@ecopoesis/homebridge-dmx 0.1.0

package/tools/ghidra/find-stick3a-ctor.py

@@ -0,0 +1,87 @@
+# Locate the Stick3A_DmxUniverse constructor and trace where the cipher
+# state at this+0x1618+offsets gets initialized.
+
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out13')
+try: os.makedirs(OUT_DIR)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+ref_mgr = prog.getReferenceManager()
+mem = prog.getMemory()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface()
+decomp.openProgram(prog)
+
+
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+
+def dump(func, out):
+    out.write('==== %s @ %s ====\n' % (func.getName(True), func.getEntryPoint()))
+    out.write('size: %d body bytes\n' % func.getBody().getNumAddresses())
+    callees = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCalledFunctions(monitor)))
+    out.write('\n-- callees (%d) --\n' % len(callees))
+    for c in callees: out.write('  ' + c + '\n')
+    callers = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCallingFunctions(monitor)))
+    out.write('\n-- callers (%d) --\n' % len(callers))
+    for c in callers: out.write('  ' + c + '\n')
+    out.write('\n-- decompilation --\n')
+    res = decomp.decompileFunction(func, 240, monitor)
+    if res.decompileCompleted():
+        out.write(res.getDecompiledFunction().getC())
+    else:
+        out.write('(decompilation failed: %s)\n' % res.getErrorMessage())
+    out.write('\n')
+
+
+# Each of these is the typeinfo_ptr field; slot[0] (vptr value used by
+# instances) = field + 8.
+VTABLES = {
+    'Stick3A_DmxUniverse_primary': 0x100962968,
+    'Stick3A_DmxUniverse_sub1':    0x100962A48,
+    'Stick3A_DmxUniverse_sub2':    0x100962A70,
+    'Stick3A_DmxUniverse_sub3':    0x100962AB0,
+    'Stick3A_DmxUniverse_sub4':    0x100962AE8,
+    'Stick3A_DmxUniverse_sub5':    0x100962B28,
+}
+
+seen = set()
+summary = open(os.path.join(OUT_DIR, 'SUMMARY.txt'), 'w')
+summary.write('Stick3A_DmxUniverse ctor hunt\n\n')
+
+for label, ti in VTABLES.items():
+    vptr = ti + 8
+    summary.write('\n#### %s   vptr=0x%x\n' % (label, vptr))
+    code_refs = set()
+    for r in ref_mgr.getReferencesTo(addr(vptr)):
+        f = fm.getFunctionContaining(r.getFromAddress())
+        if f is not None:
+            code_refs.add(f.getEntryPoint())
+        else:
+            summary.write('   data ref @ %s (no fn)\n' % r.getFromAddress())
+    summary.write('  code refs from %d fn(s):\n' % len(code_refs))
+    for ep in sorted(code_refs):
+        f = fm.getFunctionAt(ep)
+        summary.write('    %s @ %s (size %d)\n' %
+                      (f.getName(True), f.getEntryPoint(),
+                       f.getBody().getNumAddresses()))
+        if ep in seen: continue
+        seen.add(ep)
+        safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+        with open(os.path.join(OUT_DIR, '%s_%s_%s.txt' %
+                                (label, f.getEntryPoint(), safe)), 'w') as o:
+            dump(f, o)
+
+summary.write('\n=== total: %d ===\n' % len(seen))
+summary.close()
+print('find-stick3a-ctor: %d functions dumped to %s' % (len(seen), OUT_DIR))

