|
| 1 | +# This example works with the binary found in ../tests/binaries/fauxware |
| 2 | +# To use this script, open that binary in a decompiler, than run this script. |
| 3 | +from libbs.api import DecompilerInterface |
| 4 | +from libbs.artifacts import Struct, StructMember |
| 5 | + |
| 6 | +deci = DecompilerInterface.discover() |
| 7 | +# access a function and stack variable using their offsets, which get unified across decompilers |
| 8 | +func = deci.functions[0x71D] |
| 9 | +stack_var = func.stack_vars[-0x18] |
| 10 | +print("Stack variable:", stack_var) |
| 11 | + |
| 12 | +# make a struct that is the same size as the stack variable (16) |
| 13 | +members = { |
| 14 | + 0: StructMember(name="field1", type_="int", size=4, offset=0), |
| 15 | + 4: StructMember(name="field2", type_="int", size=4, offset=4), |
| 16 | + 8: StructMember(name="field3", type_="int", size=4, offset=8), |
| 17 | + 12: StructMember(name="field4", type_="int", size=4, offset=12), |
| 18 | +} |
| 19 | +struct = Struct(name="my_struct", size=16, members=members) |
| 20 | +print("Struct:", struct) |
| 21 | +deci.structs["my_struct"] = struct |
| 22 | + |
| 23 | +# modify the stack variable to use the struct |
| 24 | +stack_var.type = "my_struct" |
| 25 | +print("Updated stack variable:", stack_var) |
| 26 | + |
| 27 | +# reassign to affect the decompiler |
| 28 | +deci.functions[0x71D] = func |
0 commit comments