Chapter 6
- The appropriate Ghidra API function to set a byte at a given memory address is
setByte
.I followed these steps to reach this Ghidra Flat API function:
1. I checked the Ghidra Flat API reference provided in Chapter 6, Scripting Malware Analysis.
2. I located the set of Ghidra Flat API functions of interest: Use these functions to set a value into some memory address.
3. I identified the most relevant function, reading its name and figuring out what it does:
setByte
.4. I checked the online documentation of the function to confirm that it was the function I was looking for:https://ghidra.re/ghidra_docs/api/ghidra/program/database/mem/MemoryMapDB.html#setByte(ghidra.program.model.address.Address,byte).
5. The description matched my needs: Write byte at addr. So, we can use it for that.
- Ghidra is written in the Java programming language and this is why this language is the most supported (of course, the decompiler is not; it is written in the C++ programming language) so the...