windows-exe-decompiler-mcp-server 0.1.0

package/ghidra_scripts/ExtractCFG.java

@@ -0,0 +1,256 @@
+// ExtractCFG.java - Java fallback for CFG extraction
+// @category Analysis
+// @description Extracts a control-flow graph for a function and returns JSON
+
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.block.BasicBlockModel;
+import ghidra.program.model.block.CodeBlock;
+import ghidra.program.model.block.CodeBlockIterator;
+import ghidra.program.model.block.CodeBlockReference;
+import ghidra.program.model.block.CodeBlockReferenceIterator;
+import ghidra.program.model.listing.Function;
+import ghidra.program.model.listing.FunctionIterator;
+import ghidra.program.model.listing.FunctionManager;
+import ghidra.program.model.listing.Instruction;
+import ghidra.program.model.symbol.Symbol;
+import ghidra.program.model.symbol.SymbolIterator;
+import ghidra.program.model.symbol.SymbolType;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+public class ExtractCFG extends GhidraScript {
+
+    private String escapeJson(String value) {
+        if (value == null) {
+            return "";
+        }
+        StringBuilder out = new StringBuilder(value.length() + 16);
+        for (int i = 0; i < value.length(); i++) {
+            char c = value.charAt(i);
+            switch (c) {
+                case '"':
+                    out.append("\\\"");
+                    break;
+                case '\\':
+                    out.append("\\\\");
+                    break;
+                case '\b':
+                    out.append("\\b");
+                    break;
+                case '\f':
+                    out.append("\\f");
+                    break;
+                case '\n':
+                    out.append("\\n");
+                    break;
+                case '\r':
+                    out.append("\\r");
+                    break;
+                case '\t':
+                    out.append("\\t");
+                    break;
+                default:
+                    if (c < 0x20) {
+                        out.append(String.format("\\u%04x", (int) c));
+                    } else {
+                        out.append(c);
+                    }
+            }
+        }
+        return out.toString();
+    }
+
+    private Function resolveFunction(String addressOrSymbol) {
+        FunctionManager manager = currentProgram.getFunctionManager();
+        try {
+            Address address = currentProgram.getAddressFactory().getAddress(addressOrSymbol);
+            Function byAddress = manager.getFunctionAt(address);
+            if (byAddress != null) {
+                return byAddress;
+            }
+        } catch (Exception ignored) {
+        }
+
+        SymbolIterator iterator = currentProgram.getSymbolTable().getSymbols(addressOrSymbol);
+        while (iterator.hasNext()) {
+            Symbol symbol = iterator.next();
+            if (symbol.getSymbolType() != SymbolType.FUNCTION) {
+                continue;
+            }
+            Function bySymbol = manager.getFunctionAt(symbol.getAddress());
+            if (bySymbol != null) {
+                return bySymbol;
+            }
+        }
+
+        FunctionIterator functions = manager.getFunctions(true);
+        while (functions.hasNext()) {
+            Function function = functions.next();
+            if (addressOrSymbol.equals(function.getName())) {
+                return function;
+            }
+        }
+
+        return null;
+    }
+
+    private String getBlockType(CodeBlock block, Function function) throws Exception {
+        if (block.getFirstStartAddress().equals(function.getEntryPoint())) {
+            return "entry";
+        }
+
+        CodeBlockReferenceIterator destinations = block.getDestinations(monitor);
+        if (!destinations.hasNext()) {
+            return "exit";
+        }
+
+        Instruction instruction = currentProgram.getListing().getInstructionAt(block.getFirstStartAddress());
+        while (instruction != null && block.contains(instruction.getAddress())) {
+            if (instruction.getFlowType().isCall()) {
+                return "call";
+            }
+            if (instruction.getFlowType().isTerminal()) {
