Ghidra Python - Get Decompile Line Text by RVA

Question

Is there a way in Ghidra Python to get the corresponding decompile line by RVA?

Or the opposite - get the corresponding RVA from a given line in a decompile?

Answer 1

I don't know how any examples how you could get the line like Ghidra would render it, but as a start you can look at https://github.com/schlafwandler/ghidra_ExportToX64dbg.

The basic idea is to walk the C-AST and extract the ClangStatements that have a corresponding RVA.

This has limitations, namely:

At the moment the source code export is limited to elements that appear as ClangStatement in the ClangTokenGroup returned by getCCodeMarkup(). This works fine for most variable assignments and function calls, but excludes most control flow altering constructs (like if, for or while).

If you really need the line and not the ClangStatement, my first idea is to search for the Ghidra code that renders the AST, find the part where a line is rendered and extend it to retain a mapping from a line to a list of ClangStatements used in that line. Then you can iterate over the lines and filter for those that use a statement that has the RVA you are interested in.