yetangitu/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2025-10-03 09:49:23 +02:00
Code Issues Releases Wiki Activity

GP-5998 Added security_check_cookie function patterns and callfixup for VS2022 based binaries.

Browse source
This commit is contained in:
emteere 2025-09-24 18:01:43 +00:00
parent cfab7b13df
commit 0815f463f5
4 changed files with 40 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
Ghidra/Processors/x86/data/languages/x86-64-win.cspec
View file

@ -233,4 +233,13 @@
]]></body> ]]></body>
</pcode> </pcode>
</callfixup> </callfixup>
<callfixup name="security_check_cookie">
<target name="__security_check_cookie"/>
<pcode>
<body><![CDATA[
tmpzero:4 = 0;
]]></body>
</pcode>
</callfixup>
</compiler_spec> </compiler_spec>

9
Ghidra/Processors/x86/data/languages/x86win.cspec
View file

@ -386,4 +386,13 @@
]]></body> ]]></body>
</pcode> </pcode>
</callfixup> </callfixup>
<callfixup name="security_check_cookie">
<target name="__security_check_cookie"/>
<pcode>
<body><![CDATA[
tmpzero:4 = 0;
]]></body>
</pcode>
</callfixup>
</compiler_spec> </compiler_spec>

13
Ghidra/Processors/x86/data/patterns/x86-64win_patterns.xml
View file

@ -89,4 +89,17 @@
<data>0xcccc * 0x4c8b 11...100 01001.01 0x89</data> <!-- CC filler : MOV -,RSP : MOV [- + #], --> <data>0xcccc * 0x4c8b 11...100 01001.01 0x89</data> <!-- CC filler : MOV -,RSP : MOV [- + #], -->
<funcstart/> <funcstart/>
</pattern> </pattern>
<pattern> <!-- This can most likely be removed when VS2022 FID files are added __security_check_cookie -->
<data> 01001... 0x3b 0x0d ........ ........ ........ ........
0x75 0x10
01001... 0xc1 0xc1 0x10
0x66 0xf7 0xc1 0xff 0xff
0x75 0x01
0xc3
01001... 0xc1 0xc9 0x10
0xe9 </data>
<align mark="0" bits="3"/>
<funcstart label="__security_check_cookie" validcode="function"/>
</pattern>
</patternlist> </patternlist>

9
Ghidra/Processors/x86/data/patterns/x86win_patterns.xml
View file

@ -144,4 +144,13 @@
<funcstart label="__break" validcode="function" noreturn="true"/> <!-- must be defined at an existing function --> <funcstart label="__break" validcode="function" noreturn="true"/> <!-- must be defined at an existing function -->
</pattern> </pattern>
<pattern> <!-- This can most likely be removed when VS2022 FID files are added __security_check_cookie -->
<data> 0x3b 0x0d 0x.. 0x.. 0x.. 0x..
0x75 0x01
0xc3
0xe9
</data>
<funcstart label="__security_check_cookie" validcode="function"/>
</pattern>
</patternlist> </patternlist>