mirror of
https://github.com/NationalSecurityAgency/ghidra.git
synced 2025-10-04 18:29:37 +02:00
GP-1601 Fixed the ApplyClassFunctionDefinitionUpdatesScript and the ApplyClassFunctionSignatureUpdatesScript and related methods in RecoveredClassHelper to work with new 10.1 function definition changes.
This commit is contained in:
parent
0e9792ac45
commit
eeee6c1ba4
4 changed files with 662 additions and 701 deletions
|
@ -18,13 +18,17 @@
|
||||||
// desired class in the listing then run the script. For each function definition in the given class
|
// desired class in the listing then run the script. For each function definition in the given class
|
||||||
// that differs from the associated function signature in the listing, the script will update the
|
// that differs from the associated function signature in the listing, the script will update the
|
||||||
// listing function signatures of any related virtual functions belonging to parent and children
|
// listing function signatures of any related virtual functions belonging to parent and children
|
||||||
// classes. It will also update related data types including function definitions and vftable structures.
|
// classes.
|
||||||
// Note: The script will not work if the vftable structures were not originally applied to
|
// Note: The script will not work if the vftable structures were not originally applied to
|
||||||
// the vftables using the RecoverClassesFromRTTIScript.
|
// the vftables using the RecoverClassesFromRTTIScript.
|
||||||
// At some point, the Ghidra API will be updated to do this automatically instead of needing the
|
// At some point, the Ghidra API will be updated to do this automatically instead of needing the
|
||||||
// script to do so.
|
// script to do so. For now, to make it a bit easier, you can use the below listed key binding
|
||||||
|
// or menupath if you have the "In Tool" checkbox checked for this script in the script manager.
|
||||||
//@category C++
|
//@category C++
|
||||||
|
//@menupath Scripts.ApplyClassFunctionDefinitions
|
||||||
|
//@keybinding shift D
|
||||||
|
|
||||||
|
import java.util.ArrayList;
|
||||||
import java.util.List;
|
import java.util.List;
|
||||||
|
|
||||||
import classrecovery.RecoveredClassHelper;
|
import classrecovery.RecoveredClassHelper;
|
||||||
|
@ -63,41 +67,54 @@ public class ApplyClassFunctionDefinitionUpdatesScript extends GhidraScript {
|
||||||
println(
|
println(
|
||||||
"Applying differing function definitions for class " + classNamespace.getName(true));
|
"Applying differing function definitions for class " + classNamespace.getName(true));
|
||||||
|
|
||||||
List<Object> changedItems =
|
List<FunctionDefinition> classFunctionDefinitions =
|
||||||
classHelper.applyNewFunctionDefinitions(classNamespace, classVftableSymbols);
|
classHelper.getClassFunctionDefinitions(classNamespace);
|
||||||
|
if (classFunctionDefinitions.isEmpty()) {
|
||||||
|
println("Class " + classNamespace.getName() + " has no function definitions to apply.");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
List<Object> changedItems = new ArrayList<Object>();
|
||||||
|
|
||||||
|
for (FunctionDefinition functionDef : classFunctionDefinitions) {
|
||||||
|
monitor.checkCanceled();
|
||||||
|
|
||||||
|
List<Object> newChangedItems = classHelper.applyNewFunctionDefinition(functionDef);
|
||||||
|
|
||||||
|
changedItems = classHelper.updateList(changedItems, newChangedItems);
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
if (changedItems == null) {
|
||||||
|
println("Class " + classNamespace.getName() + " has no function definitions to apply.");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
if (changedItems.isEmpty()) {
|
if (changedItems.isEmpty()) {
|
||||||
println("No differences found for class " + classNamespace.getName(true) +
|
println("No differences found for class " + classNamespace.getName(true) +
|
||||||
" between the vftable listing function signatures and their associated data type manager function definition data types");
|
" between its function definition data types and the associated function signatures in the listing.");
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
List<Structure> structuresOnList = classHelper.getStructuresOnList(changedItems);
|
List<Structure> structuresOnList = classHelper.getStructuresOnList(changedItems);
|
||||||
List<FunctionDefinition> functionDefinitionsOnList =
|
|
||||||
classHelper.getFunctionDefinitionsOnList(changedItems);
|
|
