From 922091e27d60aa73f0c67ed2a6527eabfbdc000d Mon Sep 17 00:00:00 2001 From: ghidra007 Date: Wed, 30 Oct 2024 17:27:43 +0000 Subject: [PATCH 1/2] GP-5053 RTTIUtil removed check for similar symbol to fix class namespaces in some anonymous namespaces that could not be determined by pdb. --- .../ghidra/app/cmd/data/rtti/RttiUtil.java | 23 +++++++++++-------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/Ghidra/Features/MicrosoftCodeAnalyzer/src/main/java/ghidra/app/cmd/data/rtti/RttiUtil.java b/Ghidra/Features/MicrosoftCodeAnalyzer/src/main/java/ghidra/app/cmd/data/rtti/RttiUtil.java index 0b28425eb1..abc0a1c718 100644 --- a/Ghidra/Features/MicrosoftCodeAnalyzer/src/main/java/ghidra/app/cmd/data/rtti/RttiUtil.java +++ b/Ghidra/Features/MicrosoftCodeAnalyzer/src/main/java/ghidra/app/cmd/data/rtti/RttiUtil.java @@ -78,16 +78,21 @@ public class RttiUtil { if (matchingSymbol != null) { return false; } - // Don't create it if a similar symbol already exists at the address of the data. - SymbolIterator symbols = symbolTable.getSymbolsAsIterator(rttiAddress); - for (Symbol symbol : symbols) { - String name = symbol.getName(); - if (name.contains(rttiSuffix)) { - return false; // Similar symbol already exists. - } - } - try { + // NOTE: This code was originally put here to skip applying labels the pdb put down if the + // above check failed but symbols were similar. This check has been removed because of + // cases where this check stopped the full namespace path from being created. The code is + // here commented out because we might want to use this to do extra checking and possibly + // remove the similar symbol instead of leaving it as a secondary symbol. + // Don't create it if a similar symbol already exists at the address of the data. +// SymbolIterator symbols = symbolTable.getSymbolsAsIterator(rttiAddress); +// for (Symbol symbol : symbols) { +// String name = symbol.getName(); +// if (name.contains(rttiSuffix)) { +// return false; // Similar symbol already exists. +// } +// } + try { // Ignore imported mangled symbol because demangling would add tick marks into the name. // The name created here is better. Set the symbol to be primary so that the demangler // won't demangle. From c4132d02d8addd1fbbd0be6d65c9bdef6cb97973 Mon Sep 17 00:00:00 2001 From: ghidra007 Date: Wed, 30 Oct 2024 17:36:36 +0000 Subject: [PATCH 2/2] GP-5079 added null check to parentOffsetMap --- .../classrecovery/RTTIWindowsClassRecoverer.java | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/Ghidra/Features/Decompiler/ghidra_scripts/classrecovery/RTTIWindowsClassRecoverer.java b/Ghidra/Features/Decompiler/ghidra_scripts/classrecovery/RTTIWindowsClassRecoverer.java index 0720dd7e58..15ac3d96a8 100644 --- a/Ghidra/Features/Decompiler/ghidra_scripts/classrecovery/RTTIWindowsClassRecoverer.java +++ b/Ghidra/Features/Decompiler/ghidra_scripts/classrecovery/RTTIWindowsClassRecoverer.java @@ -2454,7 +2454,11 @@ public class RTTIWindowsClassRecoverer extends RTTIClassRecoverer { Map parentOffsetMap = getBaseClassOffsetMap(recoveredClass); - return parentOffsetMap.get(virtualParentClasses.get(0)); + if (parentOffsetMap != null) { + return parentOffsetMap.get(virtualParentClasses.get(0)); + } + + return null; }