function overloading), so Ghidra will return an array (Python list) you have to consider iterating over."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "id": "cec0a832",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Found 1 function(s) with the name 'main'\n",
      "main is located at 0x00101169\n"
     ]
    }
   ],
   "source": [
    "// Note that multiple functions can share the same name, so Ghidra's API\n",
    "// returns a list of `Function` types. Just keep this in mind.\n",
    "val name = \"main\"\n",
    "val funcs = getGlobalFunctions(name)\n",
    "println(\"Found ${funcs.size} function(s) with the name '$name'\")\n",
    "funcs.forEach {\n",
    "    println(\"${it.name} is located at 0x${it.entryPoint}\")\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a5901073",
   "metadata": {},
   "source": [
    "### Get cross references to a function\n",
    "Ghidra makes it easy to find all cross references to a function using `getReferencesTo`. To use this, you'll just need the function's entry address which can be acquired using the `getEntryPoint` method on a function object.  Let's take a look at an example where we find all cross references to functions named \"system\"."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "id": "313f8e36",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n",
      "Found 'main' @ 0x00101169\n",
      "From: Entry Point To: 00101169 Type: EXTERNAL Op: -1 DEFAULT\n",
      "From: 00102048 To: 00101169 Type: INDIRECTION Op: 0 ANALYSIS\n",
      "From: 001020f0 To: 00101169 Type: DATA Op: 0 ANALYSIS\n",
      "From: 001010a1 To: 00101169 Type: DATA Op: 1 ANALYSIS\n"
     ]
    }
   ],
   "source": [
    "val fm = currentProgram.getFunctionManager()\n",
    "val funcs = fm.getFunctions(true)\n",
    "funcs.filter {\n",
    "    it.name == \"main\"\n",
    "}.forEach {\n",
    "    println(\"\\nFound '${it.name}' @ 0x${it.entryPoint}\")\n",
    "    val entryPoint = it.entryPoint\n",
    "    val references = getReferencesTo(entryPoint)\n",
    "    references.forEach { \n",
    "        println(it)\n",
    "    }\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "5837c37c",
   "metadata": {},
   "source": [
    "### Analyzing function call arguments\n",
    "This snippet uses a `TARGET_ADDR` which should be the address of a call to return the call arguments at that address. Thanks to [gipi](https://github.com/gipi) for [suggesting](https://github.com/HackOvert/GhidraSnippets/issues/4) this much cleaner way to obtain function call arguments than previously listed!"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "id": "201a92de",
   "metadata": {},
   "outputs": [],
   "source": [
    "import ghidra.app.decompiler.DecompileOptions\n",
    "import ghidra.app.decompiler.DecompInterface\n",
    "import ghidra.util.task.ConsoleTaskMonitor\n",
    "\n",
    "// Disassembly shows: 00434f6c    CALL    FUN_00433ff0\n",
    "// Decompiler shows:  uVar1 = FUN_00433ff0(param_1,param_2,param_3);\n",
    "val TARGET_ADDR = toAddr(0x10114d)\n",
    "\n",
    "val options = DecompileOptions()\n",
    "val monitor = ConsoleTaskMonitor()\n",
    "val ifc = DecompInterface()\n",
    "ifc.setOptions(options)\n",
    "ifc.openProgram(currentProgram)\n",
    "\n",
    "val func = getFunctionContaining(TARGET_ADDR)\n",
    "val res = ifc.decompileFunction(func, 60, monitor)\n",
    "val high_func = res.getHighFunction()\n",
    "val pcodeops = high_func.getPcodeOps(TARGET_ADDR)\n",
    "pcodeops.forEach { \n",
    "    println(it.getInputs().joinToString())\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "55dfc3bd",
   "metadata": {},
   "source": [
    "### Analyzing function call arguments at cross references\n",
    "In this snippet we locate cross references to a target function (`TARGET_FUNC`) and show how we can analyze the arguments passed to each call. This can be helpful in analyzing malware, or potentially vulnerable functions.  For malware analysis, this may help \"decrypt\" strings, or in vulnerability research this may help locate functions that may be vulnerable if called with an incorrect value.  The specific analysis performed on the arguments of a called target function are up to you. This snippet will allow you to add your own analysis as you see fit."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "id": "d588eca9",
   "metadata": {},
   "outputs": [],
   "source": [
    "import ghidra.app.decompiler.DecompileOptions\n",
    "import ghidra.app.decompiler.DecompInterface\n",
    "import ghidra.util.task.ConsoleTaskMonitor\n",
    "\n",
    "// helper function to get a Ghidra Address type\n",
    "fun getAddress(offset:Long) = currentProgram.getAddressFactory().getDefaultAddressSpace().getAddress(offset)\n",
    "\n",
    "val TARGET_FUNC = \"a\"\n",
    "var targetAddr = getAddress(0)\n",
    "// Step 1. Get functions that call the target function ('callers')\n",
    "val funcs = getGlobalFunctions(TARGET_FUNC)\n",
    "val callers = funcs.filter {\n",
    "    it.name == TARGET_FUNC\n",
    "}.flatMap {\n",
    "    println(\"\\nFound ${it.name} @ 0x${it.entryPoint}\")\n",
    "    targetAddr = it.entryPoint\n",
    "    val references = getReferencesTo(targetAddr)\n",
    "    references.map {\n",
    "        getFunctionContaining(it.fromAddress)\n",
    "    }\n",
    "}.filterNotNull()\n",
    "\n",
    "// Step 2. Decompile all callers and find PCODE CALL operations leading to `target_add`\n",
    "val options = DecompileOptions()\n",
    "val monitor = ConsoleTaskMonitor()\n",
    "val ifc = DecompInterface()\n",
    "ifc.setOptions(options)\n",
    "ifc.openProgram(currentProgram)\n",
    "\n",
    "callers.forEach {\n",
    "    val res = ifc.decompileFunction(it, 60, monitor)\n",
    "    val high_func = res.highFunction\n",
    "    high_func?.let {\n",
    "        it.pcodeOps.forEach { \n",
    "            val mnemonic = it.mnemonic\n",
    "            if (mnemonic == \"CALL\") {\n",
    "                val inputs = it.inputs\n",
    "                val addr = inputs.first().address\n",
    "                val args = inputs.slice(1 until inputs.size)\n",
    "                println(\"$args\")\n",
    "                if (addr == targetAddr) {\n",
    "                    println(\"Call to ${addr} at ${it.seqnum.target} has ${args.size} arguments: ${args}\")\n",
    "                }\n",
    "            }\n",
    "        }\n",
    "    }\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "093dd505",
   "metadata": {},
   "source": [
    "### Rename functions based on strings\n",
    "In some cases strings will either hint at or give the name of a function when symbols aren't available.  In these cases, we can rename functions based on these strings to help perform reverse engineering.  This becomes a daunting task when there are hundreds or thousands of these cases, making the process of copy, rename, paste, a soul crushing task.  The power of tools like Ghidra is that you can script this.  Take for example this decompiled function found in a binary:\n",
    "```\n",
    "undefined4 FUN_00056b58(void)\n",
    "{\n",
    "\tundefined4 in_r3;\n",
    "\n",
    "\tregister_function(1, \"core_Init_Database\", FUN_00058294);\n",
    "\tregister_function(1, \"core_Clear_Database\", FUN_00058374);\n",
    "\tregister_function(1, \"core_Auth_Database\", FUN_00058584);\n",
    "\tregister_function(1, \"core_Add_User_Database\", FUN_00058650);\n",
    "\t\n",
    "\t// ... hundreds more in this function and in others ...\n",
    "\t\n",
    "\treturn in_r3;\n",
    "}\n",
    "```\n",
    "\n",
    "In this function, we have calls to a `register_function` which correlates an event string with a handler function.  We want to rename these functions so that `FUN_00058294` becomes `core_Init_Database` and so on.  Below is code that performs this task for every `register_function` in the target binary."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "841e7e4f",
   "metadata": {},
   "outputs": [],
   "source": [
    "import ghidra.app.decompiler.DecompileOptions\n",
    "import ghidra.app.decompiler.DecompInterface\n",
    "import ghidra.util.task.ConsoleTaskMonitor\n",
    "import ghidra.app.util.bin.BinaryReader\n",
    "import ghidra.app.util.bin.RandomAccessMutableByteProvider\n",
    "import java.io.File\n",
    "import ghidra.program.database.ProgramDB\n",
    "\n",
    "// helper function to get a Ghidra Address type\n",
    "fun getAddress(offset:Long) = currentProgram.getAddressFactory().getDefaultAddressSpace().getAddress(offset)\n",
    "\n",
    "fun runTransaction(msg:String, transaction:() -> Unit) {\n",
    "    val id = currentProgram.startTransaction(msg)\n",
    "    transaction()\n",
    "    currentProgram.endTransaction(id, true)\n",
    "}\n",
    "\n",
    "val f = File(currentProgram.executablePath)\n",
    "val mem = currentProgram.getMemory()\n",
    "val provider = RandomAccessMutableByteProvider(f)\n",
    "val reader = BinaryReader(provider, true)\n",
    "\n",
    "fun readString(offset:Long) = reader.readAsciiString(offset - currentProgram.imageBase.offset)\n",
    "\n",
    "val options = DecompileOptions()\n",
    "val monitor = ConsoleTaskMonitor()\n",
    "val ifc = DecompInterface()\n",
    "ifc.setOptions(options)\n",
    "ifc.openProgram(currentProgram)\n",
    "\n",
    "val functionManager = currentProgram.getFunctionManager()\n",
    "val funcs = functionManager.getFunctions(true)\n",
    "val registerFunction = getGlobalFunctions(\"register_function\").first()\n",
    "\n",
    "val entryPoint = registerFunction.entryPoint\n",
    "val references = getReferencesTo(entryPoint)\n",
    "// val id = currentProgram.startTransaction(\"modify\")\n",
    "runTransaction(\"modify\") {\n",
    "    references.map {\n",
    "        functionManager.getFunctionContaining(it.fromAddress)\n",
    "    }.filterNotNull().toSet().forEach {\n",
    "        val res = ifc.decompileFunction(it, 60, monitor)\n",
    "        val high_func = res.highFunction\n",
    "        high_func?.let {\n",
    "            it.pcodeOps.forEach { \n",
    "                it?.run { \n",
    "                    if (mnemonic == \"CALL\") {\n",
    "                        val callTarget = it.getInput(0)\n",
    "                        if (callTarget.address == entryPoint) {\n",
    "                            val coreName = it.getInput(1)\n",
    "                            val coreFunc = it.getInput(2)\n",
    "                            val coreNameAddr = when(coreName.def.mnemonic) {\n",
    "                                \"COPY\" -> coreName.def.getInput(0).offset\n",
    "                                \"PTRSUB\" -> coreName.def.getInput(1).offset\n",
    "                                else -> 0\n",
    "                            }\n",
    "                            val coreString = readString(coreNameAddr)\n",
    "    //                         createAsciiString(toAddr(coreNameAddr))\n",
    "                            println(coreString)\n",
    "                            val coreFuncAddr = toAddr(coreFunc.def.getInput(1).offset)\n",
    "                            println(coreFuncAddr)\n",
    "                            val coreFuncObj = functionManager.getFunctionAt(coreFuncAddr)\n",
    "                            val trans:()->Unit = {\n",
    "                                coreFuncObj.setName(coreString, ghidra.program.model.symbol.SourceType.DEFAULT)\n",
    "                            }\n",
    "                            trans()\n",
    "    //                         println(type(transaction.))\n",
    "    //                         runTransaction(\"modify Name\", trans) \n",
    "                        }\n",
    "                    }\n",
    "                }\n",
    "            }\n",
    "        }\n",
    "    }\n",
    "}\n",
    "// currentProgram.endTransaction(id, true)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a9b0a273",
   "metadata": {},
   "source": [
    "## Working with Instructions\n",
    "\n",
    "### Print all instructions in a select function\n",
    "Just like `objdump` or a `disas` command in GDB, Ghidra provides a way to dump instructions if you need.  You might do this to generate input for another application, or for documenting issues found during analysis. Whatever you use case might be, you can easily acquire the address, opcodes, and instruction text for a target function, or specific addresses."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "id": "5c34176e",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "0x00101169 : f30f1efa         ENDBR64\n",
      "0x0010116d : 55               PUSH RBP\n",
      "0x0010116e : 4889e5           MOV RBP,RSP\n",
      "0x00101171 : 4883ec10         SUB RSP,0x10\n",
      "0x00101175 : c745fc00000000   MOV dword ptr [RBP + -0x4],0x0\n",
      "0x0010117c : eb23             JMP 0x001011a1\n",
      "0x0010117e : 837dfc05         CMP dword ptr [RBP + -0x4],0x5\n",
      "0x00101182 : 7418             JZ 0x0010119c\n",
      "0x00101184 : 8b45fc           MOV EAX,dword ptr [RBP + -0x4]\n",
      "0x00101187 : 89c6             MOV ESI,EAX\n",
      "0x00101189 : 488d3d740e0000   LEA RDI,[0x102004]\n",
      "0x00101190 : b800000000       MOV EAX,0x0\n",
      "0x00101195 : e8d6feffff       CALL 0x00101070\n",
      "0x0010119a : eb01             JMP 0x0010119d\n",
      "0x0010119c : 90               NOP\n",
      "0x0010119d : 8345fc01         ADD dword ptr [RBP + -0x4],0x1\n",
      "0x001011a1 : 837dfc09         CMP dword ptr [RBP + -0x4],0x9\n",
      "0x001011a5 : 7ed7             JLE 0x0010117e\n",
      "0x001011a7 : eb22             JMP 0x001011cb\n",
      "0x001011a9 : 837dfc05         CMP dword ptr [RBP + -0x4],0x5\n",
      "0x001011ad : 7502             JNZ 0x001011b1\n",
      "0x001011af : eb1a             JMP 0x001011cb\n",
      "0x001011b1 : 8b45fc           MOV EAX,dword ptr [RBP + -0x4]\n",
      "0x001011b4 : 89c6             MOV ESI,EAX\n",
      "0x001011b6 : 488d3d470e0000   LEA RDI,[0x102004]\n",
      "0x001011bd : b800000000       MOV EAX,0x0\n",
      "0x001011c2 : e8a9feffff       CALL 0x00101070\n",
      "0x001011c7 : 836dfc01         SUB dword ptr [RBP + -0x4],0x1\n",
      "0x001011cb : 837dfc00         CMP dword ptr [RBP + -0x4],0x0\n",
      "0x001011cf : 7fd8             JG 0x001011a9\n",
      "0x001011d1 : 837dfc00         CMP dword ptr [RBP + -0x4],0x0\n",
      "0x001011d5 : 7408             JZ 0x001011df\n",
      "0x001011d7 : 837dfc01         CMP dword ptr [RBP + -0x4],0x1\n",
      "0x001011db : 7410             JZ 0x001011ed\n",
      "0x001011dd : eb1c             JMP 0x001011fb\n",
      "0x001011df : 488d3d220e0000   LEA RDI,[0x102008]\n",
      "0x001011e6 : e875feffff       CALL 0x00101060\n",