package/tools/ghidra/find-stick3anet-ctor.py

@@ -0,0 +1,76 @@
+# Find XHL_Stick3ANet device constructor + trace cipher init at this+0x1618.
+
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out14')
+try: os.makedirs(OUT_DIR)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+ref_mgr = prog.getReferenceManager()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface()
+decomp.openProgram(prog)
+
+
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+
+def dump(func, out):
+    out.write('==== %s @ %s ====\n' % (func.getName(True), func.getEntryPoint()))
+    out.write('size: %d body bytes\n' % func.getBody().getNumAddresses())
+    callees = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCalledFunctions(monitor)))
+    out.write('\n-- callees (%d) --\n' % len(callees))
+    for c in callees: out.write('  ' + c + '\n')
+    callers = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCallingFunctions(monitor)))
+    out.write('\n-- callers (%d) --\n' % len(callers))
+    for c in callers: out.write('  ' + c + '\n')
+    out.write('\n-- decompilation --\n')
+    res = decomp.decompileFunction(func, 240, monitor)
+    if res.decompileCompleted():
+        out.write(res.getDecompiledFunction().getC())
+    else:
+        out.write('(decompilation failed: %s)\n' % res.getErrorMessage())
+    out.write('\n')
+
+
+# Primary Stick3ANet vptr = slot 0 of vtable @ 0x10095EF70 (typeinfo_ptr field)
+# So vptr stored in instances = 0x10095EF70 + 8 = 0x10095EF78
+VPTRS = {
+    'Stick3ANet_primary': 0x10095EF78,
+}
+
+seen = set()
+summary = open(os.path.join(OUT_DIR, 'SUMMARY.txt'), 'w')
+
+for label, vptr in VPTRS.items():
+    summary.write('\n#### %s   vptr=0x%x\n' % (label, vptr))
+    code_refs = set()
+    for r in ref_mgr.getReferencesTo(addr(vptr)):
+        f = fm.getFunctionContaining(r.getFromAddress())
+        if f is not None:
+            code_refs.add(f.getEntryPoint())
+    summary.write('  code refs from %d fn(s):\n' % len(code_refs))
+    for ep in sorted(code_refs):
+        f = fm.getFunctionAt(ep)
+        summary.write('    %s @ %s (size %d)\n' %
+                      (f.getName(True), f.getEntryPoint(),
+                       f.getBody().getNumAddresses()))
+        if ep in seen: continue
+        seen.add(ep)
+        safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+        with open(os.path.join(OUT_DIR, '%s_%s_%s.txt' %
+                                (label, f.getEntryPoint(), safe)), 'w') as o:
+            dump(f, o)
+
+summary.write('\n=== total: %d ===\n' % len(seen))
+summary.close()
+print('find-stick3anet-ctor: %d functions dumped to %s' % (len(seen), OUT_DIR))

