decomp_query

Tool tools/triage/decomp_query.py (program, Triage). Answer questions about a Ghidra export (scripts/ghidra-export.sh) without reading it whole.

Run it with ./gameframe run decomp_query ARGS or python3 tools/triage/decomp_query.py. Source on GitHub.

Its own help

This is the help text in the tool itself, as ./gameframe tool decomp_query prints it.

Answer questions about a Ghidra export (scripts/ghidra-export.sh) without reading it whole.

Usage: decomp_query.py [--binary NAME] [--export DIR] [--labels FILE ...] COMMAND ARGS

Commands:
  fn ADDR|NAME          one function's pseudocode, with your labels applied
  callers ADDR|NAME     the functions that call or reference it
  callees ADDR|NAME     the functions it calls (with sizes, labelled ones first)
  find TEXT             the functions whose pseudocode contains TEXT (a string, a constant...)
  strings TEXT          defined strings containing TEXT, and the functions that use each
  writers OFFSET        the functions that store to `+ OFFSET` of a pointer (who sets a field?)
  layout FN[:VAR] ...   a structure's fields from the functions that use it: each offset with
                        its sizes, types, reads, writes and users, then a C struct to start
                        from. VAR is the pointer to it in that function (default param_1)
  biggest [N]           the N largest functions not yet labelled (where the work is)
  stats                 functions, labelled share by count and by size

ADDR is an address as Ghidra prints it (1400be770, 0x1400be770 or FUN_1400be770; for 16-bit
programs seg:off, 1000:873a or FUN_1000_873a). NAME is a
Ghidra name or one of your labels. Labels come from labels/names.tsv (address<TAB>label<TAB>
evidence): add a row every time you identify a function, and every later answer is easier to
read. The labels are read from each --labels FILE (the first file to name an address wins), else from labels/names.tsv in the current folder
(the project you work in), else from GameFrame's own. `--binary` picks a binary when the export holds several (default: the only one, or the
first .exe).

Named by

Skills: re-rea, re-ghidra, re-trace, re-format, re-land.

Agents: re-typer.