      "0x001011eb : eb1b             JMP 0x00101208\n",
      "0x001011ed : 488d3d190e0000   LEA RDI,[0x10200d]\n",
      "0x001011f4 : e867feffff       CALL 0x00101060\n",
      "0x001011f9 : eb0d             JMP 0x00101208\n",
      "0x001011fb : 488d3d0f0e0000   LEA RDI,[0x102011]\n",
      "0x00101202 : e859feffff       CALL 0x00101060\n",
      "0x00101207 : 90               NOP\n",
      "0x00101208 : b800000000       MOV EAX,0x0\n",
      "0x0010120d : c9               LEAVE\n",
      "0x0010120e : c3               RET\n"
     ]
    }
   ],
   "source": [
    "val listing = currentProgram.getListing()\n",
    "val mainFunc = getGlobalFunctions(\"main\")[0] // assume there's only 1 function named 'main'\n",
    "val addrSet = mainFunc.body\n",
    "val codeUnits = listing.getCodeUnits(addrSet, true) // true means 'forward'\n",
    "\n",
    "codeUnits.forEach {\n",
    "    println(\"0x%s : %-16s %s\".format(it.address, it.bytes.map {\"%02x\".format(it)}. joinToString(\"\"), it.toString()))\n",
    "}\n",
    "// for codeUnit in codeUnits:\n",
    "// \tprint(\"0x{} : {:16} {}\".format(codeUnit.getAddress(), hexlify(codeUnit.getBytes()), codeUnit.toString()))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "83f1151a",
   "metadata": {},
   "source": [
    "### Find all calls and jumps to a register\n",
    "This snippet shows how to find all instructions in an x86 program that are calls or jumps to a regitser. This information can be useful when attempting to track down a crash by researching code flow in hard-to-debug targets. `getRegister` returns `None` when the specified index is not a regitser. We use `startswith('J')` to account for all jump variants. This is not architecture agnostic and a little goofy but it gets the job done."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "id": "2d5865c0",
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "0x00101014 : CALL RAX\n",
      "0x001010cf : JMP RAX\n",
      "0x00101110 : JMP RAX\n"
     ]
    }
   ],
   "source": [
    "val listing = currentProgram.getListing()\n",
    "val func = getFirstFunction()\n",
    "val entryPoint = func.getEntryPoint()\n",
    "val instructions = listing.getInstructions(entryPoint, true)\n",
    "\n",
    "instructions.filter {\n",
    "    (it.mnemonicString.startsWith(\"CALL\") || it.mnemonicString.startsWith(\"J\"))\n",
    "}.filter {\n",
    "    it.getRegister(0) != null\n",
    "}.forEach {\n",
    "    println(\"0x${it.address} : ${it}\")\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4739b04c",
   "metadata": {},
   "source": [
    "### Count all mnemonics in a binary\n",
    "While recently preparing to teach some introductary x86, I wanted to know the most used mnemonics appearing in a given application to make sure I covered them. This is insanely easy to do in Binary Ninja, but a bit more involved in Ghidra. Essentially, we track mnemonics in a dictionary and increment the count as we process all instructions in a binary.  \n",
    "\n",
    "This requires getting a `InstructionDB` and using the `getMnemonicString` method to determine the mnemonic of the native assembly instruction. At the end of this snippet, we copy/pasta code from StackOverflow to sort our collected data without really thinking about how it works and we call it a day. All joking aside, this is a pretty neat way to prioritize which instructions you should focus on learning if you're learning a new architecture and don't know where to begin.\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "id": "80797366",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[(MOV, 24), (JMP, 16), (LEA, 14), (ENDBR64, 13), (PUSH, 13), (CALL, 11), (JZ, 10), (CMP, 10), (RET, 9), (POP, 8), (SUB, 7), (ADD, 6), (NOP, 5), (TEST, 3), (SAR, 3), (JNZ, 3), (XOR, 2), (AND, 1), (HLT, 1), (SHR, 1), (JLE, 1), (JG, 1), (LEAVE, 1)]"
      ]
     },
     "execution_count": 15,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "val func = getFirstFunction()\n",
    "var inst = getInstructionAt((func.getEntryPoint()))\n",
    "// val instructions = mutableMapOf<String, Long>().withDefault { 0 }\n",
    "// while(inst != null) {\n",
    "//     val mnmonic = inst.mnemonicString\n",
    "//     instructions.put(mnmonic, instructions.getValue(mnmonic) + 1)\n",
    "//     inst = inst.getNext()\n",
    "// }\n",
    "val instList = mutableListOf<String>()\n",
    "while(inst != null) {\n",
    "    val mnmonic = inst.mnemonicString\n",
    "    instList += mnmonic\n",
    "    inst = inst.next\n",
    "}\n",
    "instList.groupBy { it }.mapValues { it.value.size }.toList().sortedByDescending { it.second }"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "55041361",
   "metadata": {},
   "source": [
    "## Tokenize a function\n",
    "\n",
    "Tokenize decompiled functions with ClangNode interface"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "id": "aa6ec2e9",
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[int, _init, (, EVP_PKEY_CTX, *, ctx, ), {, int, iVar1, ;, iVar1, =, __gmon_start__, (, ), ;, return, iVar1, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"int\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"_init\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"EVP_PKEY_CTX\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"*\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"ctx\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"int\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"iVar1\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"iVar1\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"=\",\"child\":null},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__gmon_start__\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"iVar1\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, FUN_00101020, (, void, ), {, (, *, (, code, *, ), (, undefined, *, ), 0x0, ), (, ), ;, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"FUN_00101020\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"*\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"code\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"*\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"undefined\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"*\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"0x0\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, __cxa_finalize, (, void, ), {, __cxa_finalize, (, ), ;, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__cxa_finalize\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__cxa_finalize\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[int, puts, (, char, *, __s, ), {, int, iVar1, ;, iVar1, =, puts, (, __s, ), ;, return, iVar1, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"int\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"puts\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"char\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"*\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"__s\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"int\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"iVar1\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"iVar1\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"=\",\"child\":null},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"puts\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"__s\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"iVar1\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[int, printf, (, char, *, __format, ,, ..., ), {, int, iVar1, ;, iVar1, =, printf, (, __format, ), ;, return, iVar1, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"int\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"printf\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"char\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"*\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"__format\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"...\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"int\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"iVar1\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"iVar1\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"=\",\"child\":null},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"printf\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"__format\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"iVar1\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, _start, (, undefined8, param_1, ,, undefined8, param_2, ,, undefined8, param_3, ), {, undefined8, unaff_retaddr, ;, undefined, auStack8, [, 8, ], ;, __libc_start_main, (, main, ,, unaff_retaddr, ,, &, stack0x00000008, ,, __libc_csu_init, ,, __libc_csu_fini, ,, param_3, ,, auStack8, ), ;, do, {, }, while, (, true, ), ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"_start\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"undefined8\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_1\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"undefined8\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_2\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"undefined8\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_3\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"undefined8\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"unaff_retaddr\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"undefined\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"auStack8\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"[\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"8\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"]\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__libc_start_main\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"main\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"unaff_retaddr\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"&\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"stack0x00000008\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"__libc_csu_init\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"__libc_csu_fini\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_3\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"auStack8\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"SYNTAX_TOKEN\",\"token\":\"do\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"while\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"true\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, deregister_tm_clones, (, void, ), {, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"deregister_tm_clones\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, register_tm_clones, (, void, ), {, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"register_tm_clones\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, __do_global_dtors_aux, (, void, ), {, if, (, completed.8061, !=, '\\0', ), {, return, ;, }, __cxa_finalize, (, __dso_handle, ), ;, deregister_tm_clones, (, ), ;, completed.8061, =, 1, ;, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__do_global_dtors_aux\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"if\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"completed.8061\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"!=\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"'\\\\0'\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__cxa_finalize\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"__dso_handle\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"deregister_tm_clones\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"completed.8061\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"=\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"1\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, frame_dummy, (, void, ), {, register_tm_clones, (, ), ;, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"frame_dummy\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"register_tm_clones\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[int, main, (, void, ), {, int, i, ;, for, (, i, =, 0, ;, i, <, 10, ;, i, =, i, +, 1, ), {, if, (, i, !=, 5, ), {, printf, (, \"%d\\n\", ,, (, ulong, ), (, uint, ), i, ), ;, }, }, while, (, 0, <, i, ), {, if, (, i, !=, 5, ), {, printf, (, \"%d\\n\", ,, (, ulong, ), (, uint, ), i, ), ;, i, =, i, +, -1, ;, }, }, if, (, i, ==, 0, ), {, puts, (, \"zero\", ), ;, }, else, if, (, i, ==, 1, ), {, puts, (, \"one\", ), ;, }, else, {, puts, (, \"default\", ), ;, }, return, 0, ;, }]\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"int\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"main\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"int\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"i\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"for\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"i\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"=\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"0\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"i\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"<\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"10\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"i\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"=\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"i\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"+\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"1\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"if\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"i\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"!=\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"5\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"printf\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"\\\"%d\\\\n\\\"\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"ulong\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"uint\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"i\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}]},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"while\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"0\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"<\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"i\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"if\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"i\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"!