package/tools/ghidra/find-vtables.py

@@ -0,0 +1,165 @@
+# Locate vtables by scanning memory for the typeinfo pointers we found.
+#
+# From string-walk we have typeinfo struct addresses for each class:
+#   Stick3CryptDmxUniverse   @ 0x100970dc8
+#   Stick5CryptDmxUniverse   @ 0x1009843c0
+#   DasNetCryptDmxUniverse   @ 0x100986688
+#   AesOStream               @ 0x100851c50
+#   AesIStream               @ 0x100851ae0
+#   AesOStreamBuffer         @ 0x100851c68
+#   AesIStreamBuffer         @ 0x100851af8
+#   DasEccAesCryptography    @ 0x100851ee0
+#   DasDhRsaCryptography<1024> @ 0x100ae7e20
+#   DasDhRsaCryptography<512>  @ 0x100b12398
+#   DasEccStreamCryptography @ 0x100852088
+#   DasCryptography          @ 0x100851d50
+#
+# An Itanium-ABI vtable is laid out:
+#     -0x10  offset_to_top
+#     -0x08  typeinfo_ptr    ← this is the typeinfo struct address
+#     +0x00  vt_slot[0]      ← what objects' vptr points at
+#     +0x08  vt_slot[1]
+#     ...
+#
+# So scanning memory for an 8-byte little-endian value equal to a typeinfo
+# address finds the typeinfo_ptr field of every vtable for that class
+# (primary + secondary base vtables). Vtable[0] = that_address + 8.
+#
+# Then dump every fn pointer at vt_slot[N] for N in [0..32) until 0/non-code.
+
+# @category Stick
+
+import os, re, struct
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+from java.lang import Long
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out5')
+try:
+    os.makedirs(OUT_DIR)
+except OSError:
+    pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+mem = prog.getMemory()
+af = prog.getAddressFactory()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface()
+decomp.openProgram(prog)
+
+
+def addr(a):
+    return af.getDefaultAddressSpace().getAddress(a)
+
+
+def get_ptr(a):
+    try:
+        return mem.getLong(a) & 0xFFFFFFFFFFFFFFFF
+    except Exception:
+        return None
+
+
+def find_le_qword(value):
+    """Return all addresses where the 8-byte LE encoding of `value` occurs."""
+    pat = struct.pack('<Q', value)
+    hits = []
+    a = mem.findBytes(prog.getMinAddress(), pat, None, True, monitor)
+    while a is not None and len(hits) < 200:
+        hits.append(a)
+        try:
+            a = mem.findBytes(a.add(1), pat, None, True, monitor)
+        except Exception:
+            break
+    return hits
+
+
+def dump_function(func, out):
+    out.write('==== %s @ %s ====\n' % (func.getName(True), func.getEntryPoint()))
+    out.write('signature: %s\n' % func.getPrototypeString(True, True))
+    out.write('size: %d body bytes\n' % func.getBody().getNumAddresses())
+    callees = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCalledFunctions(monitor)))
+    out.write('\n-- callees (%d) --\n' % len(callees))
+    for c in callees:
+        out.write('  ' + c + '\n')
+    callers = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCallingFunctions(monitor)))
+    out.write('\n-- callers (%d) --\n' % len(callers))
+    for c in callers:
+        out.write('  ' + c + '\n')
+    out.write('\n-- decompilation --\n')
+    res = decomp.decompileFunction(func, 180, monitor)
+    if res.decompileCompleted():
+        out.write(res.getDecompiledFunction().getC())
+    else:
+        out.write('(decompilation failed: %s)\n' % res.getErrorMessage())
+    out.write('\n')
+
+
+# (class_label, typeinfo_addr)
+TARGETS = [
+    ('Stick3CryptDmxUniverse',     0x100970dc8),
+    ('Stick5CryptDmxUniverse',     0x1009843c0),
+    ('DasNetCryptDmxUniverse',     0x100986688),
+    ('AesOStream',                 0x100851c50),
+    ('AesIStream',                 0x100851ae0),
+    ('AesOStreamBuffer',           0x100851c68),
+    ('AesIStreamBuffer',           0x100851af8),
+    ('DasEccAesCryptography',      0x100851ee0),
+    ('DasDhRsaCryptography_1024',  0x100ae7e20),
+    ('DasDhRsaCryptography_512',   0x100b12398),
+    ('DasEccStreamCryptography',   0x100852088),
+    ('DasCryptography',            0x100851d50),
+]
+
+summary = open(os.path.join(OUT_DIR, 'SUMMARY.txt'), 'w')
+summary.write('Vtable hunt by typeinfo-ptr search — ESA2 HardwareManager\n\n')
+
+seen_funcs = set()
+
+for label, ti_addr in TARGETS:
+    summary.write('\n#### %s   typeinfo @ 0x%x\n' % (label, ti_addr))
+    occurrences = find_le_qword(ti_addr)
+    summary.write('  typeinfo_ptr field occurs %d time(s)\n' % len(occurrences))
+    for occ in occurrences:
+        # occ = address of the typeinfo_ptr field in the vtable.
+        # vt_slot[0] is at occ + 8.
+        summary.write('    typeinfo_ptr @ %s   ->  vtable slot[0] @ 0x%x\n' %
+                      (occ, int(occ.getOffset()) + 8))
+        base = int(occ.getOffset()) + 8
+        # Walk up to 32 slots
+        for slot in range(0, 32):
+            sa = addr(base + slot * 8)
+            fp = get_ptr(sa)
+            if fp is None:
+                summary.write('      vt[%2d] @ 0x%x  <unmapped>\n' %
+                              (slot, base + slot * 8))
+                break
+            # End-of-vtable: many ABIs put zeros or a new offset-to-top
+            if fp == 0:
+                summary.write('      vt[%2d] @ 0x%x  = 0  (end?)\n' %
+                              (slot, base + slot * 8))
+                break
+            fa = addr(fp)
+            f = fm.getFunctionAt(fa) or fm.getFunctionContaining(fa)
+            if f is None:
+                # Could be a pure-virtual stub or non-code; stop
+                summary.write('      vt[%2d] @ 0x%x  -> 0x%x (no fn)\n' %
+                              (slot, base + slot * 8, fp))
+                break
+            summary.write('      vt[%2d] @ 0x%x  -> %s @ %s  (size %d)\n' %
+                          (slot, base + slot * 8, f.getName(True),
+                           f.getEntryPoint(), f.getBody().getNumAddresses()))
+            if f.getEntryPoint() in seen_funcs:
+                continue
+            seen_funcs.add(f.getEntryPoint())
+            safe_fn = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+            path = os.path.join(OUT_DIR, '%s_vt%02d_%s_%s.txt' %
+                                (label, slot, f.getEntryPoint(), safe_fn))
+            with open(path, 'w') as o:
+                dump_function(f, o)
+
+summary.write('\n=== total functions dumped: %d ===\n' % len(seen_funcs))
+summary.close()
+print('find-vtables: dumped %d functions to %s' % (len(seen_funcs), OUT_DIR))

