yetangitu/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2025-10-04 10:19:23 +02:00
Code Issues Releases Wiki Activity

GP-1832 improved isGcc checks in RecoverClassesFromRTTI script.

Browse source
This commit is contained in:
ghidra007 2022-03-18 13:39:41 +00:00
parent 7daa822523
commit 1ae9218eba
2 changed files with 6 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

7
Ghidra/Features/Decompiler/ghidra_scripts/RecoverClassesFromRTTIScript.java
View file

@ -69,6 +69,7 @@ import ghidra.app.util.bin.format.dwarf4.next.sectionprovider.DWARFSectionProvid
import ghidra.app.util.bin.format.dwarf4.next.sectionprovider.DWARFSectionProviderFactory; import ghidra.app.util.bin.format.dwarf4.next.sectionprovider.DWARFSectionProviderFactory;
import ghidra.app.util.bin.format.pdb.PdbParserConstants; import ghidra.app.util.bin.format.pdb.PdbParserConstants;
import ghidra.app.util.importer.MessageLog; import ghidra.app.util.importer.MessageLog;
import ghidra.app.util.opinion.ElfLoader;
import ghidra.framework.options.Options; import ghidra.framework.options.Options;
import ghidra.framework.plugintool.PluginTool; import ghidra.framework.plugintool.PluginTool;
import ghidra.program.model.address.*; import ghidra.program.model.address.*;
@ -574,8 +575,7 @@ public class RecoverClassesFromRTTIScript extends GhidraScript {
*/ */
private boolean isGcc() { private boolean isGcc() {
boolean isELF = currentProgram.getExecutableFormat().contains("ELF"); if (!ElfLoader.ELF_NAME.equals(currentProgram.getExecutableFormat())) {
if (!isELF) {
return false; return false;
} }
@ -591,11 +591,10 @@ public class RecoverClassesFromRTTIScript extends GhidraScript {
return false; return false;
} }
if (!commentBlock.isLoaded()) { if (!commentBlock.isInitialized()) {
return false; return false;
} }
// check memory bytes in block for GCC: bytes // check memory bytes in block for GCC: bytes
byte[] gccBytes = { (byte) 0x47, (byte) 0x43, (byte) 0x43, (byte) 0x3a }; byte[] gccBytes = { (byte) 0x47, (byte) 0x43, (byte) 0x43, (byte) 0x3a };
byte[] maskBytes = { (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff }; byte[] maskBytes = { (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff };

6
Ghidra/Features/Decompiler/ghidra_scripts/classrecovery/RTTIGccClassRecoverer.java
View file

@ -21,6 +21,7 @@ import java.util.*;
import ghidra.app.cmd.label.DemanglerCmd; import ghidra.app.cmd.label.DemanglerCmd;
import ghidra.app.util.NamespaceUtils; import ghidra.app.util.NamespaceUtils;
import ghidra.app.util.demangler.*; import ghidra.app.util.demangler.*;
import ghidra.app.util.opinion.ElfLoader;
import ghidra.framework.plugintool.PluginTool; import ghidra.framework.plugintool.PluginTool;
import ghidra.program.flatapi.FlatProgramAPI; import ghidra.program.flatapi.FlatProgramAPI;
import ghidra.program.model.address.*; import ghidra.program.model.address.*;
@ -133,8 +134,7 @@ public class RTTIGccClassRecoverer extends RTTIClassRecoverer {
private boolean isGcc() { private boolean isGcc() {
boolean isELF = program.getExecutableFormat().contains("ELF"); if (!ElfLoader.ELF_NAME.equals(program.getExecutableFormat())) {
if (!isELF) {
return false; return false;
} }
@ -149,7 +149,7 @@ public class RTTIGccClassRecoverer extends RTTIClassRecoverer {
return false; return false;
} }
if (!commentBlock.isLoaded()) { if (!commentBlock.isInitialized()) {
return false; return false;
} }