=\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"5\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"printf\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"\\\"%d\\\\n\\\"\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"ulong\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"uint\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"i\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"i\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"=\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"i\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"+\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"-1\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"if\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"i\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"==\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"0\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"puts\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"\\\"zero\\\"\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"else\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"if\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"i\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"==\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"1\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"puts\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"\\\"one\\\"\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"else\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"puts\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"\\\"default\\\"\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}]},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"0\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]}]}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, __libc_csu_init, (, EVP_PKEY_CTX, *, param_1, ,, undefined8, param_2, ,, undefined8, param_3, ), {, long, lVar1, ;, _init, (, param_1, ), ;, lVar1, =, 0, ;, do, {, (, *, (, code, *, ), (, &, __frame_dummy_init_array_entry, ), [, lVar1, ], ), (, (, ulong, ), param_1, &, 0xffffffff, ,, param_2, ,, param_3, ), ;, lVar1, =, lVar1, +, 1, ;, }, while, (, lVar1, !=, 1, ), ;, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__libc_csu_init\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"EVP_PKEY_CTX\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"*\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_1\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"undefined8\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_2\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"undefined8\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_3\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"long\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"lVar1\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"_init\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_1\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"lVar1\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"=\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"0\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"SYNTAX_TOKEN\",\"token\":\"do\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"*\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"code\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"*\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"&\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"__frame_dummy_init_array_entry\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"[\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"lVar1\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"]\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"ulong\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_1\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"&\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"0xffffffff\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_2\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_3\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"lVar1\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"=\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"lVar1\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"+\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"1\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"while\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"lVar1\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"!=\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"1\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, __libc_csu_fini, (, void, ), {, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__libc_csu_fini\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, _fini, (, void, ), {, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"_fini\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, _ITM_deregisterTMCloneTable, (, void, ), {, halt_baddata, (, ), ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"_ITM_deregisterTMCloneTable\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"halt_baddata\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[int, puts, (, char, *, __s, ), {, halt_baddata, (, ), ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"int\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"puts\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"char\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"*\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"__s\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"halt_baddata\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[int, printf, (, char, *, __format, ,, ..., ), {, halt_baddata, (, ), ;, }]\n",
      "\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"int\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"printf\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"char\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"*\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"__format\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"...\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"halt_baddata\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, __libc_start_main, (, void, ), {, halt_baddata, (, ), ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__libc_start_main\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"halt_baddata\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, __gmon_start__, (, void, ), {, halt_baddata, (, ), ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__gmon_start__\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"halt_baddata\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, _ITM_registerTMCloneTable, (, void, ), {, halt_baddata, (, ), ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"_ITM_registerTMCloneTable\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"halt_baddata\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, __cxa_finalize, (, void, ), {, halt_baddata, (, ), ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__cxa_finalize\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"halt_baddata\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n"
     ]
    }
   ],
   "source": [
    "import ghidra.app.decompiler.DecompileOptions\n",
    "import ghidra.app.decompiler.DecompInterface\n",
    "import ghidra.util.task.ConsoleTaskMonitor\n",
    "import ghidra.app.decompiler.*\n",
    "import kotlinx.serialization.*\n",
    "import kotlinx.serialization.json.*\n",
    "\n",
    "val options = DecompileOptions()\n",
    "val monitor = ConsoleTaskMonitor()\n",
    "val ifc = DecompInterface()\n",
    "ifc.setOptions(options)\n",
    "ifc.openProgram(currentProgram)\n",
    "\n",
    "val functionManager = currentProgram.getFunctionManager()\n",
    "val funcs = functionManager.getFunctions(true)\n",
    "\n",
    "enum class TokenType {\n",
    "    BREAK, COMMENT_TOKEN, FIELD_TOKEN, FUNC_NAME_TOKEN, FUNC_PROTO, FUNCTION, LABEL_TOKEN,\n",
    "    OP_TOKEN, RETURN_TYPE, STATEMENT, SYNTAX_TOKEN, TOKEN, TOKEN_GROUP, TYPE_TOKEN, VARIABLE_DECL, VARIABLE_TOKEN\n",
    "}\n",
    "\n",
    "@Serializable\n",
    "data class Token(\n",
    "    val type: TokenType,\n",
    "    val token: String?,\n",
    "    val child: List<Token>?\n",
    ") {\n",
    "    fun flatten():List<String> {\n",
    "        if (token != null) {\n",
    "            return listOf(token)\n",
    "        } else {\n",
    "            return child?.flatMap { it.flatten() } ?: listOf<String>()\n",
    "        }\n",
    "//         return token ?: child?.map {it.flatten()}?.filterNotNull()?.joinToString()\n",
    "    }\n",
    "}\n",
    "\n",
    "\n",
    "fun ClangNode.expand():Token? {\n",
    "    val type = when(this) {\n",
    "        is ClangBreak -> { TokenType.BREAK; return null }\n",
    "        is ClangCommentToken -> { TokenType.COMMENT_TOKEN; return null }\n",
    "        is ClangFieldToken -> { TokenType.FIELD_TOKEN}\n",
    "        is ClangFuncNameToken -> { TokenType.FUNC_NAME_TOKEN }\n",
    "        is ClangFuncProto -> { TokenType.FUNC_PROTO }\n",
    "        is ClangFunction -> { TokenType.FUNCTION }\n",
    "        is ClangLabelToken -> { TokenType.LABEL_TOKEN }\n",
    "        is ClangOpToken -> { TokenType.OP_TOKEN }\n",
    "        is ClangReturnType -> { TokenType.RETURN_TYPE }\n",
    "        is ClangStatement -> { TokenType.STATEMENT }\n",
    "        is ClangSyntaxToken -> {TokenType.SYNTAX_TOKEN }\n",
    "        is ClangToken -> { TokenType.TOKEN }\n",
    "        is ClangTokenGroup -> { TokenType.TOKEN_GROUP}\n",
    "        is ClangTypeToken -> { TokenType.TYPE_TOKEN }\n",
    "        is ClangVariableDecl -> { TokenType.VARIABLE_DECL }\n",
    "        is ClangVariableToken -> { TokenType.VARIABLE_TOKEN }\n",
    "        else -> {TokenType.TOKEN}\n",
    "    }\n",
    "    if (numChildren() == 0) {\n",
    "        return if(!toString().isEmpty() && !toString().isBlank()) Token(type, toString(), null) else null\n",
    "    } else {\n",
    "        return Token(\n",
    "            type,\n",
    "            null, \n",
    "            (0 until numChildren()).map {\n",
    "                Child(it).expand()\n",
    "            }.filterNotNull()\n",
    "        )\n",
    "    }\n",
    "}\n",
    "funcs.forEach { \n",
    "    val res = ifc.decompileFunction(it, 60, monitor)\n",
    "    val markUp = res.cCodeMarkup\n",
    "    val tokens = markUp.expand()\n",
    "    val jsonToken = Json.encodeToString(tokens)\n",
    "    println(tokens?.flatten())\n",
    "    println()\n",
    "    println(jsonToken)\n",
    "    println()\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "961dd52d",
   "metadata": {},
   "source": [
    "## Working with Variables\n",
    "\n",
    "### Get a stack variable from a Varnode or VarnodeAST\n",
    "When working with refined PCode you'll almost exclusively be dealing with `VarnodeAST` or `PCodeOpAST` objects. Correlating these objects to stack variables is not something exposed by the Ghidra API (as far as I can tell in v9.2.2). This leads to a complex mess of taking a varnode and comparing it to the decompiler's stack variable symbols for a given function.  It's not intutitive, and quite frankly, it's been the most confusing and complex thing I've done with the Ghidra API to date. \n",
    "\n",
    "This function works when you're passing a Varnode/AST of a simple variable, say something like this:\n",
    "\n",
    "\n",
    "```c\n",
    "memset(local_88,0,0x10);\n",
    "```\n",
    "\n",
    "If you want to know what that the first argument (`local_88`) is named \"local_88\" and get its size, you can use this function.  If that first parameter include nested `PCodeOpAST`s however, say something like `(char *)local_a8`, this function will not work because the variable is \"wrapped\" inside of a `CAST` operation. In order to work, this needs to be paired with `get_vars_from_varnode` (ctrl-f to find its definition) to unwrap this onion, isolate the variable VarnodeAST, and then pass it here. There's an example of doing that in this document under the heading \"Get stack variables from a PcodeOpAST\"."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "ec6fa6aa",
   "metadata": {},
   "outputs": [],
   "source": [
    "TODO()\n",
    "// def get_stack_var_from_varnode(func, varnode):\n",
    "//     if type(varnode) not in [Varnode, VarnodeAST]:\n",
    "//         raise Exception(\"Invalid value. Expected `Varnode` or `VarnodeAST`, got {}.\".format(type(varnode)))\n",
    "    \n",
    "//     bitness_masks = {\n",
    "//         '16': 0xffff,\n",
    "//         '32': 0xffffffff,\n",
    "//         '64': 0xffffffffffffffff,\n",
    "//     }\n",
    "\n",
    "//     try:\n",
    "//       addr_size = currentProgram.getMetadata()['Address Size']\n",
    "//       bitmask = bitness_masks[addr_size]\n",
    "//     except KeyError:\n",
    "//       raise Exception(\"Unsupported bitness: {}. Add a bit mask for this target.\".format(addr_size))\n",
    "\n",
    "//     local_variables = func.getAllVariables()\n",
    "//     vndef = varnode.getDef()\n",
    "//     if vndef:\n",
    "//         vndef_inputs = vndef.getInputs()\n",
    "//         for defop_input in vndef_inputs:\n",
    "//             defop_input_offset = defop_input.getAddress().getOffset() & bitmask\n",
    "//             for lv in local_variables:\n",
    "//                 unsigned_lv_offset = lv.getMinAddress().getUnsignedOffset() & bitmask\n",
    "//                 if unsigned_lv_offset == defop_input_offset:\n",
    "//                     return lv\n",
    "        \n",
    "//         # If we get here, varnode is likely a \"acStack##\" variable.\n",
    "//         hf = get_high_function(func)\n",
    "//         lsm = hf.getLocalSymbolMap()\n",
    "//         for vndef_input in vndef_inputs:\n",
    "//             defop_input_offset = vndef_input.getAddress().getOffset() & bitmask\n",
    "//             for symbol in lsm.getSymbols():\n",
    "//                 if symbol.isParameter(): \n",
    "//                     continue\n",
    "//                 if defop_input_offset == symbol.getStorage().getFirstVarnode().getOffset() & bitmask:\n",
    "//                     return symbol\n",
    "\n",
    "//     # unable to resolve stack variable for given varnode\n",
    "//     return None"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "da796ba7",
   "metadata": {},
   "source": [
    "\n",
    "### Get stack variables from a PcodeOpAST\n",
    "If you took a look at the code under the section \"Get a stack variable from a Varnode or VarnodeAST\", you'll probably be asking why that code works for something like: `memset(local_88,0,0x10);` but it fails for `strchr((char *)local_a8,10);`. The reason is that `local_88` is a `VarnodeAST` while `(char *)local_a8` is a `PcodeOpAST`. In other words, the `local_a8` varnode is \"wrapped\" inside of a `PcodeOpAST` and you can't associate it to any kind of meaningful value without first \"unwrapping\" it. Of course, a wrapped `VarnodeAST` could be wrapped in numerous `CAST` operations and `INT_ADD` operations, etc.  So how do we handle this? Recursion. * shudder *. \n",
    "\n",
    "Fair warning, recursion is my computer science nemisis. If you look at this code and think \"this is odd\" - you're probably right!\n",