package/tools/ghidra/out-011c-callers-run.log

@@ -0,0 +1,51 @@
+INFO  Using log config file: jar:file:/opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Framework/Generic/lib/Generic.jar!/generic.log4j.xml (LoggingInitialization)  
+INFO  Using log file: /Users/miker/Library/ghidra/ghidra_12.1_PUBLIC/application.log (LoggingInitialization)  
+INFO  Loading user preferences: /Users/miker/Library/ghidra/ghidra_12.1_PUBLIC/preferences (Preferences)  
+INFO  Searching for classes... (ClassSearcher)  
+INFO  Class search complete (631 ms) (ClassSearcher)  
+INFO  Initializing SSL Context (DefaultSSLContextInitializer)  
+INFO  Initializing Random Number Generator... (SecureRandomFactory)  
+INFO  Random Number Generator initialization complete: NativePRNGNonBlocking (SecureRandomFactory)  
+INFO  Trust manager disabled, cacerts have not been set (DefaultTrustManagerFactory)  
+INFO  Headless startup complete (1495 ms) (AnalyzeHeadless)  
+INFO  Class searcher loaded 59 extension points (20 false positives) (ClassSearcher)  
+INFO  HEADLESS Script Paths:
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/SwiftDemangler/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Processors/8051/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/BSim/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/VersionTracking/ghidra_scripts
+    /Users/miker/code/homebridge-stick-de3/tools/ghidra
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/GnuDemangler/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/DecompilerDependent/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/FunctionID/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/SystemEmulation/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Processors/Atmel/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Processors/PIC/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Debug/Debugger/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/PyGhidra/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/Decompiler/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Debug/Debugger-rmi-trace/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/WildcardAssembler/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/FileFormats/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Processors/JVM/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/Base/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/BytePatterns/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/PDB/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Processors/DATA/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/MicrosoftCodeAnalyzer/ghidra_scripts (HeadlessAnalyzer)  
+INFO  HEADLESS: execution starts (HeadlessAnalyzer)  
+INFO  Opening existing project: /Users/miker/code/homebridge-stick-de3/tools/ghidra/HwmESA2 (HeadlessAnalyzer)  
+INFO  Opening project: /Users/miker/code/homebridge-stick-de3/tools/ghidra/HwmESA2 (HeadlessProject)  
+INFO  REPORT: Processing project file: /HardwareManager (HeadlessAnalyzer)  
+INFO  REPORT: Execute script: dump-011c-callers.py  (HeadlessAnalyzer)  
+INFO  SCRIPT: /Users/miker/code/homebridge-stick-de3/tools/ghidra/dump-011c-callers.py (HeadlessAnalyzer)  
+dumping handler-related functions ...
+finding vtable[+0xe8] load sites ...
+e8 displacement sites: 494
+searching for byte pattern FF 90 E8 00 00 00 (call [reg+0xe8]) ...
+found 0 call-via-[reg+0xe8] sites
+dump-011c-callers: done -> /Users/miker/code/homebridge-stick-de3/tools/ghidra/out-011c-callers
+INFO  REPORT: Save succeeded for processed file: /HardwareManager (HeadlessAnalyzer)  
+Last used Python executable: ['/Users/miker/Library/ghidra/ghidra_12.1_PUBLIC/venv/bin/python3']
+Using Python command: "/Users/miker/Library/ghidra/ghidra_12.1_PUBLIC/venv/bin/python3"
+Switching to Ghidra virtual environment: /Users/miker/Library/ghidra/ghidra_12.1_PUBLIC/venv

