Getting a string value for Varnode which isConstant() == true (Java)

[Martyx00]

Hello,
I am struggling for couple hours on trying to get a String value (imagine for example format string such as Hello %s!\n for a function call to printf) after I get the Varnode (I get the Varnode by calling the getInput(1) on the PcodeOP of the printf function call) . I am able to retrieve Address of that string in the binary with ease, however, I have not found a way how to read the String value of that constant itself.

Any help is greatly appreciated! Thanks!

[astrelsky]

Once you have the address of the string you may retrieve the Data using getDataAt(Address) or create it using createAsciiString(Address) if not already created. Once you have the Data the string value may be obtained via
(String) data.getValue(). The Data interface has a hasStringValue method if you wish to check before casting the value.

[Martyx00]

It is a completely dummy ELF file I created to learn how to work with Ghidra API. Loading was done with standard ELF format file and x86:LE:64:default:gcc language. The basic analysis was left in the default state and the module was run afterwards as "One-shot". The string constant in question can be clearly seen in the Listing at the same address that I am trying to get it from (0x00100864) with getDataAt. It was also properly recognized as a String value by the decompiler. I have attached the file.
strcpy_test.zip

[astrelsky]

It seems like there is some other issue occurring. May you post your code?

[dev747368]

I think the issue is that the address that you get from the varnode is in a different address space (const) and needs to be converted to the ram address space. A recent commit (28e0480) that added an analyzer that also pulls printf-style strings has an example of converting the varnode const address to ram addresses.

[Martyx00]

@dev747368 that works! Thanks!

[Heath123]

For anyone seeing this in the future here is the relevant code:

private Address convertAddressToRamSpace(Address address) {

    String addressString = address.toString(false);
    return this.program.getAddressFactory().getAddress(addressString);
}