    "\n",
    "That being said, let's slap something like `(char *)local_a8` into this function and see if we can get the associated variable name(s) out of it. It's perfectly fine to pass a `PcodeOpAST` with multiple variables (e.g. `(long)iVar2 + local_a0`) into this function. It will just return a list of all variables contained in that `VarnodeAST`.\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "cac3f2db",
   "metadata": {},
   "outputs": [],
   "source": [
    "TODO()\n",
    "// def get_vars_from_varnode(func, node, variables=None):\n",
    "//     if type(node) not in [PcodeOpAST, VarnodeAST]:\n",
    "//         raise Exception(\"Invalid value passed. Got {}.\".format(type(node)))\n",
    "\n",
    "//     # create `variables` list on first call. Do not make `variables` default to [].\n",
    "//     if variables == None:\n",
    "//         variables = []\n",
    "\n",
    "//     # We must use `getDef()` on VarnodeASTs\n",
    "//     if type(node) == VarnodeAST:\n",
    "//         # For `get_stack_var_from_varnode` see:\n",
    "//         # https://github.com/HackOvert/GhidraSnippets \n",
    "//         # Ctrl-F for \"get_stack_var_from_varnode\"\n",
    "//         var = get_stack_var_from_varnode(func, node)\n",
    "//         if var and type(var) != HighSymbol:\n",
    "//             variables.append(var.getName())\n",
    "//         node = node.getDef()\n",
    "//         if node:\n",
    "//             variables = get_vars_from_varnode(func, node, variables)\n",
    "\n",
    "//     # We must call `getInputs()` on PcodeOpASTs\n",
    "//     elif type(node) == PcodeOpAST:\n",
    "//         nodes = list(node.getInputs())\n",
    "//         for node in nodes:\n",
    "//             if type(node.getHigh()) == HighLocal:\n",
    "//                 variables.append(node.getHigh().getName())\n",
    "//             else:\n",
    "//                 variables = get_vars_from_varnode(func, node, variables)\n",
    "\n",
    "//     return variables"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f910e058",
   "metadata": {},
   "source": [
    "## Working with Basic Blocks\n",
    "Basic Blocks are collections of continuous non-branching instructions within Functions. They are joined by conditional and non-conditional branches, revealing valuable information about a program and function's code flow. This section deals with examples working with Basic Block models."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "id": "4e133e73",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Basic block details for function 'main':\n",
      "\t[*] 00101169 \n",
      "\t[*] 0010117c -> 001011a1 \n",
      "\t[*] 00101182 -> 0010119c \n",
      "\t[*] 00101182 -> 00101184 \n",
      "\t[*] 0010119a -> 0010119d \n",
      "\t[*] 0010119c -> 0010119d \n",
      "\t[*] 0010119d -> 001011a1 \n",
      "\t[*] 001011a5 -> 0010117e \n",
      "\t[*] 001011a5 -> 001011a7 \n",
      "\t[*] 001011a7 -> 001011cb \n",
      "\t[*] 001011ad -> 001011b1 \n",
      "\t[*] 001011ad -> 001011af \n",
      "\t[*] 001011af -> 001011cb \n",
      "\t[*] 001011c7 -> 001011cb \n",
      "\t[*] 001011cf -> 001011a9 \n",
      "\t[*] 001011cf -> 001011d1 \n",
      "\t[*] 001011d5 -> 001011df \n",
      "\t[*] 001011d5 -> 001011d7 \n",
      "\t[*] 001011db -> 001011ed \n",
      "\t[*] 001011db -> 001011dd \n",
      "\t[*] 001011dd -> 001011fb \n",
      "\t[*] 001011eb -> 00101208 \n",
      "\t[*] 001011f9 -> 00101208 \n",
      "\t[*] 00101207 -> 00101208 \n"
     ]
    }
   ],
   "source": [
    "import ghidra.program.model.block.BasicBlockModel\n",
    "import ghidra.util.task.ConsoleTaskMonitor\n",
    "\n",
    "val FUNC_NAME=\"main\"\n",
    "val blockModel = BasicBlockModel(currentProgram)\n",
    "val monitor = ConsoleTaskMonitor()\n",
    "val func = getGlobalFunctions(FUNC_NAME)[0]\n",
    "\n",
    "println(\"Basic block details for function '${FUNC_NAME}':\")\n",
    "val blocks = blockModel.getCodeBlocksContaining(func.body, monitor)\n",
    "\n",
    "//  print first block\n",
    "println(\"\\t[*] ${func.entryPoint} \")\n",
    "blocks.forEach {\n",
    "    val dest = it.getDestinations(monitor)\n",
    "    while(dest.hasNext()) {\n",
    "        val dbb = dest.next()\n",
    "//         For some odd reason `getCodeBlocksContaining()` and `.next()`\n",
    "//         return the root basic block after CALL instructions (x86). To filter\n",
    "//         these out, we use `getFunctionAt()` which returns `None` if the address\n",
    "//         is not the entry point of a function. See:\n",
    "//         https://github.com/NationalSecurityAgency/ghidra/issues/855\n",
    "        if(getFunctionAt(dbb.getDestinationAddress()) == null)\n",
    "            println(\"\\t[*] ${dbb} \")\n",
    "    }\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "db3ba953",
   "metadata": {},
   "source": [
    "## Working with the Decompiler\n",
    "\n",
    "### Print decompiled code for a specific function\n",
    "Ghidra's decompiler is an exceptional resource. In certain cases you might want to extract the decompiler output for a list of functions. Here's an easy way to gather that information.  Just add your own file I/O code to dump everything to individual files for analysis."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "id": "fd201282",
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n",
      "int main(void)\n",
      "\n",
      "{\n",
      "  int i;\n",
      "  \n",
      "  for (i = 0; i < 10; i = i + 1) {\n",
      "    if (i != 5) {\n",
      "      printf(\"%d\\n\",(ulong)(uint)i);\n",
      "    }\n",
      "  }\n",
      "  while (0 < i) {\n",
      "    if (i != 5) {\n",
      "      printf(\"%d\\n\",(ulong)(uint)i);\n",
      "      i = i + -1;\n",
      "    }\n",
      "  }\n",
      "  if (i == 0) {\n",
      "    puts(\"zero\");\n",
      "  }\n",
      "  else if (i == 1) {\n",
      "    puts(\"one\");\n",
      "  }\n",
      "  else {\n",
      "    puts(\"default\");\n",
      "  }\n",
      "  return 0;\n",
      "}\n",
      "\n",
      "\n"
     ]
    }
   ],
   "source": [
    "import ghidra.util.task.ConsoleTaskMonitor\n",
    "import ghidra.app.decompiler.*\n",
    "\n",
    "val options = DecompileOptions()\n",
    "val monitor = ConsoleTaskMonitor()\n",
    "val ifc = DecompInterface()\n",
    "ifc.setOptions(options)\n",
    "ifc.openProgram(currentProgram)\n",
    "\n",
    "val func = getGlobalFunctions(\"main\")[0]\n",
    "val results = ifc.decompileFunction(func, 0, ConsoleTaskMonitor())\n",
    "println(results.getDecompiledFunction().getC())"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "bf169e5c",
   "metadata": {},
   "source": [
    "### Getting variable information from the decompiler\n",
    "Ghidra's decompiler performs a lot of analysis in order to recover variable information.  If you're interested in getting this information you'll need to use the decompiler interface to get a high function and its symbols.  Once you have this data, you can enumerate the symbols and retrieve information about variables in the target function.  Let's take a look at an example decompiled function:\n",
    "\n",
    "\n",
    "```c++\n",
    "undefined8 func(int param_1,int param_2)\n",
    "{\n",
    "  long in_FS_OFFSET;\n",
    "  uint auStack88 [8];\n",
    "  undefined4 auStack56 [10];\n",
    "  long local_10;\n",
    "  \n",
    "  local_10 = *(long *)(in_FS_OFFSET + 0x28);\n",
    "  auStack56[param_1] = 1;\n",
    "  printf(\"%d\\n\",(ulong)auStack88[param_2]);\n",
    "  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {\n",
    "    __stack_chk_fail();\n",
    "  }\n",
    "  return 0;\n",
    "}\n",
    "```\n",
    "\n",
    "The decompiled function above shows two stack variables that seem interesting to us; auStack88 and auStack56.  Let's get that information programmatically."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "id": "5f2598c3",
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n",
      "Symbol 1:\n",
      "  name:         i\n",
      "  dataType:     int\n",
      "  getPCAddress: 0xnull\n",
      "  size:         4\n",
      "  storage:      Stack[-0xc]:4\n",
      "  parameter:    false\n",
      "  readOnly:     false\n",
      "  typeLocked:   true\n",
      "  nameLocked:   true\n",
      "  slot:         -1\n"
     ]
    }
   ],
   "source": [
    "import ghidra.util.task.ConsoleTaskMonitor\n",
    "import ghidra.app.decompiler.*\n",
    "\n",
    "val options = DecompileOptions()\n",
    "val monitor = ConsoleTaskMonitor()\n",
    "val ifc = DecompInterface()\n",
    "ifc.setOptions(options)\n",
    "ifc.openProgram(currentProgram)\n",
    "\n",
    "val func = getGlobalFunctions(\"main\")[0]\n",
    "val results = ifc.decompileFunction(func, 0, ConsoleTaskMonitor())\n",
    "val highFunc = results.getHighFunction()\n",
    "val localSymbolMap = highFunc.localSymbolMap\n",
    "val symbols = localSymbolMap.symbols\n",
    "\n",
    "symbols.withIndex().forEach { \n",
    "    println(\"\\nSymbol ${it.index + 1}:\")\n",
    "    it.value.run {\n",
    "        println(\"  name:         ${name}\")\n",
    "        println(\"  dataType:     ${dataType}\")\n",
    "        println(\"  getPCAddress: 0x${pcAddress}\")\n",
    "        println(\"  size:         ${size}\")\n",
    "        println(\"  storage:      ${storage}\")\n",
    "        println(\"  parameter:    ${isParameter}\")\n",
    "        println(\"  readOnly:     ${isReadOnly}\")\n",
    "        println(\"  typeLocked:   ${isTypeLocked}\")\n",
    "        println(\"  nameLocked:   ${isNameLocked}\")\n",
    "        println(\"  slot:         ${this.categoryIndex}\")\n",
    "    }\n",
    "    \n",
    "//     println(\"  parameter:    ${it.value.parameter}\")\n",
    "//     println(\"  readOnly:     ${it.value.readOnly}\")\n",
    "//     println(\"  typeLocked:   ${it.value.typeLocked}\")\n",
    "//     println(\"  nameLocked:   ${it.value.nameLocked}\")\n",
    "//     println(\"  slot:         ${it.value.slot}\")\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "24be0724",
   "metadata": {},
   "source": [
    "## Working with Comments\n",
    "\n",
    "### Get all Automatic comments for a function\n",
    "\n",
    "Ghidra adds \"automatic comments\" (light gray in color) in the EOL field. Here's how you can access those comments."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "id": "3b0ef342",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Array\n",
      "undefined register_tm_clones()\n",
      "undefined register_tm_clones()\n"
     ]
    }
   ],
   "source": [
    "import ghidra.app.util.DisplayableEol\n",
    "\n",
    "val listing = currentProgram.listing\n",
    "val func = getGlobalFunctions(\"frame_dummy\")[0]\n",
    "val addrSet = func.body\n",
    "val codeUnits = listing.getCodeUnits(addrSet, true)\n",
    "\n",
    "codeUnits.forEach {\n",
    "    val deol = DisplayableEol(it, true, true, true, true, 5, true, true)\n",
    "    if (deol.hasAutomatic()) {\n",
    "        val ac = deol.getAutomaticComment()\n",
    "        println(ac::class.simpleName)\n",
    "        println(ac.joinToString())\n",
    "        println(ac[0])\n",
    "    }\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "7b1be53a",
   "metadata": {},
   "source": [
    "### Get specific comment types for all functions\n",
    "\n",
    "Ghidra supports 5 unique comment types users can add to their projects. This snippet shows you show to print all comments by type. This snippet is a slightly modified version of what user `u/securisec` posted in the Ghidra subreddit, `r/ghidra`. Thanks!\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "id": "310fb632",
   "metadata": {},
   "outputs": [],
   "source": [
    "val functionManager = currentProgram.getFunctionManager()\n",
    "val listing = currentProgram.getListing()\n",
    "val funcs = functionManager.getFunctions(true) // True means iterate forward\n",
    "\n",
    "// val commentTypesMap = mapOf (\n",
    "//     0 to \"EOL\", \n",
    "//     1 to \"PRE\", \n",
    "//     2 to \"POST\",\n",
    "//     3 to \"PLATE\",\n",
    "//     4 to \"REPEATABLE\",\n",
    "// )\n",
    "val commentTypes = listOf(\"EOL\", \"PRE\", \"POST\", \"PLATE\", \"REPEATABLE\")\n",
    "\n",
    "funcs.forEach {\n",
    "    val addrSet = it.body\n",
    "    val codeUnits = listing.getCodeUnits(addrSet, true)\n",
    "    codeUnits.forEach { \n",
    "        codeUnit -> {\n",
    "            commentTypes.forEachIndexed { \n",
    "                index, value -> {\n",
    "                    val comment = codeUnit.getComment(index + 1)\n",
    "                    comment.run {\n",
    "                        println(\"[${it.name}: {codeUnit.address}] ${value}: {comment}\")\n",
    "                    }\n",
    "                }\n",
    "                \n",
    "            }\n",
    "        }\n",
    "        \n",
    "    }\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "476b931f",
   "metadata": {},
   "source": [
    "## Working with PCode\n",
    "\n",
    "### Emulating a function\n",
    "Instruction emulation is an extremely powerful technique to asist in static code analysis.  Rarely however, do we have the full memory context in which dynamic code executes. So while emulation can bring an element of 'dynamic' analysis to static RE, it's typically plagued with problems of unknown memory state. For simple code this might be no problem. For object oriented code this can be a major difficulty.  Either way, some element of emulation can help tremendously in speeding up analysis.  Ghidra uses its internal intermediate representation (PCode) to define what instructions do. Emulation is the process of tracking these changes in a cumulative state. Unfortunely Ghidra doesn't provide fancy GUI controls around the emulator (yet), but it's fully scriptable. Ghidra v9.1 added emprovements to the `EmulatorHelper` class, which is really quite amazing. Here's a simple example of what you can do with it."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "id": "d2f5221e",
   "metadata": {},
   "outputs": [],
   "source": [
    "import ghidra.app.emulator.EmulatorHelper\n",
    "import ghidra.program.model.symbol.SymbolUtilities\n",
    "\n",
    "fun getSymbolAddress(symbolName:String) = SymbolUtilities.getLabelOrFunctionSymbol(currentProgram, symbolName, null)?.address\n",
    "\n",
    "val paramRegisterList = currentProgram.programContext.registers"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "id": "b8e9550d",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Memory at 0x000000000008C000: ccbbaa99\n",
      "Memory at 0x00000000000CF000: 99aabbcc\n",
      "Emulation starting at 0x00101169\n",
