yetangitu/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2025-10-03 09:49:23 +02:00
Code Issues Releases Wiki Activity

GP-5146 fixed rttiUtil issue resulting from previous pdb anon fix. Main fix was to remove incorrect pdb secondary symbols causing rtti script to blow up. Also updated to remove known functions from other class possible const/dest lists. Also updated to remove ticks from pdb rtti instead of just removing the symbols and recreating. This fixed the missing _forParent symbols so also updated script to handle for parent case now that it is getting them.

Browse source
This commit is contained in:
ghidra007 2024-12-06 15:59:20 +00:00
parent 0411db7e88
commit 8892384b71
3 changed files with 103 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

9
Ghidra/Features/Decompiler/ghidra_scripts/classrecovery/RecoveredClassHelper.java
View file

@ -2562,7 +2562,11 @@ public class RecoveredClassHelper {
Function function = functionIterator.next();
Namespace namespace = function.getParentNamespace();
if (!namespace.equals(recoveredClass.getClassNamespace())) {
continue;
Symbol functionSymbol = function.getSymbol();
if (functionSymbol.getSource().equals(SourceType.IMPORTED)) {
functionIterator.remove(); // remove named functions belonging to other class
}
continue; // continue in either case to skip functions in other namespaces
}
String name = function.getName();
if (name.equals(recoveredClass.getName())) {
@ -8465,7 +8469,8 @@ public class RecoveredClassHelper {
Symbol symbol = symbols.next();
if (symbol.getName().equals("vftable") ||
symbol.getName().substring(1).startsWith("vftable") ||
symbol.getName().contains("vftable_for_")) {
symbol.getName().contains("vftable_for_") ||
symbol.getName().contains("vftable{for")) {
vftableSymbols.add(symbol);
}