+                return "return";
+            }
+            instruction = instruction.getNext();
+        }
+
+        return "basic";
+    }
+
+    private String getEdgeType(CodeBlock sourceBlock) {
+        Instruction instruction = currentProgram.getListing().getInstructionAt(sourceBlock.getMaxAddress());
+        if (instruction == null) {
+            return "fallthrough";
+        }
+        if (instruction.getFlowType().isCall()) {
+            return "call";
+        }
+        if (instruction.getFlowType().isJump()) {
+            return "jump";
+        }
+        if (instruction.getFlowType().isTerminal()) {
+            return "return";
+        }
+        return "fallthrough";
+    }
+
+    @Override
+    protected void run() throws Exception {
+        if (currentProgram == null) {
+            println("{\"error\":\"No program loaded\"}");
+            return;
+        }
+
+        String[] args = getScriptArgs();
+        if (args.length < 1) {
+            println("{\"error\":\"Usage: ExtractCFG.java <address|symbol>\"}");
+            return;
+        }
+
+        Function function = resolveFunction(args[0]);
+        if (function == null) {
+            println("{\"error\":\"Function not found: " + escapeJson(args[0]) + "\"}");
+            return;
+        }
+
+        BasicBlockModel blockModel = new BasicBlockModel(currentProgram);
+        Map<String, String> blockIds = new LinkedHashMap<>();
+        StringBuilder nodes = new StringBuilder(16384);
+        StringBuilder edges = new StringBuilder(16384);
+
+        boolean firstNode = true;
+        int blockIndex = 0;
+        CodeBlockIterator blocks = blockModel.getCodeBlocksContaining(function.getBody(), monitor);
+        while (blocks.hasNext()) {
+            CodeBlock block = blocks.next();
+            String blockAddress = block.getFirstStartAddress().toString();
+            String blockId = "block_" + blockIndex++;
+            blockIds.put(blockAddress, blockId);
+
+            if (!firstNode) {
+                nodes.append(',');
+            }
+            firstNode = false;
+
+            nodes.append('{');
+            nodes.append("\"id\":\"").append(escapeJson(blockId)).append("\",");
+            nodes.append("\"address\":\"").append(escapeJson(blockAddress)).append("\",");
+            nodes.append("\"instructions\":[");
+
+            boolean firstInstruction = true;
+            Instruction instruction = currentProgram.getListing().getInstructionAt(block.getFirstStartAddress());
+            while (instruction != null && block.contains(instruction.getAddress())) {
+                if (!firstInstruction) {
+                    nodes.append(',');
+                }
+                firstInstruction = false;
+                String operand =
+                    instruction.getNumOperands() > 0
+                        ? instruction.getDefaultOperandRepresentation(0)
+                        : "";
+                nodes.append("\"")
+                    .append(escapeJson(
+                        instruction.getAddress().toString()
+                            + ": "
+                            + instruction.getMnemonicString()
+                            + (operand.length() > 0 ? " " + operand : "")
+                    ))
+                    .append("\"");
+                instruction = instruction.getNext();
+            }
+
+            nodes.append("],\"type\":\"")
+                .append(escapeJson(getBlockType(block, function)))
+                .append("\"}");
+        }
+
+        boolean firstEdge = true;
+        blocks = blockModel.getCodeBlocksContaining(function.getBody(), monitor);
+        while (blocks.hasNext()) {
+            CodeBlock block = blocks.next();
+            String fromId = blockIds.get(block.getFirstStartAddress().toString());
+            if (fromId == null) {
+                continue;
+            }
+
+            CodeBlockReferenceIterator destinations = block.getDestinations(monitor);
+            while (destinations.hasNext()) {
+                CodeBlockReference destination = destinations.next();
+                if (!function.getBody().contains(destination.getDestinationAddress())) {
+                    continue;
+                }