      "Address: 0x00101169 (ENDBR64)\n",
      "  RIP = 0x0000000000101169\n",
      "  RAX = 0x0000000000000020\n",
      "  RBX = 0x0000000000000000\n",
      "  RCX = 0x0000000000000000\n",
      "  RDX = 0x0000000000000000\n",
      "  RSI = 0x0000000000000000\n",
      "  RDI = 0x0000000000000000\n",
      "  RSP = 0x000000002fff0000\n",
      "  RBP = 0x000000002fff0000\n",
      "  rflags = 0x0000000000000000\n",
      "Address: 0x0010116d (PUSH RBP)\n",
      "  RIP = 0x000000000010116d\n",
      "  RAX = 0x0000000000000020\n",
      "  RBX = 0x0000000000000000\n",
      "  RCX = 0x0000000000000000\n",
      "  RDX = 0x0000000000000000\n",
      "  RSI = 0x0000000000000000\n",
      "  RDI = 0x0000000000000000\n",
      "  RSP = 0x000000002fff0000\n",
      "  RBP = 0x000000002fff0000\n",
      "  rflags = 0x0000000000000000\n",
      "Address: 0x0010116e (MOV RBP,RSP)\n",
      "  RIP = 0x000000000010116e\n",
      "  RAX = 0x0000000000000020\n",
      "  RBX = 0x0000000000000000\n",
      "  RCX = 0x0000000000000000\n",
      "  RDX = 0x0000000000000000\n",
      "  RSI = 0x0000000000000000\n",
      "  RDI = 0x0000000000000000\n",
      "  RSP = 0x000000002ffefff8\n",
      "  RBP = 0x000000002fff0000\n",
      "  rflags = 0x0000000000000000\n",
      "Address: 0x00101171 (SUB RSP,0x10)\n",
      "  RIP = 0x0000000000101171\n",
      "  RAX = 0x0000000000000020\n",
      "  RBX = 0x0000000000000000\n",
      "  RCX = 0x0000000000000000\n",
      "  RDX = 0x0000000000000000\n",
      "  RSI = 0x0000000000000000\n",
      "  RDI = 0x0000000000000000\n",
      "  RSP = 0x000000002ffefff8\n",
      "  RBP = 0x000000002ffefff8\n",
      "  rflags = 0x0000000000000000\n",
      "Address: 0x00101175 (MOV dword ptr [RBP + -0x4],0x0)\n",
      "  RIP = 0x0000000000101175\n",
      "  RAX = 0x0000000000000020\n",
      "  RBX = 0x0000000000000000\n",
      "  RCX = 0x0000000000000000\n",
      "  RDX = 0x0000000000000000\n",
      "  RSI = 0x0000000000000000\n",
      "  RDI = 0x0000000000000000\n",
      "  RSP = 0x000000002ffeffe8\n",
      "  RBP = 0x000000002ffefff8\n",
      "  rflags = 0x0000000000000000\n",
      "Address: 0x0010117c (JMP 0x001011a1)\n",
      "  RIP = 0x000000000010117c\n",
      "  RAX = 0x0000000000000020\n",
      "  RBX = 0x0000000000000000\n",
      "  RCX = 0x0000000000000000\n",
      "  RDX = 0x0000000000000000\n",
      "  RSI = 0x0000000000000000\n",
      "  RDI = 0x0000000000000000\n",
      "  RSP = 0x000000002ffeffe8\n",
      "  RBP = 0x000000002ffefff8\n",
      "  rflags = 0x0000000000000000\n",
      "Address: 0x001011a1 (CMP dword ptr [RBP + -0x4],0x9)\n",
      "  RIP = 0x00000000001011a1\n",
      "  RAX = 0x0000000000000020\n",
      "  RBX = 0x0000000000000000\n",
      "  RCX = 0x0000000000000000\n",
      "  RDX = 0x0000000000000000\n",
      "  RSI = 0x0000000000000000\n",
      "  RDI = 0x0000000000000000\n",
      "  RSP = 0x000000002ffeffe8\n",
      "  RBP = 0x000000002ffefff8\n",
      "  rflags = 0x0000000000000000\n",
      "Address: 0x001011a5 (JLE 0x0010117e)\n",
      "  RIP = 0x00000000001011a5\n",
      "  RAX = 0x0000000000000020\n",
      "  RBX = 0x0000000000000000\n",
      "  RCX = 0x0000000000000000\n",
      "  RDX = 0x0000000000000000\n",
      "  RSI = 0x0000000000000000\n",
      "  RDI = 0x0000000000000000\n",
      "  RSP = 0x000000002ffeffe8\n",
      "  RBP = 0x000000002ffefff8\n",
      "  rflags = 0x0000000000000000\n",
      "Address: 0x0010117e (CMP dword ptr [RBP + -0x4],0x5)\n",
      "  RIP = 0x000000000010117e\n",
      "  RAX = 0x0000000000000020\n",
      "  RBX = 0x0000000000000000\n",
      "  RCX = 0x0000000000000000\n",
      "  RDX = 0x0000000000000000\n",
      "  RSI = 0x0000000000000000\n",
      "  RDI = 0x0000000000000000\n",
      "  RSP = 0x000000002ffeffe8\n",
      "  RBP = 0x000000002ffefff8\n",
      "  rflags = 0x0000000000000000\n",
      "Address: 0x00101182 (JZ 0x0010119c)\n",
      "  RIP = 0x0000000000101182\n",
      "  RAX = 0x0000000000000020\n",
      "  RBX = 0x0000000000000000\n",
      "  RCX = 0x0000000000000000\n",
      "  RDX = 0x0000000000000000\n",
      "  RSI = 0x0000000000000000\n",
      "  RDI = 0x0000000000000000\n",
      "  RSP = 0x000000002ffeffe8\n",
      "  RBP = 0x000000002ffefff8\n",
      "  rflags = 0x0000000000000000\n",
      "Address: 0x00101184 (MOV EAX,dword ptr [RBP + -0x4])\n",
      "  RIP = 0x0000000000101184\n",
      "  RAX = 0x0000000000000020\n",
      "  RBX = 0x0000000000000000\n",
      "  RCX = 0x0000000000000000\n",
      "  RDX = 0x0000000000000000\n",
      "  RSI = 0x0000000000000000\n",
      "  RDI = 0x0000000000000000\n",
      "  RSP = 0x000000002ffeffe8\n",
      "  RBP = 0x000000002ffefff8\n",
      "  rflags = 0x0000000000000000\n",
      "Address: 0x00101187 (MOV ESI,EAX)\n",
      "  RIP = 0x0000000000101187\n",
      "  RAX = 0x0000000000000000\n",
      "  RBX = 0x0000000000000000\n",
      "  RCX = 0x0000000000000000\n",
      "  RDX = 0x0000000000000000\n",
      "  RSI = 0x0000000000000000\n",
      "  RDI = 0x0000000000000000\n",
      "  RSP = 0x000000002ffeffe8\n",
      "  RBP = 0x000000002ffefff8\n",
      "  rflags = 0x0000000000000000\n",
      "Address: 0x00101189 (LEA RDI,[0x102004])\n",
      "  RIP = 0x0000000000101189\n",
      "  RAX = 0x0000000000000000\n",
      "  RBX = 0x0000000000000000\n",
      "  RCX = 0x0000000000000000\n",
      "  RDX = 0x0000000000000000\n",
      "  RSI = 0x0000000000000000\n",
      "  RDI = 0x0000000000000000\n",
      "  RSP = 0x000000002ffeffe8\n",
      "  RBP = 0x000000002ffefff8\n",
      "  rflags = 0x0000000000000000\n",
      "Address: 0x00101190 (MOV EAX,0x0)\n",
      "  RIP = 0x0000000000101190\n",
      "  RAX = 0x0000000000000000\n",
      "  RBX = 0x0000000000000000\n",
      "  RCX = 0x0000000000000000\n",
      "  RDX = 0x0000000000000000\n",
      "  RSI = 0x0000000000000000\n",
      "  RDI = 0x0000000000102004\n",
      "  RSP = 0x000000002ffeffe8\n",
      "  RBP = 0x000000002ffefff8\n",
      "  rflags = 0x0000000000000000\n",
      "Address: 0x00101195 (CALL 0x00101070)\n",
      "  RIP = 0x0000000000101195\n",
      "  RAX = 0x0000000000000000\n",
      "  RBX = 0x0000000000000000\n",
      "  RCX = 0x0000000000000000\n",
      "  RDX = 0x0000000000000000\n",
      "  RSI = 0x0000000000000000\n",
      "  RDI = 0x0000000000102004\n",
      "  RSP = 0x000000002ffeffe8\n",
      "  RBP = 0x000000002ffefff8\n",
      "  rflags = 0x0000000000000000\n",
      "Address: 0x00101070 (ENDBR64)\n",
      "  RIP = 0x0000000000101070\n",
      "  RAX = 0x0000000000000000\n",
      "  RBX = 0x0000000000000000\n",
      "  RCX = 0x0000000000000000\n",
      "  RDX = 0x0000000000000000\n",
      "  RSI = 0x0000000000000000\n",
      "  RDI = 0x0000000000102004\n",
      "  RSP = 0x000000002ffeffe0\n",
      "  RBP = 0x000000002ffefff8\n",
      "  rflags = 0x0000000000000000\n",
      "Address: 0x00101074 (JMP qword ptr [0x00103fd0])\n",
      "  RIP = 0x0000000000101074\n",
      "  RAX = 0x0000000000000000\n",
      "  RBX = 0x0000000000000000\n",
      "  RCX = 0x0000000000000000\n",
      "  RDX = 0x0000000000000000\n",
      "  RSI = 0x0000000000000000\n",
      "  RDI = 0x0000000000102004\n",
      "  RSP = 0x000000002ffeffe0\n",
      "  RBP = 0x000000002ffefff8\n",
      "  rflags = 0x0000000000000000\n",
      "Address: 0x00105010 (null)\n",
      "  RIP = 0x0000000000105010\n",
      "  RAX = 0x0000000000000000\n",
      "  RBX = 0x0000000000000000\n",
      "  RCX = 0x0000000000000000\n",
      "  RDX = 0x0000000000000000\n",
      "  RSI = 0x0000000000000000\n",
      "  RDI = 0x0000000000102004\n",
      "  RSP = 0x000000002ffeffe0\n",
      "  RBP = 0x000000002ffefff8\n",
      "  rflags = 0x0000000000000000\n"
     ]
    }
   ],
   "source": [
    "val CONTROLLED_RETURN_OFFSET = 0\n",
    "\n",
    "// Identify function to be emulated\n",
    "val mainFunctionEntry = getSymbolAddress(\"main\")\n",
    "\n",
    "//  Establish emulation helper, please check out the API docs\n",
    "//  for `EmulatorHelper` - there's a lot of helpful things\n",
    "//  to help make architecture agnostic emulator tools.\n",
    "val emuHelper = EmulatorHelper(currentProgram)\n",
    "\n",
    "// Set controlled return location so we can identify return from emulated function\n",
    "val controlledReturnAddress = toAddr(CONTROLLED_RETURN_OFFSET)\n",
    "\n",
    "// Set initial RIP\n",
    "val mainFunctionEntryLong = mainFunctionEntry!!.offset\n",
    "emuHelper.writeRegister(emuHelper.pcRegister, mainFunctionEntryLong)\n",
    "\n",
    "// For x86_64 `registers` contains 872 registers! You probably don't\n",
    "// want to print all of these. Just be aware, and print what you need.\n",
    "// To see all supported registers. just print `registers`.\n",
    "// We won't use this, it's just here to show you how to query\n",
    "// valid registers for your target architecture.\n",
    "val registers = paramRegisterList\n",
    "\n",
    "//  Here's a list of all the registers we want printed after each\n",
    "//  instruction. Modify this as you see fit, based on your architecture.\n",
    "val regFilter = listOf(\n",
    "    \"RIP\", \"RAX\", \"RBX\", \"RCX\", \"RDX\", \"RSI\", \"RDI\", \n",
    "    \"RSP\", \"RBP\", \"rflags\"\n",
    ")\n",
    "\n",
    "//  Setup your desired starting state. By default, all registers\n",
    "//  and memory will be 0. This may or may not be acceptable for\n",
    "//  you. So please be aware.\n",
    "emuHelper.writeRegister(\"RAX\", 0x20)\n",
    "emuHelper.writeRegister(\"RSP\", 0x000000002FFF0000)\n",
    "emuHelper.writeRegister(\"RBP\", 0x000000002FFF0000)\n",
    "\n",
    "//  There are a couple of ways to write memory, use `writeMemoryValue` if you want\n",
    "//  to set a small typed value (e.g. uint64). Use `writeMemory` if you're mapping in\n",
    "//  a lot of memory (e.g. from a debugger memory dump). Note that each of these\n",
    "//  methods write with different endianess, see the example output.\n",
    "emuHelper.writeMemoryValue(toAddr(0x000000000008C000), 4, 0x99AABBCC)  // writes big endian\n",
    "emuHelper.writeMemory(toAddr(0x00000000000CF000), ubyteArrayOf(0x99u, 0xaau, 0xbbu, 0xccu).toByteArray())//\"\\x99\\xAA\\xBB\\xCC\") // writes little endian\n",
    "\n",
    "// You can verify writes worked, or just read memory at select points\n",
    "// during emulation. Here's a couple of examples:\n",
    "val mem1 = emuHelper.readMemory(toAddr(0x000000000008C000), 4)\n",
    "val mem2 = emuHelper.readMemory(toAddr(0x00000000000CF000), 4)\n",
    "\n",
    "println(\"Memory at 0x000000000008C000: ${mem1.joinToString(\"\") { \"%02x\".format(it) }}\")\n",
    "println(\"Memory at 0x00000000000CF000: ${mem2.joinToString(\"\") { \"%02x\".format(it) }}\")\n",
    "\n",
    "println(\"Emulation starting at 0x${mainFunctionEntry}\")\n",
    "\n",
    "while(monitor.isCancelled() == false) {\n",
    "    // Check the current address in the program counter, if it's\n",
    "    // zero (our `CONTROLLED_RETURN_OFFSET` value) stop emulation.\n",
    "    // Set this to whatever end target you want.\n",
    "    val executionAddress = emuHelper.getExecutionAddress()\n",
    "    if(executionAddress == controlledReturnAddress) {\n",
    "        println(\"Emulation complete.\")\n",
    "        break\n",
    "    }\n",
    "    \n",
    "    // Print current instruction and the registers we care about\n",
    "    println(\"Address: 0x${executionAddress} (${getInstructionAt(executionAddress)})\")\n",
    "    regFilter.forEach {\n",
    "        println(\"  ${it} = 0x%016x\".format(emuHelper.readRegister(it)))\n",
    "    }\n",
    "    // single step emulation\n",
    "    val success = emuHelper.step(monitor)\n",
    "    if (success == false) {\n",
    "        val lastError = emuHelper.getLastError()\n",
    "        printerr(\"Emulation Error: '${lastError}'\")\n",
    "        break\n",
    "    }\n",
    "}\n",
    "\n",
    "// Cleanup resources and release hold on currentProgram\n",
    "emuHelper.dispose()"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a48e09ab",
   "metadata": {},
   "source": [
    "### Dumping Raw PCode\n",
    "PCode exists in two primary forms you as a user should consider, \"raw\" and \"refined\".  In documentation both forms are simply referred to as \"PCode\" making it confusing to talk about - so I distinguish between the forms using raw and refined. Just know theses are not universally accepted terms. \n",
    "\n",
    "So raw PCode is the first pass, and the form that's displayed in the \"Listing\" pane inside the Ghidra UI.  It's extremely verbose and explicit. This is the form you want to use when emulating, if you're writing a symbolic executor, or anything of the sort.  If you want details from the decompiler passes, you want to analyze refined PCode, not this stuff!  So what does it look like and how do you access it? Let's take a look."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "id": "3b49b318",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "class ghidra.program.database.function.FunctionDB"
      ]
     },
     "execution_count": 26,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "getGlobalFunctions(\"main\")[0]::class"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "id": "0ca5c366",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "ENDBR64\n",
      "PUSH RBP\n",
      "  (unique, 0xed00, 8) COPY (register, 0x28, 8)\n",
      "  (register, 0x20, 8) INT_SUB (register, 0x20, 8) , (const, 0x8, 8)\n",
      "   ---  STORE (const, 0x1b1, 8) , (register, 0x20, 8) , (unique, 0xed00, 8)\n",
      "MOV RBP,RSP\n",
      "  (register, 0x28, 8) COPY (register, 0x20, 8)\n",
      "SUB RSP,0x10\n",
      "  (register, 0x200, 1) INT_LESS (register, 0x20, 8) , (const, 0x10, 8)\n",
      "  (register, 0x20b, 1) INT_SBORROW (register, 0x20, 8) , (const, 0x10, 8)\n",
      "  (register, 0x20, 8) INT_SUB (register, 0x20, 8) , (const, 0x10, 8)\n",
      "  (register, 0x207, 1) INT_SLESS (register, 0x20, 8) , (const, 0x0, 8)\n",
      "  (register, 0x206, 1) INT_EQUAL (register, 0x20, 8) , (const, 0x0, 8)\n",
      "  (unique, 0x13180, 8) INT_AND (register, 0x20, 8) , (const, 0xff, 8)\n",
      "  (unique, 0x13200, 1) POPCOUNT (unique, 0x13180, 8)\n",
      "  (unique, 0x13280, 1) INT_AND (unique, 0x13200, 1) , (const, 0x1, 1)\n",
      "  (register, 0x202, 1) INT_EQUAL (unique, 0x13280, 1) , (const, 0x0, 1)\n",
      "MOV dword ptr [RBP + -0x4],0x0\n",
      "  (unique, 0x3100, 8) INT_ADD (register, 0x28, 8) , (const, 0xfffffffffffffffc, 8)\n",
      "  (unique, 0xbf80, 4) COPY (const, 0x0, 4)\n",
      "   ---  STORE (const, 0x1b1, 4) , (unique, 0x3100, 8) , (unique, 0xbf80, 4)\n",
      "JMP 0x001011a1\n",
      "   ---  BRANCH (ram, 0x1011a1, 8)\n",