||||||
List<Function> functionsOnList = classHelper.getFunctionsOnList(changedItems);
|
List<Function> functionsOnList = classHelper.getFunctionsOnList(changedItems);
|
||||||
|
|
||||||
|
if (!structuresOnList.isEmpty()) {
|
||||||
println();
|
println();
|
||||||
println("Updated structures:");
|
println("Updated structures:");
|
||||||
for (Structure structure : structuresOnList) {
|
for (Structure structure : structuresOnList) {
|
||||||
monitor.checkCanceled();
|
monitor.checkCanceled();
|
||||||
println(structure.getPathName());
|
println(structure.getPathName());
|
||||||
}
|
}
|
||||||
|
|
||||||
println();
|
|
||||||
println("Updated function definitions:");
|
|
||||||
for (FunctionDefinition functionDef : functionDefinitionsOnList) {
|
|
||||||
monitor.checkCanceled();
|
|
||||||
println(functionDef.getPathName());
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (!functionsOnList.isEmpty()) {
|
||||||
println();
|
println();
|
||||||
println("Updated functions:");
|
println("Updated functions:");
|
||||||
for (Function function : functionsOnList) {
|
for (Function function : functionsOnList) {
|
||||||
monitor.checkCanceled();
|
monitor.checkCanceled();
|
||||||
println(function.getEntryPoint().toString());
|
println(function.getEntryPoint().toString());
|
||||||
}
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
|
@ -14,26 +14,28 @@
|
||||||
* limitations under the License.
|
* limitations under the License.
|
||||||
*/
|
*/
|
||||||
// Script to apply any changes the user has made to recovered class virtual function signatures
|
// Script to apply any changes the user has made to recovered class virtual function signatures
|
||||||
// edited in the listing. To run the script, put the cursor on any member of the desired class in
|
// edited in the listing. To run the script, put the cursor on a changed virtual function in
|
||||||
// the listing then run the script. For each function signature in the given class that differs from
|
// the listing then run the script. If the function signature in the given class differs from
|
||||||
// the associated function definition in the data type manager, the script will update the listing
|
// the associated function definition in the data type manager, the script will update the associated
|
||||||
// function signatures of any related virtual functions belonging to parents and children classes.
|
// function definition and any other related function signatures in the listing.
|
||||||
// It will also update related data types including function definitions and vftable structures.
|
|
||||||
// Note: The script will not work if the vftable structures were not originally applied to
|
// Note: The script will not work if the vftable structures were not originally applied to
|
||||||
// the vftables using the RecoverClassesFromRTTIScript.
|
// the vftables using the RecoverClassesFromRTTIScript.
|
||||||
// At some point, the Ghidra API will be updated to do this automatically instead of needing the
|
// At some point, the Ghidra API will be updated to do this automatically instead of needing the
|
||||||
// script to do so.
|
// script to do so. For now, to make it a bit easier, you can use the below listed key binding
|
||||||
|
// or menupath if you have the "In Tool" checkbox checked for this script in the script manager.
|
||||||
//@category C++
|
//@category C++
|
||||||
|
//@menupath Scripts.ApplyClassFunctionSignatures
|
||||||
|
//@keybinding shift S
|
||||||
|
|
||||||
import java.util.List;
|
import java.util.List;
|
||||||
|
|
||||||
import classrecovery.RecoveredClassHelper;
|
import classrecovery.RecoveredClassHelper;
|
||||||
import ghidra.app.script.GhidraScript;
|
import ghidra.app.script.GhidraScript;
|
||||||
import ghidra.program.model.data.FunctionDefinition;
|
import ghidra.program.model.address.Address;
|
||||||
import ghidra.program.model.data.Structure;
|
import ghidra.program.model.data.*;
|
||||||
|
import ghidra.program.model.listing.Data;
|
||||||
import ghidra.program.model.listing.Function;
|
import ghidra.program.model.listing.Function;
|
||||||
import ghidra.program.model.symbol.Namespace;
|
import ghidra.program.model.symbol.Namespace;
|
||||||
import ghidra.program.model.symbol.Symbol;
|
|
||||||
|
|
||||||
public class ApplyClassFunctionSignatureUpdatesScript extends GhidraScript {
|
public class ApplyClassFunctionSignatureUpdatesScript extends GhidraScript {
|
||||||
@Override
|
@Override
|
||||||
|