package/tools/ghidra/out-011c-run.log

@@ -0,0 +1,50 @@
+INFO  Using log config file: jar:file:/opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Framework/Generic/lib/Generic.jar!/generic.log4j.xml (LoggingInitialization)  
+INFO  Using log file: /Users/miker/Library/ghidra/ghidra_12.1_PUBLIC/application.log (LoggingInitialization)  
+INFO  Loading user preferences: /Users/miker/Library/ghidra/ghidra_12.1_PUBLIC/preferences (Preferences)  
+INFO  Searching for classes... (ClassSearcher)  
+INFO  Class search complete (588 ms) (ClassSearcher)  
+INFO  Initializing SSL Context (DefaultSSLContextInitializer)  
+INFO  Initializing Random Number Generator... (SecureRandomFactory)  
+INFO  Random Number Generator initialization complete: NativePRNGNonBlocking (SecureRandomFactory)  
+INFO  Trust manager disabled, cacerts have not been set (DefaultTrustManagerFactory)  
+INFO  Starting cache cleanup: /var/tmp/miker-ghidra/fscache2 (FileCacheMaintenanceDaemon)  
+INFO  Finished cache cleanup, estimated storage used: 0 (FileCacheMaintenanceDaemon)  
+INFO  Headless startup complete (1705 ms) (AnalyzeHeadless)  
+INFO  Class searcher loaded 59 extension points (20 false positives) (ClassSearcher)  
+INFO  HEADLESS Script Paths:
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/SwiftDemangler/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Processors/8051/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/BSim/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/VersionTracking/ghidra_scripts
+    /Users/miker/code/homebridge-stick-de3/tools/ghidra
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/GnuDemangler/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/DecompilerDependent/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/FunctionID/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/SystemEmulation/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Processors/Atmel/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Processors/PIC/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Debug/Debugger/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/PyGhidra/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/Decompiler/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Debug/Debugger-rmi-trace/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/WildcardAssembler/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/FileFormats/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Processors/JVM/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/Base/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/BytePatterns/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/PDB/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Processors/DATA/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/MicrosoftCodeAnalyzer/ghidra_scripts (HeadlessAnalyzer)  
+INFO  HEADLESS: execution starts (HeadlessAnalyzer)  
+INFO  Opening existing project: /Users/miker/code/homebridge-stick-de3/tools/ghidra/HwmESA2 (HeadlessAnalyzer)  
+INFO  Opening project: /Users/miker/code/homebridge-stick-de3/tools/ghidra/HwmESA2 (HeadlessProject)  
+INFO  REPORT: Processing project file: /HardwareManager (HeadlessAnalyzer)  
+INFO  REPORT: Execute script: dump-011c-handler.py  (HeadlessAnalyzer)  
+INFO  SCRIPT: /Users/miker/code/homebridge-stick-de3/tools/ghidra/dump-011c-handler.py (HeadlessAnalyzer)  
+scanning instructions ...
+scanned 1537813 instructions
+dump-011c-handler: 93 functions -> /Users/miker/code/homebridge-stick-de3/tools/ghidra/out-011c
+INFO  REPORT: Save succeeded for processed file: /HardwareManager (HeadlessAnalyzer)  
+Last used Python executable: ['/Users/miker/Library/ghidra/ghidra_12.1_PUBLIC/venv/bin/python3']
+Using Python command: "/Users/miker/Library/ghidra/ghidra_12.1_PUBLIC/venv/bin/python3"
+Switching to Ghidra virtual environment: /Users/miker/Library/ghidra/ghidra_12.1_PUBLIC/venv