      "CMP dword ptr [RBP + -0x4],0x5\n",
      "  (unique, 0x3100, 8) INT_ADD (register, 0x28, 8) , (const, 0xfffffffffffffffc, 8)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x200, 1) INT_LESS (unique, 0xbf80, 4) , (const, 0x5, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x20b, 1) INT_SBORROW (unique, 0xbf80, 4) , (const, 0x5, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (unique, 0x29300, 4) INT_SUB (unique, 0xbf80, 4) , (const, 0x5, 4)\n",
      "  (register, 0x207, 1) INT_SLESS (unique, 0x29300, 4) , (const, 0x0, 4)\n",
      "  (register, 0x206, 1) INT_EQUAL (unique, 0x29300, 4) , (const, 0x0, 4)\n",
      "  (unique, 0x13180, 4) INT_AND (unique, 0x29300, 4) , (const, 0xff, 4)\n",
      "  (unique, 0x13200, 1) POPCOUNT (unique, 0x13180, 4)\n",
      "  (unique, 0x13280, 1) INT_AND (unique, 0x13200, 1) , (const, 0x1, 1)\n",
      "  (register, 0x202, 1) INT_EQUAL (unique, 0x13280, 1) , (const, 0x0, 1)\n",
      "JZ 0x0010119c\n",
      "   ---  CBRANCH (ram, 0x10119c, 8) , (register, 0x206, 1)\n",
      "MOV EAX,dword ptr [RBP + -0x4]\n",
      "  (unique, 0x3100, 8) INT_ADD (register, 0x28, 8) , (const, 0xfffffffffffffffc, 8)\n",
      "  (unique, 0xbf00, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x0, 4) COPY (unique, 0xbf00, 4)\n",
      "  (register, 0x0, 8) INT_ZEXT (register, 0x0, 4)\n",
      "MOV ESI,EAX\n",
      "  (register, 0x30, 4) COPY (register, 0x0, 4)\n",
      "  (register, 0x30, 8) INT_ZEXT (register, 0x30, 4)\n",
      "LEA RDI,[0x102004]\n",
      "  (register, 0x38, 8) COPY (const, 0x102004, 8)\n",
      "MOV EAX,0x0\n",
      "  (register, 0x0, 8) COPY (const, 0x0, 8)\n",
      "CALL 0x00101070\n",
      "  (register, 0x20, 8) INT_SUB (register, 0x20, 8) , (const, 0x8, 8)\n",
      "   ---  STORE (const, 0x1b1, 8) , (register, 0x20, 8) , (const, 0x10119a, 8)\n",
      "   ---  CALL (ram, 0x101070, 8)\n",
      "JMP 0x0010119d\n",
      "   ---  BRANCH (ram, 0x10119d, 8)\n",
      "NOP\n",
      "ADD dword ptr [RBP + -0x4],0x1\n",
      "  (unique, 0x3100, 8) INT_ADD (register, 0x28, 8) , (const, 0xfffffffffffffffc, 8)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x200, 1) INT_CARRY (unique, 0xbf80, 4) , (const, 0x1, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x20b, 1) INT_SCARRY (unique, 0xbf80, 4) , (const, 0x1, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (unique, 0xbf80, 4) INT_ADD (unique, 0xbf80, 4) , (const, 0x1, 4)\n",
      "   ---  STORE (const, 0x1b1, 4) , (unique, 0x3100, 8) , (unique, 0xbf80, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x207, 1) INT_SLESS (unique, 0xbf80, 4) , (const, 0x0, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x206, 1) INT_EQUAL (unique, 0xbf80, 4) , (const, 0x0, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (unique, 0x13180, 4) INT_AND (unique, 0xbf80, 4) , (const, 0xff, 4)\n",
      "  (unique, 0x13200, 1) POPCOUNT (unique, 0x13180, 4)\n",
      "  (unique, 0x13280, 1) INT_AND (unique, 0x13200, 1) , (const, 0x1, 1)\n",
      "  (register, 0x202, 1) INT_EQUAL (unique, 0x13280, 1) , (const, 0x0, 1)\n",
      "CMP dword ptr [RBP + -0x4],0x9\n",
      "  (unique, 0x3100, 8) INT_ADD (register, 0x28, 8) , (const, 0xfffffffffffffffc, 8)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x200, 1) INT_LESS (unique, 0xbf80, 4) , (const, 0x9, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x20b, 1) INT_SBORROW (unique, 0xbf80, 4) , (const, 0x9, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (unique, 0x29300, 4) INT_SUB (unique, 0xbf80, 4) , (const, 0x9, 4)\n",
      "  (register, 0x207, 1) INT_SLESS (unique, 0x29300, 4) , (const, 0x0, 4)\n",
      "  (register, 0x206, 1) INT_EQUAL (unique, 0x29300, 4) , (const, 0x0, 4)\n",
      "  (unique, 0x13180, 4) INT_AND (unique, 0x29300, 4) , (const, 0xff, 4)\n",
      "  (unique, 0x13200, 1) POPCOUNT (unique, 0x13180, 4)\n",
      "  (unique, 0x13280, 1) INT_AND (unique, 0x13200, 1) , (const, 0x1, 1)\n",
      "  (register, 0x202, 1) INT_EQUAL (unique, 0x13280, 1) , (const, 0x0, 1)\n",
      "JLE 0x0010117e\n",
      "  (unique, 0xd000, 1) INT_NOTEQUAL (register, 0x20b, 1) , (register, 0x207, 1)\n",
      "  (unique, 0xd100, 1) BOOL_OR (register, 0x206, 1) , (unique, 0xd000, 1)\n",
      "   ---  CBRANCH (ram, 0x10117e, 8) , (unique, 0xd100, 1)\n",
      "JMP 0x001011cb\n",
      "   ---  BRANCH (ram, 0x1011cb, 8)\n",
      "CMP dword ptr [RBP + -0x4],0x5\n",
      "  (unique, 0x3100, 8) INT_ADD (register, 0x28, 8) , (const, 0xfffffffffffffffc, 8)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x200, 1) INT_LESS (unique, 0xbf80, 4) , (const, 0x5, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x20b, 1) INT_SBORROW (unique, 0xbf80, 4) , (const, 0x5, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (unique, 0x29300, 4) INT_SUB (unique, 0xbf80, 4) , (const, 0x5, 4)\n",
      "  (register, 0x207, 1) INT_SLESS (unique, 0x29300, 4) , (const, 0x0, 4)\n",
      "  (register, 0x206, 1) INT_EQUAL (unique, 0x29300, 4) , (const, 0x0, 4)\n",
      "  (unique, 0x13180, 4) INT_AND (unique, 0x29300, 4) , (const, 0xff, 4)\n",
      "  (unique, 0x13200, 1) POPCOUNT (unique, 0x13180, 4)\n",
      "  (unique, 0x13280, 1) INT_AND (unique, 0x13200, 1) , (const, 0x1, 1)\n",
      "  (register, 0x202, 1) INT_EQUAL (unique, 0x13280, 1) , (const, 0x0, 1)\n",
      "JNZ 0x001011b1\n",
      "  (unique, 0xc900, 1) BOOL_NEGATE (register, 0x206, 1)\n",
      "   ---  CBRANCH (ram, 0x1011b1, 8) , (unique, 0xc900, 1)\n",
      "JMP 0x001011cb\n",
      "   ---  BRANCH (ram, 0x1011cb, 8)\n",
      "MOV EAX,dword ptr [RBP + -0x4]\n",
      "  (unique, 0x3100, 8) INT_ADD (register, 0x28, 8) , (const, 0xfffffffffffffffc, 8)\n",
      "  (unique, 0xbf00, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x0, 4) COPY (unique, 0xbf00, 4)\n",
      "  (register, 0x0, 8) INT_ZEXT (register, 0x0, 4)\n",
      "MOV ESI,EAX\n",
      "  (register, 0x30, 4) COPY (register, 0x0, 4)\n",
      "  (register, 0x30, 8) INT_ZEXT (register, 0x30, 4)\n",
      "LEA RDI,[0x102004]\n",
      "  (register, 0x38, 8) COPY (const, 0x102004, 8)\n",
      "MOV EAX,0x0\n",
      "  (register, 0x0, 8) COPY (const, 0x0, 8)\n",
      "CALL 0x00101070\n",
      "  (register, 0x20, 8) INT_SUB (register, 0x20, 8) , (const, 0x8, 8)\n",
      "   ---  STORE (const, 0x1b1, 8) , (register, 0x20, 8) , (const, 0x1011c7, 8)\n",
      "   ---  CALL (ram, 0x101070, 8)\n",
      "SUB dword ptr [RBP + -0x4],0x1\n",
      "  (unique, 0x3100, 8) INT_ADD (register, 0x28, 8) , (const, 0xfffffffffffffffc, 8)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x200, 1) INT_LESS (unique, 0xbf80, 4) , (const, 0x1, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x20b, 1) INT_SBORROW (unique, 0xbf80, 4) , (const, 0x1, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (unique, 0xbf80, 4) INT_SUB (unique, 0xbf80, 4) , (const, 0x1, 4)\n",
      "   ---  STORE (const, 0x1b1, 4) , (unique, 0x3100, 8) , (unique, 0xbf80, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x207, 1) INT_SLESS (unique, 0xbf80, 4) , (const, 0x0, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x206, 1) INT_EQUAL (unique, 0xbf80, 4) , (const, 0x0, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (unique, 0x13180, 4) INT_AND (unique, 0xbf80, 4) , (const, 0xff, 4)\n",
      "  (unique, 0x13200, 1) POPCOUNT (unique, 0x13180, 4)\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "  (unique, 0x13280, 1) INT_AND (unique, 0x13200, 1) , (const, 0x1, 1)\n",
      "  (register, 0x202, 1) INT_EQUAL (unique, 0x13280, 1) , (const, 0x0, 1)\n",
      "CMP dword ptr [RBP + -0x4],0x0\n",
      "  (unique, 0x3100, 8) INT_ADD (register, 0x28, 8) , (const, 0xfffffffffffffffc, 8)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x200, 1) INT_LESS (unique, 0xbf80, 4) , (const, 0x0, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x20b, 1) INT_SBORROW (unique, 0xbf80, 4) , (const, 0x0, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (unique, 0x29300, 4) INT_SUB (unique, 0xbf80, 4) , (const, 0x0, 4)\n",
      "  (register, 0x207, 1) INT_SLESS (unique, 0x29300, 4) , (const, 0x0, 4)\n",
      "  (register, 0x206, 1) INT_EQUAL (unique, 0x29300, 4) , (const, 0x0, 4)\n",
      "  (unique, 0x13180, 4) INT_AND (unique, 0x29300, 4) , (const, 0xff, 4)\n",
      "  (unique, 0x13200, 1) POPCOUNT (unique, 0x13180, 4)\n",
      "  (unique, 0x13280, 1) INT_AND (unique, 0x13200, 1) , (const, 0x1, 1)\n",
      "  (register, 0x202, 1) INT_EQUAL (unique, 0x13280, 1) , (const, 0x0, 1)\n",
      "JG 0x001011a9\n",
      "  (unique, 0xd180, 1) BOOL_NEGATE (register, 0x206, 1)\n",
      "  (unique, 0xd200, 1) INT_EQUAL (register, 0x20b, 1) , (register, 0x207, 1)\n",
      "  (unique, 0xd300, 1) BOOL_AND (unique, 0xd180, 1) , (unique, 0xd200, 1)\n",
      "   ---  CBRANCH (ram, 0x1011a9, 8) , (unique, 0xd300, 1)\n",
      "CMP dword ptr [RBP + -0x4],0x0\n",
      "  (unique, 0x3100, 8) INT_ADD (register, 0x28, 8) , (const, 0xfffffffffffffffc, 8)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x200, 1) INT_LESS (unique, 0xbf80, 4) , (const, 0x0, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x20b, 1) INT_SBORROW (unique, 0xbf80, 4) , (const, 0x0, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (unique, 0x29300, 4) INT_SUB (unique, 0xbf80, 4) , (const, 0x0, 4)\n",
      "  (register, 0x207, 1) INT_SLESS (unique, 0x29300, 4) , (const, 0x0, 4)\n",
      "  (register, 0x206, 1) INT_EQUAL (unique, 0x29300, 4) , (const, 0x0, 4)\n",
      "  (unique, 0x13180, 4) INT_AND (unique, 0x29300, 4) , (const, 0xff, 4)\n",
      "  (unique, 0x13200, 1) POPCOUNT (unique, 0x13180, 4)\n",
      "  (unique, 0x13280, 1) INT_AND (unique, 0x13200, 1) , (const, 0x1, 1)\n",
      "  (register, 0x202, 1) INT_EQUAL (unique, 0x13280, 1) , (const, 0x0, 1)\n",
      "JZ 0x001011df\n",
      "   ---  CBRANCH (ram, 0x1011df, 8) , (register, 0x206, 1)\n",
      "CMP dword ptr [RBP + -0x4],0x1\n",
      "  (unique, 0x3100, 8) INT_ADD (register, 0x28, 8) , (const, 0xfffffffffffffffc, 8)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x200, 1) INT_LESS (unique, 0xbf80, 4) , (const, 0x1, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (register, 0x20b, 1) INT_SBORROW (unique, 0xbf80, 4) , (const, 0x1, 4)\n",
      "  (unique, 0xbf80, 4) LOAD (const, 0x1b1, 4) , (unique, 0x3100, 8)\n",
      "  (unique, 0x29300, 4) INT_SUB (unique, 0xbf80, 4) , (const, 0x1, 4)\n",
      "  (register, 0x207, 1) INT_SLESS (unique, 0x29300, 4) , (const, 0x0, 4)\n",
      "  (register, 0x206, 1) INT_EQUAL (unique, 0x29300, 4) , (const, 0x0, 4)\n",
      "  (unique, 0x13180, 4) INT_AND (unique, 0x29300, 4) , (const, 0xff, 4)\n",
      "  (unique, 0x13200, 1) POPCOUNT (unique, 0x13180, 4)\n",
      "  (unique, 0x13280, 1) INT_AND (unique, 0x13200, 1) , (const, 0x1, 1)\n",
      "  (register, 0x202, 1) INT_EQUAL (unique, 0x13280, 1) , (const, 0x0, 1)\n",
      "JZ 0x001011ed\n",
      "   ---  CBRANCH (ram, 0x1011ed, 8) , (register, 0x206, 1)\n",
      "JMP 0x001011fb\n",
      "   ---  BRANCH (ram, 0x1011fb, 8)\n",
      "LEA RDI,[0x102008]\n",
      "  (register, 0x38, 8) COPY (const, 0x102008, 8)\n",
      "CALL 0x00101060\n",
      "  (register, 0x20, 8) INT_SUB (register, 0x20, 8) , (const, 0x8, 8)\n",
      "   ---  STORE (const, 0x1b1, 8) , (register, 0x20, 8) , (const, 0x1011eb, 8)\n",
      "   ---  CALL (ram, 0x101060, 8)\n",
      "JMP 0x00101208\n",
      "   ---  BRANCH (ram, 0x101208, 8)\n",
      "LEA RDI,[0x10200d]\n",
      "  (register, 0x38, 8) COPY (const, 0x10200d, 8)\n",
      "CALL 0x00101060\n",
      "  (register, 0x20, 8) INT_SUB (register, 0x20, 8) , (const, 0x8, 8)\n",
      "   ---  STORE (const, 0x1b1, 8) , (register, 0x20, 8) , (const, 0x1011f9, 8)\n",
      "   ---  CALL (ram, 0x101060, 8)\n",
      "JMP 0x00101208\n",
      "   ---  BRANCH (ram, 0x101208, 8)\n",
      "LEA RDI,[0x102011]\n",
      "  (register, 0x38, 8) COPY (const, 0x102011, 8)\n",
      "CALL 0x00101060\n",
      "  (register, 0x20, 8) INT_SUB (register, 0x20, 8) , (const, 0x8, 8)\n",
      "   ---  STORE (const, 0x1b1, 8) , (register, 0x20, 8) , (const, 0x101207, 8)\n",
      "   ---  CALL (ram, 0x101060, 8)\n",
      "NOP\n",
      "MOV EAX,0x0\n",
      "  (register, 0x0, 8) COPY (const, 0x0, 8)\n",
      "LEAVE\n",
      "  (register, 0x20, 8) COPY (register, 0x28, 8)\n",
      "  (register, 0x28, 8) LOAD (const, 0x1b1, 8) , (register, 0x20, 8)\n",
      "  (register, 0x20, 8) INT_ADD (register, 0x20, 8) , (const, 0x8, 8)\n",
      "RET\n",
      "  (register, 0x288, 8) LOAD (const, 0x1b1, 8) , (register, 0x20, 8)\n",
      "  (register, 0x20, 8) INT_ADD (register, 0x20, 8) , (const, 0x8, 8)\n",
      "   ---  RETURN (register, 0x288, 8)\n"
     ]
    }
   ],
   "source": [
    "import ghidra.program.database.function.FunctionDB\n",
    "fun dumpRawPcode(func: FunctionDB) {\n",
    "    val funcBody = func.body\n",
    "    val listing = currentProgram.getListing()\n",
    "    val ops = listing.getInstructions(funcBody, true)\n",
    "    ops.forEach {\n",
    "        val rawPcode = it.pcode\n",
    "        println(\"$it\")\n",
    "        rawPcode.forEach {\n",
    "            println(\"  ${it}\")\n",
    "        }\n",
    "    }\n",
    "}\n",
    "dumpRawPcode(getGlobalFunctions(\"main\")[0] as FunctionDB)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a4a62fb6",
   "metadata": {},
   "source": [
    "### Dumping Refined PCode\n",
    "PCode exists in two primary forms you as a user should consider, \"raw\" and \"refined\".  In documentation both forms are simply referred to as \"PCode\" making it confusing to talk about - so I distinguish between the forms using raw and refined. Just know theses are not universally accepted terms. \n",
    "\n",
    "So refined PCode is heavily processed. It highly relates to the output you see in the decompiler, and if you're interested in making use of the Ghidra decompiler passes, this is the form of PCode you'll want to analyze. There are many interesting aspects of refined PCode we do not cover here, including `unique` values and name spaces. Just know that what might appear to be simple has a lot of analysis backing it and digging into these refined PCode elements are worth your time."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "id": "13739620",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "0x00101175: (stack, 0xfffffffffffffff4, 4) COPY (const, 0x0, 4)\n",
      "0x0010117c:  ---  BRANCH (ram, 0x1011a1, 1)\n",
      "0x0010117e: (register, 0x206, 1) INT_EQUAL (stack, 0xfffffffffffffff4, 4) , (const, 0x5, 4)\n",
      "0x00101182:  ---  CBRANCH (ram, 0x10119c, 1) , (register, 0x206, 1)\n",
      "0x00101187: (register, 0x30, 8) INT_ZEXT (stack, 0xfffffffffffffff4, 4)\n",
      "0x00101195:  ---  CALL (ram, 0x101070, 8) , (const, 0x102004, 8) , (register, 0x30, 8)\n",
