yetangitu/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2025-10-03 01:39:21 +02:00
Code Issues Releases Wiki Activity

GP-3293 - Added RTTI Analyzer option to the program information called 'RTTI Found' and use it to determine whether to rerun and also when deciding whether to run the RTTI script.

Browse source
This commit is contained in:
ghidra007 2023-04-14 18:57:55 +00:00
parent 75a185aa9e
commit d8cdcfb068
3 changed files with 161 additions and 97 deletions
Download patch file Download diff file Expand all files Collapse all files

46
Ghidra/Features/MicrosoftCodeAnalyzer/src/main/java/ghidra/app/plugin/prototype/MicrosoftCodeAnalyzerPlugin/RttiAnalyzer.java
View file

@ -23,6 +23,7 @@ import ghidra.app.cmd.data.rtti.*;
import ghidra.app.services.*;
import ghidra.app.util.datatype.microsoft.*;
import ghidra.app.util.importer.MessageLog;
import ghidra.framework.options.Options;
import ghidra.program.model.address.*;
import ghidra.program.model.data.InvalidDataTypeException;
import ghidra.program.model.listing.Program;
@ -41,6 +42,7 @@ public class RttiAnalyzer extends AbstractAnalyzer {
private static final String NAME = "Windows x86 PE RTTI Analyzer";
private static final String DESCRIPTION =
"Finds and creates RTTI metadata structures and associated vf tables.";
public static final String RTTI_FOUND_OPTION = "RTTI Found";
// TODO If we want the RTTI analyzer to find all type descriptors regardless of whether
// they are used for RTTI, then change the CLASS_PREFIX_CHARS to ".". Need to be
@ -61,7 +63,7 @@ public class RttiAnalyzer extends AbstractAnalyzer {
setPriority(AnalysisPriority.REFERENCE_ANALYSIS.before());
setDefaultEnablement(true);
validationOptions = new DataValidationOptions();
applyOptions = new DataApplyOptions();
applyOptions = new DataApplyOptions();
}
@Override
@ -72,10 +74,16 @@ public class RttiAnalyzer extends AbstractAnalyzer {
@Override
public boolean added(Program program, AddressSetView set, TaskMonitor monitor, MessageLog log)
throws CancelledException {
// "rttiFound" option added in 10.3 so if analyzed with previous version analyzer will rerun
if(hasRun(program)) {
return true;
}
Address commonVfTableAddress = RttiUtil.findTypeInfoVftableAddress(program, monitor);
if (commonVfTableAddress == null) {
if (commonVfTableAddress == null) {
setRttiFound(program, false);
return true;
}
@ -83,14 +91,42 @@ public class RttiAnalyzer extends AbstractAnalyzer {
Set<Address> possibleTypeAddresses = locatePotentialRTTI0Entries(program, set, monitor);
if (possibleTypeAddresses == null) {
setRttiFound(program, false);
return true;
}
// We now have a list of potential rtti0 addresses.
processRtti0(possibleTypeAddresses, program, monitor);
setRttiFound(program, true);
return true;
}
/**
* Has this analyzer been run on the given program. NOTE: option new as of 10.3 so this will
* not be accurate for older programs.
* @param program the given program
* @return true if analyzer has run, false if not or unknown (before version 10.3)
*/
private boolean hasRun(Program program) {
Options programOptions = program.getOptions(Program.PROGRAM_INFO);
Boolean hasRun = (Boolean) programOptions.getObject(RTTI_FOUND_OPTION, null);
if(hasRun == null) {
return false;
}
return true;
}
/**
* Method to set the RTTI Found option for the given program
* @param program the given program
* @param rttiFound true if RTTI found and processed, false otherwise
*/
private void setRttiFound(Program program, boolean rttiFound) {
Options programOptions = program.getOptions(Program.PROGRAM_INFO);
programOptions.setBoolean(RTTI_FOUND_OPTION, rttiFound);
}
/**
* locate any potential RTTI0 based on pointers to the type_info vftable
@ -98,7 +134,7 @@ public class RttiAnalyzer extends AbstractAnalyzer {
* @param set restricted set to locate within
* @param monitor monitor for canceling
* @return set of potential RTTI0 entries
* @throws CancelledException
* @throws CancelledException if cancelled
*/
private Set<Address> locatePotentialRTTI0Entries(Program program, AddressSetView set,
TaskMonitor monitor) throws CancelledException {