0

I'm trying to use python script in Ghidra to let a plt function named as memcmp return a fix value, But i have no idea for that. like this:

.text:10006E84
.text:10006E88 89 21 00 08                   lbz       r9, 0xB0+var_A8(r1)
.text:10006E8C 2C 09 00 00                   cmpwi     r9, 0
.text:10006E90 41 82 00 88                   beq       loc_10006F18
.text:10006E90
.text:10006E94 38 A0 00 41                   li        r5, 0x41 # 'A'                # n
.text:10006E98 38 81 00 08                   addi      r4, r1, 0xB0+var_A8           # s2
.text:10006E9C 38 61 00 4C                   addi      r3, r1, 0xB0+var_64           # s1
.text:10006EA0 48 00 23 B1                   bl        memcmp
.text:10006EA0
.text:10006EA4 7C 7D 1B 79                   mr.       r29, r3
.text:10006EA8 40 82 01 1C                   bne       loc_10006FC4
.text:10006EA8
.text:10006EAC 38 80 00 04                   li        r4, 4                         # type

memcmp as a PLT function:

.text:10009250                               # int memcmp(const void *s1, const void *s2, size_t n)
.text:10009250                               memcmp:                                 # CODE XREF: sub_10002264+84↑p
.text:10009250                                                                       # sub_10002264+D4↑p
.text:10009250                                                                       # licd_public_key_hash_check+2F4↑p
.text:10009250 3D 60 10 02                   lis       r11, memcmp_plt@ha
.text:10009254 81 6B 00 C8                   lwz       r11, memcmp_plt@l(r11)        # __imp_memcmp
.text:10009258 7D 69 03 A6                   mtctr     r11
.text:1000925C 4E 80 04 20                   bctr

How to use Ghidra python script to do this automatically?

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.