      "0x0010119a:  ---  BRANCH (ram, 0x10119d, 1)\n",
      "0x0010119d: (unique, 0xbf80, 4) INT_ADD (stack, 0xfffffffffffffff4, 4) , (const, 0x1, 4)\n",
      "0x001011a1: (stack, 0xfffffffffffffff4, 4) MULTIEQUAL (stack, 0xfffffffffffffff4, 4) , (unique, 0xbf80, 4)\n",
      "0x001011a5: (unique, 0xd100, 1) INT_SLESS (stack, 0xfffffffffffffff4, 4) , (const, 0xa, 4)\n",
      "0x001011a5:  ---  CBRANCH (ram, 0x10117e, 1) , (unique, 0xd100, 1)\n",
      "0x001011a9: (register, 0x206, 1) INT_EQUAL (stack, 0xfffffffffffffff4, 4) , (const, 0x5, 4)\n",
      "0x001011ad:  ---  CBRANCH (ram, 0x1011b1, 1) , (register, 0x206, 1)\n",
      "0x001011b4: (register, 0x30, 8) INT_ZEXT (stack, 0xfffffffffffffff4, 4)\n",
      "0x001011c2:  ---  CALL (ram, 0x101070, 8) , (const, 0x102004, 8) , (register, 0x30, 8)\n",
      "0x001011c7: (unique, 0xbf80, 4) INT_ADD (stack, 0xfffffffffffffff4, 4) , (const, 0xffffffff, 4)\n",
      "0x001011cb: (stack, 0xfffffffffffffff4, 4) MULTIEQUAL (unique, 0xbf80, 4) , (stack, 0xfffffffffffffff4, 4) , (stack, 0xfffffffffffffff4, 4)\n",
      "0x001011cf: (unique, 0xd300, 1) INT_SLESS (stack, 0xfffffffffffffff4, 4) , (const, 0x1, 4)\n",
      "0x001011cf:  ---  CBRANCH (ram, 0x1011a9, 1) , (unique, 0xd300, 1)\n",
      "0x001011d1: (register, 0x206, 1) INT_EQUAL (stack, 0xfffffffffffffff4, 4) , (const, 0x0, 4)\n",
      "0x001011d5:  ---  CBRANCH (ram, 0x1011df, 1) , (register, 0x206, 1)\n",
      "0x001011d7: (register, 0x206, 1) INT_EQUAL (stack, 0xfffffffffffffff4, 4) , (const, 0x1, 4)\n",
      "0x001011db:  ---  CBRANCH (ram, 0x1011ed, 1) , (register, 0x206, 1)\n",
      "0x001011e6:  ---  CALL (ram, 0x101060, 8) , (const, 0x102008, 8)\n",
      "0x001011eb:  ---  BRANCH (ram, 0x101208, 1)\n",
      "0x001011f4:  ---  CALL (ram, 0x101060, 8) , (const, 0x10200d, 8)\n",
      "0x001011f9:  ---  BRANCH (ram, 0x101208, 1)\n",
      "0x00101202:  ---  CALL (ram, 0x101060, 8) , (const, 0x102011, 8)\n",
      "0x00101208: (register, 0x0, 8) COPY (const, 0x0, 8)\n",
      "0x0010120e:  ---  RETURN (const, 0x0, 8) , (register, 0x0, 8)\n"
     ]
    }
   ],
   "source": [
    "import ghidra.util.task.ConsoleTaskMonitor\n",
    "import ghidra.app.decompiler.*\n",
    "import ghidra.program.database.function.FunctionDB\n",
    "import ghidra.program.model.pcode.HighFunction\n",
    "\n",
    "fun FunctionDB.getHighFunction():HighFunction {\n",
    "    val options = DecompileOptions()\n",
    "    val monitor = ConsoleTaskMonitor()\n",
    "    val ifc = DecompInterface()\n",
    "    ifc.setOptions(options)\n",
    "    ifc.openProgram(currentProgram)\n",
    "    // Setting a simplification style will strip useful `indirect` information.\n",
    "    // Please don't use this unless you know why you're using it.\n",
    "    ifc.setSimplificationStyle(\"normalize\") \n",
    "    val res = ifc.decompileFunction(this, 60, monitor)\n",
    "    val high = res.getHighFunction()\n",
    "    return high\n",
    "}\n",
    "\n",
    "fun FunctionDB.dumpRefinedPcode() {\n",
    "    val highFunc = getHighFunction()\n",
    "    val opIter = highFunc.pcodeOps\n",
    "    opIter.forEach {\n",
    "//         print(it::class)\n",
    "        println(\"0x${it.seqnum.target}: ${it}\")\n",
    "    }\n",
    "}\n",
    "\n",
    "(getGlobalFunctions(\"main\")[0] as FunctionDB).dumpRefinedPcode()"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "ad5ae803",
   "metadata": {},
   "source": [
    "## Tokenize instructions"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "id": "480d6776",
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Function: _init\n",
      "[[ENDBR64], [SUB, RSP, 0x8], [MOV, RAX, qword ptr [0x00103fe8]], [TEST, RAX, RAX], [JZ, 0x00101016]]\n",
      "[[CALL, RAX]]\n",
      "[[ADD, RSP, 0x8], [RET]]\n",
      "\n",
      "Function: FUN_00101020\n",
      "[[PUSH, qword ptr [0x00103fb8]], [JMP, qword ptr [0x00103fc0]]]\n",
      "\n",
      "Function: _start\n",
      "[[ENDBR64], [XOR, EBP, EBP], [MOV, R9, RDX], [POP, RSI], [MOV, RDX, RSP], [AND, RSP, -0x10], [PUSH, RAX], [PUSH, RSP], [LEA, R8, [0x101280]], [LEA, RCX, [0x101210]], [LEA, RDI, [0x101169]], [CALL, qword ptr [0x00103fe0]], [HLT]]\n",
      "\n",
      "Function: deregister_tm_clones\n",
      "[[LEA, RDI, [0x104010]], [LEA, RAX, [0x104010]], [CMP, RAX, RDI], [JZ, 0x001010d8]]\n",
      "[[MOV, RAX, qword ptr [0x00103fd8]], [TEST, RAX, RAX], [JZ, 0x001010d8]]\n",
      "[[JMP, RAX]]\n",
      "[[RET]]\n",
      "\n",
      "Function: register_tm_clones\n",
      "[[LEA, RDI, [0x104010]], [LEA, RSI, [0x104010]], [SUB, RSI, RDI], [MOV, RAX, RSI], [SHR, RSI, 0x3f], [SAR, RAX, 0x3], [ADD, RSI, RAX], [SAR, RSI, 0x1], [JZ, 0x00101118]]\n",
      "[[MOV, RAX, qword ptr [0x00103ff0]], [TEST, RAX, RAX], [JZ, 0x00101118]]\n",
      "[[JMP, RAX]]\n",
      "[[RET]]\n",
      "\n",
      "Function: __do_global_dtors_aux\n",
      "[[ENDBR64], [CMP, byte ptr [0x00104010], 0x0], [JNZ, 0x00101158]]\n",
      "[[PUSH, RBP], [CMP, qword ptr [0x00103ff8], 0x0], [MOV, RBP, RSP], [JZ, 0x00101147]]\n",
      "[[MOV, RDI, qword ptr [0x00104008]], [CALL, 0x00101050]]\n",
      "[[CALL, 0x001010b0], [MOV, byte ptr [0x00104010], 0x1], [POP, RBP], [RET]]\n",
      "[[RET]]\n",
      "\n",
      "Function: main\n",
      "[[ENDBR64], [PUSH, RBP], [MOV, RBP, RSP], [SUB, RSP, 0x10], [MOV, dword ptr [RBP + -0x4], 0x0], [JMP, 0x001011a1]]\n",
      "[[CMP, dword ptr [RBP + -0x4], 0x5], [JZ, 0x0010119c]]\n",
      "[[MOV, EAX, dword ptr [RBP + -0x4]], [MOV, ESI, EAX], [LEA, RDI, [0x102004]], [MOV, EAX, 0x0], [CALL, 0x00101070], [JMP, 0x0010119d]]\n",
      "[[NOP]]\n",
      "[[ADD, dword ptr [RBP + -0x4], 0x1]]\n",
      "[[CMP, dword ptr [RBP + -0x4], 0x9], [JLE, 0x0010117e]]\n",
      "[[JMP, 0x001011cb]]\n",
      "[[CMP, dword ptr [RBP + -0x4], 0x5], [JNZ, 0x001011b1]]\n",
      "[[JMP, 0x001011cb]]\n",
      "[[MOV, EAX, dword ptr [RBP + -0x4]], [MOV, ESI, EAX], [LEA, RDI, [0x102004]], [MOV, EAX, 0x0], [CALL, 0x00101070], [SUB, dword ptr [RBP + -0x4], 0x1]]\n",
      "[[CMP, dword ptr [RBP + -0x4], 0x0], [JG, 0x001011a9]]\n",
      "[[CMP, dword ptr [RBP + -0x4], 0x0], [JZ, 0x001011df]]\n",
      "[[CMP, dword ptr [RBP + -0x4], 0x1], [JZ, 0x001011ed]]\n",
      "[[JMP, 0x001011fb]]\n",
      "[[LEA, RDI, [0x102008]], [CALL, 0x00101060], [JMP, 0x00101208]]\n",
      "[[LEA, RDI, [0x10200d]], [CALL, 0x00101060], [JMP, 0x00101208]]\n",
      "[[LEA, RDI, [0x102011]], [CALL, 0x00101060], [NOP]]\n",
      "[[MOV, EAX, 0x0], [LEAVE], [RET]]\n",
      "\n",
      "Function: __libc_csu_init\n",
      "[[ENDBR64], [PUSH, R15], [LEA, R15, [0x103db0]], [PUSH, R14], [MOV, R14, RDX], [PUSH, R13], [MOV, R13, RSI], [PUSH, R12], [MOV, R12D, EDI], [PUSH, RBP], [LEA, RBP, [0x103db8]], [PUSH, RBX], [SUB, RBP, R15], [SUB, RSP, 0x8], [CALL, 0x00101000], [SAR, RBP, 0x3], [JZ, 0x00101266]]\n",
      "[[XOR, EBX, EBX], [NOP, dword ptr [RAX]]]\n",
      "[[MOV, RDX, R14], [MOV, RSI, R13], [MOV, EDI, R12D], [CALL, qword ptr [R15 + RBX*0x8]], [ADD, RBX, 0x1], [CMP, RBP, RBX], [JNZ, 0x00101250]]\n",
      "[[ADD, RSP, 0x8], [POP, RBX], [POP, RBP], [POP, R12], [POP, R13], [POP, R14], [POP, R15], [RET]]\n",
      "\n",
      "Function: __libc_csu_fini\n",
      "[[ENDBR64], [RET]]\n",
      "\n",
      "Function: _fini\n",
      "[[ENDBR64], [SUB, RSP, 0x8], [ADD, RSP, 0x8], [RET]]\n",
      "\n"
     ]
    }
   ],
   "source": [
    "currentProgram.getExecutablePath()\n",
    "val basicBlockModel = BasicBlockModel(currentProgram, true)\n",
    "val listing = currentProgram.getListing()\n",
    "val functions = currentProgram.getFunctionManager().getFunctions(true)\n",
    "functions.filter { !it.isThunk() }.forEach {\n",
    "    println(\"Function: ${it.name}\")\n",
    "    val basicBlocks = basicBlockModel.getCodeBlocksContaining(it.body, monitor)\n",
    "    basicBlocks.forEach { \n",
    "        val insts = listing.getInstructions(it, true)\n",
    "        val tokens = insts.map {\n",
    "            val list = mutableListOf<String>(it.getMnemonicString())\n",
    "            val num = it.getNumOperands()\n",
    "            for(i in (0 until num)) {\n",
    "                list += it.getDefaultOperandRepresentation(i)\n",
    "            }\n",
    "            list\n",
    "        }\n",
    "        println(tokens)\n",
    "    }\n",
    "    println()\n",
    "}\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "ff6977da",
   "metadata": {},
   "source": [
    "## Find Main"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 30,
   "id": "e1839a3e",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      " ---  CALL (ram, 0x105018, 8) , (unique, 0x10000021, 8) , (stack, 0x0, 8) , (register, 0x20, 8) , (unique, 0x10000029, 8) , (unique, 0x10000031, 8) , (register, 0x10, 8) , (register, 0x20, 8)\n",
      "main\n"
     ]
    }
   ],
   "source": [
    "import ghidra.app.decompiler.DecompileOptions\n",
    "import ghidra.app.decompiler.DecompInterface\n",
    "import ghidra.util.task.ConsoleTaskMonitor\n",
    "\n",
    "val entry = getGlobalFunctions(\"entry\")[0]\n",
    "val options = DecompileOptions()\n",
    "val monitor = ConsoleTaskMonitor()\n",
    "val ifc = DecompInterface()\n",
    "ifc.setOptions(options)\n",
    "ifc.openProgram(currentProgram)\n",
    "\n",
    "// val func = getFunctionContaining(TARGET_ADDR)\n",
    "val res = ifc.decompileFunction(entry, 60, monitor)\n",
    "val high_func = res.getHighFunction()\n",
    "val pcodeops = high_func.getPcodeOps()\n",
    "fun runTransaction(msg:String, transaction:() -> Unit) {\n",
    "    val id = currentProgram.startTransaction(msg)\n",
    "    transaction()\n",
    "    currentProgram.endTransaction(id, true)\n",
    "}\n",
    "pcodeops.forEach { \n",
    "    if(it.mnemonic == \"CALL\") {\n",
    "        println(it)\n",
    "        val mainAddress = toAddr(it.getInput(1).def.getInput(1).offset)\n",
    "        val mainFunc = getFunctionAt(mainAddress)\n",
    "        runTransaction(\"Find main\") {\n",
    "            mainFunc.setName(\"main\", ghidra.program.model.symbol.SourceType.USER_DEFINED)\n",
    "        }\n",
    "        println(mainFunc)\n",
    "    }\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "5a4cc108",
   "metadata": {},
   "source": [
    "## Rename Local Variable"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 32,
   "id": "637a5545",
   "metadata": {},
   "outputs": [],
   "source": [
    "fun runTransaction(msg:String, transaction:() -> Unit) {\n",
    "    val id = currentProgram.startTransaction(msg)\n",
    "    transaction()\n",
    "    currentProgram.endTransaction(id, true)\n",
    "}\n",
    "val OLD_NAME = \"local_c\"\n",
    "val NEW_NAME = \"i\"\n",
    "val func = getGlobalFunctions(\"main\")[0]\n",
    "val localVars = func.localVariables\n",
    "localVars.filter {\n",
    "    it.name == OLD_NAME\n",
    "}.forEach {\n",
    "    runTransaction(\"rename variable\") {\n",
    "        it.setName(NEW_NAME, ghidra.program.model.symbol.SourceType.USER_DEFINED)\n",
    "    }\n",
    "}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 53,
   "id": "aeb7151f",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "null\n",
      "null\n",
      "null\n"
     ]
    }
   ],
   "source": [
    "import ghidra.program.model.data.*;\n",
    "import ghidra.app.services.DataTypeManagerService;\n",
    "\n",
    "// val dataTypeManager = currentProgram.dataTypeManager\n",
    "// dataTypeManager\n",
    "val service = state.tool.getService(DataTypeManagerService::class.java)\n",
    "// val dataType = service.getDataType(\"int\")\n",
    "val dataTypeManagers = service.dataTypeManagers\n",
    "dataTypeManagers.forEach {\n",
    "//     it.allDataTypes.forEach {\n",
    "//         println(it)\n",
    "//     }\n",
    "    val dataType = it.getDataType(\"int\")\n",
    "//     if(dataType != null) {\n",
    "        println(dataType)\n",
    "//     }\n",
    "}\n",
    "// dataTypeManager.allDataTypes.forEach { \n",
    "//     println(it.name)\n",
    "// }\n",
    "\n",
    "// val dataType = dataTypeManager.getDataType(\"int\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 47,
   "id": "0aff3861",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[ghidra.program.model.data.BuiltInDataTypeManager@edab4f9, FileDataTypeManager - generic_clib_64, ghidra.program.database.data.ProgramDataTypeManager@7b419075]"
      ]
     },
     "execution_count": 47,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "dataTypeManagers"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "fdc0e771",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[int, _init, (, EVP_PKEY_CTX, *, ctx, ), {, int, iVar1, ;, iVar1, =, __gmon_start__, (, ), ;, return, iVar1, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"int\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"_init\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"EVP_PKEY_CTX\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"*\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"ctx\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"int\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"iVar1\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"iVar1\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"=\",\"child\":null},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__gmon_start__\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"iVar1\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, FUN_00101020, (, void, ), {, (, *, (, code, *, ), (, undefined, *, ), 0x0, ), (, ), ;, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"FUN_00101020\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"*\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"code\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"*\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"undefined\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"*\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"0x0\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, __cxa_finalize, (, void, ), {, __cxa_finalize, (, ), ;, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__cxa_finalize\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__cxa_finalize\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, _start, (, undefined8, param_1, ,, undefined8, param_2, ,, undefined8, param_3, ), {, undefined8, unaff_retaddr, ;, undefined, auStack8, [, 8, ], ;, __libc_start_main, (, main, ,, unaff_retaddr, ,, &, stack0x00000008, ,, __libc_csu_init, ,, __libc_csu_fini, ,, param_3, ,, auStack8, ), ;, do, {, }, while, (, true, ), ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"_start\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"undefined8\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_1\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"undefined8\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_2\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"undefined8\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_3\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"undefined8\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"unaff_retaddr\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"undefined\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"auStack8\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"[\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"8\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"]\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__libc_start_main\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"main\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"unaff_retaddr\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"&\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"stack0x00000008\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"__libc_csu_init\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"__libc_csu_fini\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_3\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"auStack8\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"SYNTAX_TOKEN\",\"token\":\"do\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"while\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"true\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, deregister_tm_clones, (, void, ), {, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"deregister_tm_clones\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, register_tm_clones, (, void, ), {, return, ;, }]\n",
