0

Is there a way in Ghidra Python to get the corresponding decompile line by RVA?

Or the opposite - get the corresponding RVA from a given line in a decompile?

1

I don't know how any examples how you could get the line like Ghidra would render it, but as a start you can look at https://github.com/schlafwandler/ghidra_ExportToX64dbg.

The basic idea is to walk the C-AST and extract the ClangStatements that have a corresponding RVA.

This has limitations, namely:

At the moment the source code export is limited to elements that appear as ClangStatement in the ClangTokenGroup returned by getCCodeMarkup(). This works fine for most variable assignments and function calls, but excludes most control flow altering constructs (like if, for or while).

If you really need the line and not the ClangStatement, my first idea is to search for the Ghidra code that renders the AST, find the part where a line is rendered and extend it to retain a mapping from a line to a list of ClangStatements used in that line. Then you can iterate over the lines and filter for those that use a statement that has the RVA you are interested in.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.