Files
rk3588-ddr-analysis/ExportDecompiled.java
T
test0r 816848a474 RK3588 DDR init blob reverse engineering
- Ghidra decompilation of v1.02-v1.19 blobs (118 functions)
- 53 functions renamed, 79 MMIO registers mapped to TRM
- 45 timeout-less poll loops identified and patched
- Production patcher (patch_prod.py) and QEMU emulator
- Comprehensive analysis, frequency tables, community research

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-03 13:06:47 +02:00

44 lines
1.5 KiB
Java

//Exports decompiled C for all functions
//@category Export
import ghidra.app.script.GhidraScript;
import ghidra.app.decompiler.*;
import ghidra.program.model.listing.*;
import java.io.*;
public class ExportDecompiled extends GhidraScript {
@Override
public void run() throws Exception {
String[] args = getScriptArgs();
String outPath = args.length > 0 ? args[0] : "/opt/work/ddr_decompiled.c";
DecompInterface decompiler = new DecompInterface();
decompiler.openProgram(currentProgram);
PrintWriter pw = new PrintWriter(new File(outPath));
pw.println("// RK3588 DDR Init Blob - Decompiled by Ghidra");
pw.println("// Source: " + currentProgram.getName());
pw.println("// Processor: ARM Cortex LE 32-bit");
pw.println();
FunctionManager fm = currentProgram.getFunctionManager();
FunctionIterator fi = fm.getFunctions(true);
int count = 0;
while (fi.hasNext()) {
Function func = fi.next();
DecompileResults results = decompiler.decompileFunction(func, 30, monitor);
DecompiledFunction decomp = results.getDecompiledFunction();
if (decomp != null) {
pw.println("// " + func.getName() + " @ " + func.getEntryPoint());
pw.println(decomp.getC());
pw.println();
count++;
}
}
pw.close();
decompiler.dispose();
println("Exported " + count + " functions to " + outPath);
}
}