      "\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"register_tm_clones\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, __do_global_dtors_aux, (, void, ), {, if, (, completed.8061, !=, '\\0', ), {, return, ;, }, __cxa_finalize, (, __dso_handle, ), ;, deregister_tm_clones, (, ), ;, completed.8061, =, 1, ;, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__do_global_dtors_aux\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"if\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"completed.8061\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"!=\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"'\\\\0'\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__cxa_finalize\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"__dso_handle\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"deregister_tm_clones\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"completed.8061\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"=\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"1\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, frame_dummy, (, void, ), {, register_tm_clones, (, ), ;, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"frame_dummy\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"register_tm_clones\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, register_function, (, char, *, name, ,, anon_subr_void_varargs, *, func, ), {, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"register_function\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"char\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"*\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"name\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"anon_subr_void_varargs\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"*\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"func\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, create, (, void, ), {, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"create\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, delete, (, void, ), {, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"delete\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, edit, (, void, ), {, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"edit\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[int, main, (, void, ), {, register_function, (, \"create\", ,, create, ), ;, register_function, (, \"delete\", ,, delete, ), ;, register_function, (, \"edit\", ,, edit, ), ;, return, 0, ;, }]\n",
      "\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"int\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"main\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"register_function\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"\\\"create\\\"\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"create\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"register_function\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"\\\"delete\\\"\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"delete\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"register_function\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"\\\"edit\\\"\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"edit\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"0\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, __libc_csu_init, (, EVP_PKEY_CTX, *, param_1, ,, undefined8, param_2, ,, undefined8, param_3, ), {, long, lVar1, ;, _init, (, param_1, ), ;, lVar1, =, 0, ;, do, {, (, *, (, code, *, ), (, &, __frame_dummy_init_array_entry, ), [, lVar1, ], ), (, (, ulong, ), param_1, &, 0xffffffff, ,, param_2, ,, param_3, ), ;, lVar1, =, lVar1, +, 1, ;, }, while, (, lVar1, !=, 1, ), ;, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__libc_csu_init\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"EVP_PKEY_CTX\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"*\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_1\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"undefined8\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_2\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"undefined8\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_3\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"long\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"lVar1\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"_init\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_1\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"lVar1\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"=\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"0\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"SYNTAX_TOKEN\",\"token\":\"do\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"*\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"code\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"*\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"&\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"__frame_dummy_init_array_entry\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"[\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"lVar1\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"]\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"ulong\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_1\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"&\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"0xffffffff\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_2\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\",\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"param_3\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null},{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"lVar1\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"=\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"lVar1\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"+\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"1\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"while\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"lVar1\",\"child\":null},{\"type\":\"OP_TOKEN\",\"token\":\"!=\",\"child\":null},{\"type\":\"TOKEN\",\"token\":\"1\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, __libc_csu_fini, (, void, ), {, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__libc_csu_fini\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, _fini, (, void, ), {, return, ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"_fini\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"return\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, _ITM_deregisterTMCloneTable, (, void, ), {, halt_baddata, (, ), ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"_ITM_deregisterTMCloneTable\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"halt_baddata\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n",
      "[void, __libc_start_main, (, void, ), {, halt_baddata, (, ), ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__libc_start_main\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"halt_baddata\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, __gmon_start__, (, void, ), {, halt_baddata, (, ), ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__gmon_start__\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"halt_baddata\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, _ITM_registerTMCloneTable, (, void, ), {, halt_baddata, (, ), ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"_ITM_registerTMCloneTable\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"halt_baddata\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n",
      "[void, __cxa_finalize, (, void, ), {, halt_baddata, (, ), ;, }]\n",
      "\n",
      "{\"type\":\"FUNCTION\",\"token\":null,\"child\":[{\"type\":\"FUNC_PROTO\",\"token\":null,\"child\":[{\"type\":\"RETURN_TYPE\",\"token\":null,\"child\":[{\"type\":\"TOKEN\",\"token\":\"void\",\"child\":null}]},{\"type\":\"FUNC_NAME_TOKEN\",\"token\":\"__cxa_finalize\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"void\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"{\",\"child\":null},{\"type\":\"TOKEN_GROUP\",\"token\":null,\"child\":[{\"type\":\"STATEMENT\",\"token\":null,\"child\":[{\"type\":\"OP_TOKEN\",\"token\":\"halt_baddata\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"(\",\"child\":null},{\"type\":\"SYNTAX_TOKEN\",\"token\":\")\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\";\",\"child\":null}]},{\"type\":\"SYNTAX_TOKEN\",\"token\":\"}\",\"child\":null}]}\n",
      "\n"
     ]
    }
   ],
   "source": [
    "import ghidra.app.decompiler.DecompileOptions\n",
    "import ghidra.app.decompiler.DecompInterface\n",
    "import ghidra.util.task.ConsoleTaskMonitor\n",
    "import ghidra.app.decompiler.*\n",
    "import kotlinx.serialization.*\n",
    "import kotlinx.serialization.json.*\n",
    "\n",
    "val options = DecompileOptions()\n",
    "val monitor = ConsoleTaskMonitor()\n",
    "val ifc = DecompInterface()\n",
    "ifc.setOptions(options)\n",
    "ifc.openProgram(currentProgram)\n",
    "\n",
    "val functionManager = currentProgram.getFunctionManager()\n",
    "val funcs = functionManager.getFunctions(true)\n",
    "\n",
    "enum class TokenType {\n",
    "    BREAK, COMMENT_TOKEN, FIELD_TOKEN, FUNC_NAME_TOKEN, FUNC_PROTO, FUNCTION, LABEL_TOKEN,\n",
    "    OP_TOKEN, RETURN_TYPE, STATEMENT, SYNTAX_TOKEN, TOKEN, TOKEN_GROUP, TYPE_TOKEN, VARIABLE_DECL, VARIABLE_TOKEN\n",
    "}\n",
    "\n",
    "@Serializable\n",
    "data class Token(\n",
    "    val type: TokenType,\n",
    "    val token: String?,\n",
    "    val child: List<Token>?\n",
    ") {\n",
    "    fun flatten():List<String> {\n",
    "        if (token != null) {\n",
    "            return listOf(token)\n",
    "        } else {\n",
    "            return child?.flatMap { it.flatten() } ?: listOf<String>()\n",
    "        }\n",
    "//         return token ?: child?.map {it.flatten()}?.filterNotNull()?.joinToString()\n",
    "    }\n",
    "}\n",
    "\n",
    "\n",
    "fun ClangNode.expand():Token? {\n",
    "    val type = when(this) {\n",
    "        is ClangBreak -> { TokenType.BREAK; return null }\n",
    "        is ClangCommentToken -> { TokenType.COMMENT_TOKEN; return null }\n",
    "        is ClangFieldToken -> { TokenType.FIELD_TOKEN}\n",
    "        is ClangFuncNameToken -> { TokenType.FUNC_NAME_TOKEN }\n",
    "        is ClangFuncProto -> { TokenType.FUNC_PROTO }\n",
    "        is ClangFunction -> { TokenType.FUNCTION }\n",
    "        is ClangLabelToken -> { TokenType.LABEL_TOKEN }\n",
    "        is ClangOpToken -> { TokenType.OP_TOKEN }\n",
    "        is ClangReturnType -> { TokenType.RETURN_TYPE }\n",
    "        is ClangStatement -> { TokenType.STATEMENT }\n",
    "        is ClangSyntaxToken -> {TokenType.SYNTAX_TOKEN }\n",
    "        is ClangToken -> { TokenType.TOKEN }\n",
    "        is ClangTokenGroup -> { TokenType.TOKEN_GROUP}\n",
    "        is ClangTypeToken -> { TokenType.TYPE_TOKEN }\n",
    "        is ClangVariableDecl -> { TokenType.VARIABLE_DECL }\n",
    "        is ClangVariableToken -> { TokenType.VARIABLE_TOKEN }\n",
    "        else -> {TokenType.TOKEN}\n",
    "    }\n",
    "    if (numChildren() == 0) {\n",
    "        return if(!toString().isEmpty() && !toString().isBlank()) Token(type, toString(), null) else null\n",
    "    } else {\n",
    "        return Token(\n",
    "            type,\n",
    "            null, \n",
    "            (0 until numChildren()).map {\n",
    "                Child(it).expand()\n",
    "            }.filterNotNull()\n",
    "        )\n",
    "    }\n",
    "}\n",
    "funcs.forEach { \n",
    "    val res = ifc.decompileFunction(it, 60, monitor)\n",
    "    val markUp = res.cCodeMarkup\n",
    "    val tokens = markUp.expand()\n",
    "    val jsonToken = Json.encodeToString(tokens)\n",
    "    println(tokens?.flatten())\n",
    "    println()\n",
    "    println(jsonToken)\n",
    "    println()\n",
    "}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 37,
   "id": "5a6a68a1",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[(unique, 0x1000003b, 8), (const, 0x10113c, 8)]"
      ]
     },
     "execution_count": 37,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "import ghidra.app.decompiler.component.DecompilerUtils\n",
    "val token = (currentLocation as ghidra.app.decompiler.DecompilerLocation).token\n",
    "\n",
    "DecompilerUtils.getForwardSlice(token.pcodeOp.getInput(1))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 31,
   "id": "d8483f60",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "(unique, 0x1000003b, 8)"
      ]
     },
     "execution_count": 31,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "94c8129b",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Ghidra(Kotlin)",
   "language": "kotlin",
   "name": "ghidra-kotlin"
  },
  "language_info": {
   "codemirror_mode": "text/x-kotlin",
   "file_extension": ".kt",
   "mimetype": "text/x-kotlin",
   "name": "kotlin",
   "nbconvert_exporter": "",
   "pygments_lexer": "kotlin",
   "version": "1.6.0"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}