yetangitu/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2025-10-05 19:42:36 +02:00
Code Issues Releases Wiki Activity

GP-4376 Updated gcc class recovery to allow for special typeinfos that

Browse source 
are not in program memory or external block. Also updated to add a check
for unhandled relocations. Also updated to allow for non-mangled
typeinfo-name strings.
This commit is contained in:
ghidra007 2024-03-06 17:00:26 +00:00
parent 3e35b4d4a7
commit b04d5335ca
5 changed files with 318 additions and 128 deletions
Download patch file Download diff file Expand all files Collapse all files

55
Ghidra/Features/Decompiler/ghidra_scripts/classrecovery/SpecialVtable.java
View file

@ -15,9 +15,15 @@
*/
package classrecovery;
import java.util.List;
import ghidra.program.model.address.Address;
import ghidra.program.model.listing.Program;
import ghidra.program.model.reloc.Relocation;
import ghidra.program.model.reloc.Relocation.Status;
import ghidra.program.model.reloc.RelocationTable;
import ghidra.program.model.symbol.Namespace;
import ghidra.program.model.symbol.Symbol;
import ghidra.util.exception.CancelledException;
import ghidra.util.task.TaskMonitor;
@ -45,7 +51,20 @@ public class SpecialVtable extends Vtable {
return;
}
typeinfoRefAddress = vtableAddress.add(defaultPointerSize);
typeinfoRefAddress = vtableAddress.add(defaultPointerSize);
// check for vtable has memory but all zeros or has possible invalid values which in both
// cases would make the pointer to special typeinfo invalid
if (hasSpecialCopyUnhandledRelocation(vtableAddress)) {
isConstruction = false;
isPrimary = true;
typeinfoAddress = null;
length = 3 * defaultPointerSize; //actually prob 11*defPtr but are all zeros in this case
hasVfunctions = true; // they are null though so will count as num=0, need this to be true so check for refs to vfunction top will work
numVfunctions = 0;
vfunctionTop = vtableAddress.add(2 * defaultPointerSize);
return;
}
setTypeinfoAddress();
@ -71,7 +90,9 @@ public class SpecialVtable extends Vtable {
isConstruction = false;
classNamespace = typeinfoNamespace;
if (classNamespace == null) {
classNamespace = typeinfoNamespace;
}
setLength();
@ -82,4 +103,34 @@ public class SpecialVtable extends Vtable {
return refFromTypeinfos;
}
private boolean hasSpecialCopyUnhandledRelocation(Address address) {
RelocationTable relocationTable = program.getRelocationTable();
List<Relocation> relocations = relocationTable.getRelocations(address);
for (Relocation relocation : relocations) {
Status status = relocation.getStatus();
if (status == Status.UNSUPPORTED) {
String symbolName = relocation.getSymbolName();
if (symbolName == null || !symbolName.contains("class_type_info")) {
continue;
}
//if relocation symbol is the same as the symbol at the relcation address
//then this situation is not an issue - it indicates a copy relocation at the
//location of the special typeinfo vtable which is a use case that can be handled
Symbol symbolAtAddress = program.getSymbolTable()
.getSymbol(symbolName, address, program.getGlobalNamespace());
if (symbolAtAddress != null) {
return true;
}
}
}
return false;
}
}