2

In Ghidra, I have an ARM9 binary that in many places stores hard-coded pointers to the same struct at the same location in RAM.

022308c8 a0 9f 23 02     undefined4 02239FA0h
...
02233290 a0 9f 23 02     undefined4 02239FA0h
...
02233838 a0 9f 23 02     undefined4 02239FA0h

I can easily find all/most references to that struct by doing a scalar search (Search > For Scalars...) and I would like to change the data type of all of those matches to be my_struct*.

In some cases there are too many pointers to the same RAM location to manually change the data type of each within a reasonable amount of time (ex. 1200+ pointers).

Is there any way to have Ghidra automate changing the data types of all of those matching hard-coded pointers?

3
  • You mean changing the undefined4 doesnt work ?
    – blabb
    Commented Oct 17 at 10:57
  • Changing the undefined 4 to my_struct* (using Data >Change Data Type...) works to change a single instance, but currently I would have to do that manually for each of the 1200+ pointers which would probably take several hours to do. I want to know if there is a way to automate changing the data type for 1200+ instances of this pointer.
    – Chris
    Commented Oct 17 at 14:49
  • Are these pointers in an unbroken range, or are they spread separately all over the binary? Commented Nov 19 at 6:40

1 Answer 1

1

You can automate that by using createData and getDataTypes methods from Ghidra API.

Something like that should do the trick:

ptr_type = getDataTypes("my_struct*")[0] 
# getDataTypes returns an array so we pick the first one

for addr in range(0x022308c8,02233838,4):
    createData(toAddr(addr), ptr_type)

It will work if there's nothing defined for those bytes already. If there are you need to clear that with clearListing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.