+
+                String toId = blockIds.get(destination.getDestinationAddress().toString());
+                if (toId == null) {
+                    continue;
+                }
+
+                if (!firstEdge) {
+                    edges.append(',');
+                }
+                firstEdge = false;
+
+                edges.append("{\"from\":\"")
+                    .append(escapeJson(fromId))
+                    .append("\",\"to\":\"")
+                    .append(escapeJson(toId))
+                    .append("\",\"type\":\"")
+                    .append(escapeJson(getEdgeType(block)))
+                    .append("\"}");
+            }
+        }
+
+        StringBuilder output = new StringBuilder(32768);
+        output.append('{');
+        output.append("\"function\":\"").append(escapeJson(function.getName())).append("\",");
+        output.append("\"address\":\"").append(escapeJson(function.getEntryPoint().toString())).append("\",");
+        output.append("\"nodes\":[").append(nodes).append("],");
+        output.append("\"edges\":[").append(edges).append("]");
+        output.append('}');
+
+        println(output.toString());
+    }
+}

package/ghidra_scripts/ExtractCFG.py

@@ -0,0 +1,233 @@
+# ExtractCFG.py - Extract Control Flow Graph for a function
+# Requirements: 11.1, 11.2, 11.3, 11.4, 11.5
+#
+# Usage: analyzeHeadless <project_path> <project_name> -process <binary> \
+#        -postScript ExtractCFG.py <address_or_symbol> -noanalysis
+#
+# Output: JSON with CFG nodes and edges
+
+from ghidra.program.model.block import BasicBlockModel
+from ghidra.program.model.symbol import SymbolType
+from ghidra.program.model.address import AddressSet
+import json
+import sys
+
+def get_function_by_address_or_symbol(program, address_or_symbol):
+    """
+    Find function by address (hex string) or symbol name
+    """
+    function_manager = program.getFunctionManager()
+    
+    # Try as address first
+    try:
+        addr = program.getAddressFactory().getAddress(address_or_symbol)
+        func = function_manager.getFunctionAt(addr)
+        if func:
+            return func
+    except:
+        pass
+    
+    # Try as symbol name
+    symbol_table = program.getSymbolTable()
+    symbols = symbol_table.getSymbols(address_or_symbol)
+    
+    for symbol in symbols:
+        if symbol.getSymbolType() == SymbolType.FUNCTION:
+            func = function_manager.getFunctionAt(symbol.getAddress())
+            if func:
+                return func
+    
+    return None
+
+def get_block_type(block, function):
+    """
+    Determine the type of a basic block
+    Requirements: 11.3
+    """
+    entry_point = function.getEntryPoint()
+    
+    # Check if this is the entry block
+    if block.getFirstStartAddress().equals(entry_point):
+        return "entry"
+    
+    # Check if this is an exit block (has no outgoing edges or returns)
+    destinations = block.getDestinations(monitor)
+    if not destinations.hasNext():
+        return "exit"
+    
+    # Check if block contains a call instruction
+    listing = currentProgram.getListing()
+    instruction = listing.getInstructionAt(block.getFirstStartAddress())
+    
+    while instruction and block.contains(instruction.getAddress()):
+        flow_type = instruction.getFlowType()
+        if flow_type.isCall():
+            return "call"
+        if flow_type.isTerminal():
+            return "return"
+        instruction = instruction.getNext()
+    
+    return "basic"
+
+def get_edge_type(source_block, dest_block):
+    """
+    Determine the type of a control flow edge
+    Requirements: 11.4
+    """
+    listing = currentProgram.getListing()
+    
+    # Get the last instruction in the source block
+    last_addr = source_block.getMaxAddress()
+    instruction = listing.getInstructionBefore(last_addr.add(1))
+    
+    if not instruction:
+        return "fallthrough"
+    
+    flow_type = instruction.getFlowType()
+    
+    if flow_type.isCall():
+        return "call"
+    elif flow_type.isJump():
+        return "jump"
+    elif flow_type.isTerminal():
+        return "return"
+    elif flow_type.isFallthrough():
+        return "fallthrough"
+    else:
+        return "fallthrough"