@ -47,28 +49,79 @@ public class ApplyClassFunctionSignatureUpdatesScript extends GhidraScript {
|
||||||
RecoveredClassHelper classHelper = new RecoveredClassHelper(currentProgram, currentLocation,
|
RecoveredClassHelper classHelper = new RecoveredClassHelper(currentProgram, currentLocation,
|
||||||
state.getTool(), this, false, false, false, false, monitor);
|
state.getTool(), this, false, false, false, false, monitor);
|
||||||
|
|
||||||
|
if(currentAddress == null) {
|
||||||
|
println("Cursor must be in a class function.");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
Function function = getFunctionContaining(currentAddress);
|
||||||
|
if(function == null) {
|
||||||
|
println("Cursor must be in a class function.");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
if(function.isThunk()) {
|
||||||
|
println("User should not edit thunks as they are auto-updated from thunked function. " +
|
||||||
|
"Please undo changes to thunk then edit thunked function and rerun script");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (function.getName().contains("purecall")) {
|
||||||
|
println("Function definitions are not affected by purecall changes.");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
Namespace classNamespace = classHelper.getClassNamespace(currentAddress);
|
Namespace classNamespace = classHelper.getClassNamespace(currentAddress);
|
||||||
if (classNamespace == null) {
|
if (classNamespace == null) {
|
||||||
|
println("Cursor must be in a class function.");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
// get a vftable that points to this function - doesn't matter which since it will
|
||||||
|
// be used to get the underlying function definition which will then be used to update
|
||||||
|
// all related function signatures
|
||||||
|
List<Address> vftablesContainingFunction = classHelper.getVftablesContaining(function);
|
||||||
|
|
||||||
|
// get all vftables that point to given function
|
||||||
|
if (vftablesContainingFunction.isEmpty()) {
|
||||||
println(
|
println(
|
||||||
"Either cannot retrieve class namespace or cursor is not in a member of a class namepace");
|
"Function is not a virtual function so has no function definition or related " +
|
||||||
|
"function signatures to update");
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
List<Symbol> classVftableSymbols = classHelper.getClassVftableSymbols(classNamespace);
|
// get one that has a class vftableStructure applied there
|
||||||
if (classVftableSymbols.isEmpty()) {
|
Address vftableWithAppliedStructure = null;
|
||||||
println("There are no vftables in this class");
|
for (Address vftableAddress : vftablesContainingFunction) {
|
||||||
return;
|
monitor.checkCanceled();
|
||||||
|
|
||||||
|
Data dataAt = getDataAt(vftableAddress);
|
||||||
|
if (dataAt == null) {
|
||||||
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
println("Applying differing virtual function signatures for class " +
|
DataType baseDataType = dataAt.getBaseDataType();
|
||||||
classNamespace.getName(true));
|
|
||||||
|
|
||||||
|
if (baseDataType.getCategoryPath().getPath().contains("ClassDataTypes")) {
|
||||||
|
vftableWithAppliedStructure = vftableAddress;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (vftableWithAppliedStructure == null) {
|
||||||
|
println(
|
||||||
|
"The vftable(s) containing this function do not have a valid vftable structure " +
|
||||||
|
"applied. Please run the RecoverClassesFromRTTIScript.java on this program before " +
|
||||||
|
"using this script to update virtual functions.");
|
||||||
|
return;
|
||||||
|
}
|
||||||
List<Object> changedItems =
|
List<Object> changedItems =
|
||||||
classHelper.applyNewFunctionSignatures(classNamespace, classVftableSymbols);
|
classHelper.applyNewFunctionSignature(function, vftableWithAppliedStructure);
|
||||||
|
|
||||||
if (changedItems.isEmpty()) {
|
if (changedItems.isEmpty()) {
|
||||||
println("No differences found for class " + classNamespace.getName(true) +
|
println("No differences found between function signature at " +
|
||||||
" between the listing virtual function signatures and their associated data type manager function definition data types.");
|
function.getEntryPoint().toString() +
|
||||||
|
" and its associated function definition in the data type manager.");
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -77,27 +130,34 @@ public class ApplyClassFunctionSignatureUpdatesScript extends GhidraScript {
|
||||||
