Mirrors_Framework/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-05-27 04:15:28 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

GP-64 Partial Clang-for-Win support: PeLoader, opinion/ldefs, fix some

Browse Source 
analyzers and their helpers and tests
This commit is contained in:
ghizard
2020-08-07 11:11:29 -04:00
parent 4506acddf9
commit 0013025a40
8 changed files with 54 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Ghidra/Features/MicrosoftCodeAnalyzer/src/main/java/ghidra/app/cmd/data/AbstractCreateDataTypeModel.java
-18
View File
@@ -17,11 +17,8 @@ package ghidra.app.cmd.data;
import ghidra.app.util.datatype.microsoft.DataValidationOptions;
import ghidra.app.util.datatype.microsoft.MSDataTypeUtils;
import ghidra.app.util.opinion.PeLoader;
import ghidra.app.util.opinion.PeLoader.CompilerOpinion.CompilerEnum;
import ghidra.program.model.address.*;
import ghidra.program.model.data.*;
import ghidra.program.model.lang.CompilerSpecID;
import ghidra.program.model.listing.*;
import ghidra.program.model.mem.*;
@@ -113,17 +110,6 @@ public abstract class AbstractCreateDataTypeModel {
imageBaseAddress = getProgram().getImageBase();
}
/**
* Determine if the program in this model is for windows.
* @return true if the program is a windows program.
*/
final protected boolean isWindows() {
CompilerSpecID compilerSpecID = program.getCompilerSpec().getCompilerSpecID();
return compilerSpecID.getIdAsString().equals("windows") &&
program.getExecutableFormat().equals(PeLoader.PE_NAME) &&
program.getCompiler().equals(CompilerEnum.VisualStudio.toString());
}
/**
* Determine if the address for this model is actually in the program.
* @return true if the address for the data type is valid.
@@ -293,10 +279,6 @@ public abstract class AbstractCreateDataTypeModel {
* address. The message in the exception indicates why the model isn't valid.
*/
private void doValidate() throws InvalidDataTypeException {
if (!isWindows()) {
throw new InvalidDataTypeException(
getName() + " data type model is only valid for Visual Studio windows PE.");
}
if (!isValidAddress()) {
throw new InvalidDataTypeException(
getName() + " data type isn't at a valid address " + getAddress() + ".");
Ghidra/Features/MicrosoftCodeAnalyzer/src/main/java/ghidra/app/plugin/prototype/MicrosoftCodeAnalyzerPlugin/PEExceptionAnalyzer.java
+3 -9
View File
@@ -24,12 +24,9 @@ import ghidra.app.services.*;
import ghidra.app.util.datatype.microsoft.DataApplyOptions;
import ghidra.app.util.datatype.microsoft.DataValidationOptions;
import ghidra.app.util.importer.MessageLog;
import ghidra.app.util.opinion.PeLoader;
import ghidra.app.util.opinion.PeLoader.CompilerOpinion.CompilerEnum;
import ghidra.framework.cmd.Command;
import ghidra.program.model.address.*;
import ghidra.program.model.data.InvalidDataTypeException;
import ghidra.program.model.lang.CompilerSpecID;
import ghidra.program.model.listing.Program;
import ghidra.program.model.mem.MemoryBlock;
import ghidra.program.util.ProgramMemoryUtil;
@@ -64,10 +61,7 @@ public class PEExceptionAnalyzer extends AbstractAnalyzer {
@Override
public boolean canAnalyze(Program program) {
CompilerSpecID compilerSpecID = program.getCompilerSpec().getCompilerSpecID();
return compilerSpecID.getIdAsString().equals("windows") &&
program.getExecutableFormat().equals(PeLoader.PE_NAME) &&
program.getCompiler().equals(CompilerEnum.VisualStudio.toString());
return PEUtil.canAnalyzePeVisualStudioOrClang(program);
}
@Override
@@ -87,8 +81,8 @@ public class PEExceptionAnalyzer extends AbstractAnalyzer {
"[\\x20,\\x21,\\x22]\\x05\\x93[\\x19,\\x39,\\x59,\\x79,\\x99,\\xb9,\\xd9,\\xf9]";
String bePattern =
"[\\x19,\\x39,\\x59,\\x79,\\x99,\\xb9,\\xd9,\\xf9]\\x93\\x05[\\x20,\\x21,\\x22]";
RegExSearchData regExSearchData = RegExSearchData
