RecoverJumpTable.java

This script fixes switch statements in the decompiler when Ghidra fails.

Usage

Make sure to save before running this script!!! Ghidra often fails to gather all cases for some switches, even though the jump table can be easily calculated form the context. The 'SwitchOverride.java' script is a good start but having to manually find all the targets is tedious. This script figures out where the targets are automatically! A switch usually looks like this in assembly:

LEA R9, [switch_var + offset]
CMP R9, max_value
JA default_case
MOVSXD RAX, dword ptr [jump_table + R9 * 4]
ADD RAX, jump_table
JMP RAX

Note that R9 and RAX can be any register. The offset is usually negative. If the offset is zero, the assembly will look like this:

CMP switch_var, max_value
JA default_case
MOVSXD RAX, dword ptr [jump_table + switch_var * 4]
ADD RAX, jump_table
JMP RAX

Add the script to Ghidra, run it, fill in the jump address, jump table start, max index and offset, and then re-create the function (right-click the function in the listing view > Function > Re-create)