classHelper.getFunctionDefinitionsOnList(changedItems);
|
classHelper.getFunctionDefinitionsOnList(changedItems);
|
||||||
List<Function> functionsOnList = classHelper.getFunctionsOnList(changedItems);
|
List<Function> functionsOnList = classHelper.getFunctionsOnList(changedItems);
|
||||||
|
|
||||||
|
if (!structuresOnList.isEmpty()) {
|
||||||
println();
|
println();
|
||||||
println("Updated structures:");
|
println("Updated structures:");
|
||||||
for (Structure structure : structuresOnList) {
|
for (Structure structure : structuresOnList) {
|
||||||
monitor.checkCanceled();
|
monitor.checkCanceled();
|
||||||
println(structure.getPathName());
|
println(structure.getPathName());
|
||||||
}
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!functionDefinitionsOnList.isEmpty()) {
|
||||||
println();
|
println();
|
||||||
println("Updated function definitions:");
|
println("Updated function definition:");
|
||||||
for (FunctionDefinition functionDef : functionDefinitionsOnList) {
|
for (FunctionDefinition functionDef : functionDefinitionsOnList) {
|
||||||
monitor.checkCanceled();
|
monitor.checkCanceled();
|
||||||
println(functionDef.getPathName());
|
println(functionDef.getPathName());
|
||||||
}
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!functionsOnList.isEmpty()) {
|
||||||
println();
|
println();
|
||||||
println("Updated functions:");
|
println("Updated functions:");
|
||||||
for (Function function : functionsOnList) {
|
for (Function functionOnList : functionsOnList) {
|
||||||
monitor.checkCanceled();
|
monitor.checkCanceled();
|
||||||
println(function.getEntryPoint().toString());
|
println(functionOnList.getEntryPoint().toString());
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
|
@ -121,7 +121,7 @@ public class ExtendedFlatProgramAPI extends FlatProgramAPI {
|
||||||
// check for or create function pointer if valid function pointed to
|
// check for or create function pointer if valid function pointed to
|
||||||
Data data = currentProgram.getListing().getDefinedDataAt(address);
|
Data data = currentProgram.getListing().getDefinedDataAt(address);
|
||||||
if (data != null) {
|
if (data != null) {
|
||||||
if (data.isPointer() && getPointedToFunction(address) != null) {
|
if (data.isPointer() && getReferencedFunction(address) != null) {
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -131,7 +131,7 @@ public class ExtendedFlatProgramAPI extends FlatProgramAPI {
|
||||||
|
|
||||||
try {
|
try {
|
||||||
data = createData(address, pointerDataType);
|
data = createData(address, pointerDataType);
|
||||||
if (getPointedToFunction(address) != null) {
|
if (getReferencedFunction(address) != null) {
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
clearListing(address);
|
clearListing(address);
|
||||||
|
@ -212,12 +212,12 @@ public class ExtendedFlatProgramAPI extends FlatProgramAPI {
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Method to get the function pointed to by the given address if there is one. If the pointed to function
|
* Method to get the function referenced at the given address if there is one. If the function
|
||||||
* is a thunk, get the thunked function
|
* is a thunk, get the thunked function
|
||||||
* @param address the given address
|
* @param address the given address
|
||||||
* @return the (thunked if a thunk) function pointed to by the given address
|
* @return the (thunked if a thunk) function pointed to by the given address
|
||||||
*/
|
*/
|
||||||
public Function getPointedToFunction(Address address) {
|
public Function getReferencedFunction(Address address) {
|
||||||
|
|
||||||
List<Address> referencesFrom = getReferenceFromAddresses(address);
|
List<Address> referencesFrom = getReferenceFromAddresses(address);
|
||||||
if (referencesFrom.size() != 1) {
|
if (referencesFrom.size() != 1) {
|
||||||
|
@ -243,7 +243,7 @@ public class ExtendedFlatProgramAPI extends FlatProgramAPI {
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Method to get a list of addressses that are references from the given address
|
* Method to get a list of addresses that are the "reference froms" of the given address
|
||||||
* @param address the given address
|
* @param address the given address
|
||||||
* @return a list of addresses that are references from the given address
|
* @return a list of addresses that are references from the given address
|
||||||
*/
|
*/
|
||||||
|
|
File diff suppressed because it is too large
Load diff
Loading…
Add table
Add a link
Reference in a new issue