yetangitu/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2025-10-03 01:39:21 +02:00
Code Issues Releases Wiki Activity

GP-5900: PeLoader now creates thunks in EXTERNAL block for forwarded exported functions

Browse source
This commit is contained in:
Ryan Kurtz 2025-09-16 05:56:14 -04:00
parent 162733b585
commit ad35a7e956
1 changed files with 56 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

113
Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/PeLoader.java
View file

@ -534,13 +534,26 @@ public class PeLoader extends AbstractPeDebugLoader {
return; return;
} }
AddressFactory af = program.getAddressFactory(); AddressSpace space = program.getAddressFactory().getDefaultAddressSpace();
AddressSpace space = af.getDefaultAddressSpace();
SymbolTable symTable = program.getSymbolTable(); SymbolTable symTable = program.getSymbolTable();
Listing listing = program.getListing();
ReferenceManager refManager = program.getReferenceManager(); ReferenceManager refManager = program.getReferenceManager();
ExternalManager extManager = program.getExternalManager();
FunctionManager funcManager = program.getFunctionManager();
// If we have any forwarders, set up the EXTERNAL block
ExportInfo[] exports = edd.getExports(); ExportInfo[] exports = edd.getExports();
Address extAddr = null;
long forwardedCount = Arrays.stream(exports).filter(ExportInfo::isForwarded).count();
if (forwardedCount > 0) {
try {
extAddr = AbstractProgramLoader.addExternalBlock(program,
forwardedCount * program.getDefaultPointerSize(), log);
}
catch (Exception e) {
log.appendException(e);
}
}
for (ExportInfo export : exports) { for (ExportInfo export : exports) {
if (monitor.isCancelled()) { if (monitor.isCancelled()) {
return; return;
@ -548,65 +561,51 @@ public class PeLoader extends AbstractPeDebugLoader {
Address address = space.getAddress(export.getAddress()); Address address = space.getAddress(export.getAddress());
setComment(CommentType.PRE, address, export.getComment()); setComment(CommentType.PRE, address, export.getComment());
symTable.addExternalEntryPoint(address);
String name = export.getName();
try {
symTable.createLabel(address, name, SourceType.IMPORTED);
}
catch (InvalidInputException e) {
// Don't create invalid symbol
}
try {
symTable.createLabel(address, SymbolUtilities.ORDINAL_PREFIX + export.getOrdinal(),
SourceType.IMPORTED);
}
catch (InvalidInputException e) {
// Don't create invalid symbol
}
// When exported symbol is a forwarder,
// a string exists at the address of the export
// Therefore, create a string data object to prevent
// disassembler from attempting to create
// code here. If code was created, it would be incorrect
// and offcut.
if (export.isForwarded()) { if (export.isForwarded()) {
try { Data data =
listing.createData(address, TerminatedStringDataType.dataType, -1); PeUtils.createData(program, address, TerminatedStringDataType.dataType, log);
Data data = listing.getDataAt(address); if (extAddr != null && data != null && data.getValue() instanceof String str) {
if (data != null) { int dotpos = str.indexOf('.');
Object obj = data.getValue(); if (dotpos < 0) {
if (obj instanceof String) { dotpos = 0; // TODO
String str = (String) obj; }
int dotpos = str.indexOf('.'); String libName = str.substring(0, dotpos) + ".dll";
String extSymbolName = str.substring(dotpos + 1);
if (dotpos < 0) { try {
dotpos = 0;//TODO symTable.addExternalEntryPoint(extAddr);
} Function function = funcManager.createFunction(export.getName(), extAddr,
new AddressSet(extAddr), SourceType.IMPORTED);
// get the name of the dll ExternalLocation loc = extManager.addExtLocation(libName.toUpperCase(),
String dllName = str.substring(0, dotpos) + ".dll"; extSymbolName, null, SourceType.IMPORTED);
function.setThunkedFunction(loc.createFunction());
// get the name of the symbol symTable.createLabel(extAddr,
String expName = str.substring(dotpos + 1); SymbolUtilities.ORDINAL_PREFIX + export.getOrdinal(),
SourceType.IMPORTED);
try { refManager.addMemoryReference(address, extAddr, RefType.DATA,
refManager.addExternalReference(address, dllName.toUpperCase(), SourceType.IMPORTED, 0);
expName, null, SourceType.IMPORTED, 0, RefType.DATA); setComment(CommentType.PLATE, extAddr, export.getComment());
} }
catch (DuplicateNameException e) { catch (InvalidInputException | DuplicateNameException
log.appendMsg("External location not created: " + e.getMessage()); | OverlappingFunctionException e) {
} log.appendMsg("External location not created: " + e.getMessage());
catch (InvalidInputException e) { }
log.appendMsg("External location not created: " + e.getMessage()); finally {
} extAddr = extAddr.add(program.getDefaultPointerSize());
}
} }
} }
catch (CodeUnitInsertionException e) { }
// Nothing to do...just continue on else {
symTable.addExternalEntryPoint(address);
try {
symTable.createLabel(address, export.getName(), SourceType.IMPORTED);
symTable.createLabel(address,
SymbolUtilities.ORDINAL_PREFIX + export.getOrdinal(), SourceType.IMPORTED);
}
catch (InvalidInputException e) {
// Don't create invalid symbol
} }
} }
} }