+
+def extract_cfg(function):
+    """
+    Extract control flow graph for a function
+    Requirements: 11.1, 11.2, 11.3, 11.4, 11.5
+    """
+    # Create basic block model
+    block_model = BasicBlockModel(currentProgram)
+    listing = currentProgram.getListing()
+    
+    # Get all basic blocks in the function
+    function_body = function.getBody()
+    code_blocks = block_model.getCodeBlocksContaining(function_body, monitor)
+    
+    nodes = []
+    edges = []
+    block_id_map = {}
+    
+    # First pass: create nodes
+    block_index = 0
+    while code_blocks.hasNext():
+        block = code_blocks.next()
+        
+        # Generate unique block ID
+        block_id = "block_{}".format(block_index)
+        block_id_map[block.getFirstStartAddress().toString()] = block_id
+        
+        # Extract instructions in this block
+        instructions = []
+        instruction = listing.getInstructionAt(block.getFirstStartAddress())
+        
+        while instruction and block.contains(instruction.getAddress()):
+            # Format: address: mnemonic operands
+            instr_str = "{}: {} {}".format(
+                instruction.getAddress().toString(),
+                instruction.getMnemonicString(),
+                instruction.getDefaultOperandRepresentation(0) if instruction.getNumOperands() > 0 else ""
+            )
+            instructions.append(instr_str.strip())
+            instruction = instruction.getNext()
+        
+        # Determine block type
+        block_type = get_block_type(block, function)
+        
+        # Create node
+        node = {
+            "id": block_id,
+            "address": block.getFirstStartAddress().toString(),
+            "instructions": instructions,
+            "type": block_type
+        }
+        nodes.append(node)
+        
+        block_index += 1
+    
+    # Second pass: create edges
+    code_blocks = block_model.getCodeBlocksContaining(function_body, monitor)
+    
+    while code_blocks.hasNext():
+        block = code_blocks.next()
+        source_id = block_id_map.get(block.getFirstStartAddress().toString())
+        
+        if not source_id:
+            continue
+        
+        # Get all destination blocks
+        destinations = block.getDestinations(monitor)
+        
+        while destinations.hasNext():
+            dest_ref = destinations.next()
+            dest_addr = dest_ref.getDestinationAddress()
+            
+            # Check if destination is within the function
+            if function_body.contains(dest_addr):
+                dest_id = block_id_map.get(dest_addr.toString())
+                
+                if dest_id:
+                    # Determine edge type
+                    edge_type = get_edge_type(block, None)
+                    
+                    edge = {
+                        "from": source_id,
+                        "to": dest_id,
+                        "type": edge_type
+                    }
+                    edges.append(edge)
+    
+    return {
+        "nodes": nodes,
+        "edges": edges
+    }
+
+def main():
+    """
+    Main entry point
+    """
+    if len(sys.argv) < 2:
+        result = {
+            "error": "Usage: ExtractCFG.py <address_or_symbol>"
+        }
+        print(json.dumps(result))
+        return
+    
+    address_or_symbol = sys.argv[1]
+    
+    # Find the function
+    function = get_function_by_address_or_symbol(currentProgram, address_or_symbol)
+    
+    if not function:
+        result = {
+            "error": "Function not found: {}".format(address_or_symbol)
+        }
+        print(json.dumps(result))
+        return
+    
+    # Extract CFG
+    try:
+        cfg = extract_cfg(function)
+        
+        result = {
+            "function": function.getName(),
+            "address": function.getEntryPoint().toString(),
+            "nodes": cfg["nodes"],
+            "edges": cfg["edges"]
+        }
+        
+        print(json.dumps(result, indent=2))
+        
+    except Exception as e:
+        result = {
+            "error": "Failed to extract CFG: {}".format(str(e))
+        }
+        print(json.dumps(result))
+
+if __name__ == "__main__":
+    main()