I want to automate the search for function calls to a function that does not live in the binary and where the function address is passed, via a pointer to a struct, at runtime through a function parameter.

As an example, the first parameter of a JNI class is JNIEnv* which is a struct that contains, among other things, pointers to JNI functions. If you decompile a JNI function, you might see something like this:

Java_com_example_ExampleClass_exampleMethod(JNIEnv*, ...) {
   clazz = (*(*env)->FindClass)(env,jniClass);

Using Ghidra's pcode API, is it possible to automate locating all references to the FindClass function? For reference, the call to FindClass will look something like the following in x86 assembly and pcode.

  000fd2be 8b 0f           MOV        ECX,dword ptr [EDI]
                                              $U16f0:4 = LOAD ram(EDI)
                                              ECX = COPY $U16f0

  000fd2c7 ff 51 18        CALL       dword ptr [ECX + 0x18]
                                              $U3a0:4 = INT_ADD ECX, 24:4
                                              ESP = INT_SUB ESP, 4:4
                                              STORE ram(ESP), 0xfd2ca:4
                                              $U16f0:4 = LOAD ram($U3a0)
                                              CALLIND $U16f0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.