package/tools/ghidra/out-vt-key-run.log

@@ -0,0 +1,55 @@
+INFO  Using log config file: jar:file:/opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Framework/Generic/lib/Generic.jar!/generic.log4j.xml (LoggingInitialization)  
+INFO  Using log file: /Users/miker/Library/ghidra/ghidra_12.1_PUBLIC/application.log (LoggingInitialization)  
+INFO  Loading user preferences: /Users/miker/Library/ghidra/ghidra_12.1_PUBLIC/preferences (Preferences)  
+INFO  Searching for classes... (ClassSearcher)  
+INFO  Class search complete (574 ms) (ClassSearcher)  
+INFO  Initializing SSL Context (DefaultSSLContextInitializer)  
+INFO  Initializing Random Number Generator... (SecureRandomFactory)  
+INFO  Random Number Generator initialization complete: NativePRNGNonBlocking (SecureRandomFactory)  
+INFO  Trust manager disabled, cacerts have not been set (DefaultTrustManagerFactory)  
+INFO  Headless startup complete (1631 ms) (AnalyzeHeadless)  
+INFO  Class searcher loaded 59 extension points (20 false positives) (ClassSearcher)  
+INFO  HEADLESS Script Paths:
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/SwiftDemangler/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Processors/8051/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/BSim/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/VersionTracking/ghidra_scripts
+    /Users/miker/code/homebridge-stick-de3/tools/ghidra
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/GnuDemangler/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/DecompilerDependent/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/FunctionID/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/SystemEmulation/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Processors/Atmel/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Processors/PIC/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Debug/Debugger/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/PyGhidra/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/Decompiler/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Debug/Debugger-rmi-trace/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/WildcardAssembler/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/FileFormats/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Processors/JVM/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/Base/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/BytePatterns/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/PDB/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Processors/DATA/ghidra_scripts
+    /opt/homebrew/Cellar/ghidra/12.1/libexec/Ghidra/Features/MicrosoftCodeAnalyzer/ghidra_scripts (HeadlessAnalyzer)  
+INFO  HEADLESS: execution starts (HeadlessAnalyzer)  
+INFO  Opening existing project: /Users/miker/code/homebridge-stick-de3/tools/ghidra/HwmESA2 (HeadlessAnalyzer)  
+INFO  Opening project: /Users/miker/code/homebridge-stick-de3/tools/ghidra/HwmESA2 (HeadlessProject)  
+INFO  REPORT: Processing project file: /HardwareManager (HeadlessAnalyzer)  
+INFO  REPORT: Execute script: dump-vt-key-getter.py  (HeadlessAnalyzer)  
+INFO  SCRIPT: /Users/miker/code/homebridge-stick-de3/tools/ghidra/dump-vt-key-getter.py (HeadlessAnalyzer)  
+--- references at 0x1001bbee5 ---
+
+--- references TO Stick3ANet typeinfo @ 0x100970160 ---
+
+--- bytes near typeinfo 0x100970160 (vtable + typeinfo) ---
+
+--- searching for pointer 0x100970160 in __DATA ---
+
+--- searching for pointer 0x100C820F0 (Stick3A typeinfo) ---
+dump-vt-key-getter: done -> /Users/miker/code/homebridge-stick-de3/tools/ghidra/out-vt-key
+INFO  REPORT: Save succeeded for processed file: /HardwareManager (HeadlessAnalyzer)  
+Last used Python executable: ['/Users/miker/Library/ghidra/ghidra_12.1_PUBLIC/venv/bin/python3']
+Using Python command: "/Users/miker/Library/ghidra/ghidra_12.1_PUBLIC/venv/bin/python3"
+Switching to Ghidra virtual environment: /Users/miker/Library/ghidra/ghidra_12.1_PUBLIC/venv