Writing scripts using the Python programming language
If we rewrite the deobfucation code skeleton using Python, it looks as follows:
01. fn = getFunctionAt(currentAddress) 02. i = getInstructionAt(currentAddress) 03. while getFunctionContaining(i.getAddress()) == fn: 04. nem = i.getMnemonicString() 05. if nem == "CALL": 06. target_address = i.getOpObjects(0) 07. if target_address[0].toString()=='EBP': 08. # Do your deobfuscation here. 09. i = i.getNext()
As you can see, it is similar to Java in that it doesn't need additional explanation.
To develop a Ghidra script, it is not necessary to remember all the functions. The only important thing is to be clear about what you want to do and...