.createRegExSearchData(program.getLanguage().isBigEndian() ? bePattern : lePattern);
RegExSearchData regExSearchData = RegExSearchData.createRegExSearchData(
program.getLanguage().isBigEndian() ? bePattern : lePattern);
int alignment = 4;
SearchInfo searchInfo = new SearchInfo(regExSearchData, MATCH_LIMIT, false, true, alignment,
false, new CodeUnitSearchInfo(false, true, true), null);
Ghidra/Features/MicrosoftCodeAnalyzer/src/main/java/ghidra/app/plugin/prototype/MicrosoftCodeAnalyzerPlugin/PEUtil.java
+13 -9
View File
@@ -26,6 +26,7 @@ import ghidra.app.util.datatype.microsoft.GuidInfo;
import ghidra.app.util.datatype.microsoft.GuidUtil;
import ghidra.app.util.opinion.BinaryLoader;
import ghidra.app.util.opinion.PeLoader;
import ghidra.app.util.opinion.PeLoader.CompilerOpinion.CompilerEnum;
import ghidra.program.model.address.*;
import ghidra.program.model.data.DataType;
import ghidra.program.model.data.TypeDef;
@@ -42,12 +43,11 @@ public class PEUtil {
return true;
}
if (format.equals(BinaryLoader.BINARY_NAME)) {
MemoryByteProvider mbp =
new MemoryByteProvider(program.getMemory(),
program.getAddressFactory().getDefaultAddressSpace());
MemoryByteProvider mbp = new MemoryByteProvider(program.getMemory(),
program.getAddressFactory().getDefaultAddressSpace());
try {
FactoryBundledWithBinaryReader reader =
new FactoryBundledWithBinaryReader(RethrowContinuesFactory.INSTANCE, mbp, true/*LittleEndian*/);
FactoryBundledWithBinaryReader reader = new FactoryBundledWithBinaryReader(
RethrowContinuesFactory.INSTANCE, mbp, true/*LittleEndian*/);
DOSHeader dosHeader = DOSHeader.createDOSHeader(reader);
if (dosHeader.e_magic() == DOSHeader.IMAGE_DOS_SIGNATURE) {
int peHeaderStartIndex = dosHeader.e_lfanew();
@@ -63,6 +63,12 @@ public class PEUtil {
return false;
}
static public boolean canAnalyzePeVisualStudioOrClang(Program program) {
return program.getExecutableFormat().equals(PeLoader.PE_NAME) &&
(program.getCompiler().equals(CompilerEnum.VisualStudio.toString()) ||
program.getCompiler().equals(CompilerEnum.Clang.toString()));
}
static DataType getActualType(DataType dataType) {
if (dataType instanceof TypeDef) {
return getActualType(((TypeDef) dataType).getDataType());
@@ -76,8 +82,7 @@ public class PEUtil {
AddressSpace defaultSpace = addressFactory.getDefaultAddressSpace();
try {
int addrAsInt = memory.getInt(addr);
Address pointedToAddr =
addressFactory.getAddress(defaultSpace.getSpaceID(), addrAsInt);
Address pointedToAddr = addressFactory.getAddress(defaultSpace.getSpaceID(), addrAsInt);
return memory.contains(pointedToAddr);
}
catch (MemoryAccessException e) {
@@ -91,8 +96,7 @@ public class PEUtil {
AddressSpace defaultSpace = addressFactory.getDefaultAddressSpace();
try {
int addrAsInt = memory.getInt(addr);
Address pointedToAddr =
addressFactory.getAddress(defaultSpace.getSpaceID(), addrAsInt);
Address pointedToAddr = addressFactory.getAddress(defaultSpace.getSpaceID(), addrAsInt);
if (memory.contains(pointedToAddr)) {
GuidInfo guidInfo = GuidUtil.getKnownGuid(program, pointedToAddr);
if (guidInfo != null) {
Ghidra/Features/MicrosoftCodeAnalyzer/src/main/java/ghidra/app/plugin/prototype/MicrosoftCodeAnalyzerPlugin/RttiAnalyzer.java
+4 -4
View File
@@ -69,7 +69,7 @@ public class RttiAnalyzer extends AbstractAnalyzer {
@Override
public boolean canAnalyze(Program program) {
return PEUtil.canAnalyze(program);
return PEUtil.canAnalyzePeVisualStudioOrClang(program);
}
@Override
@@ -134,7 +134,7 @@ public class RttiAnalyzer extends AbstractAnalyzer {
monitor.setMaximum(possibleRtti0Addresses.size());
monitor.setMessage("Creating RTTI Data...");
ArrayList<Address> rtti0Locations = new ArrayList<Address>();
ArrayList<Address> rtti0Locations = new ArrayList<>();
int count = 0;
for (Address rtti0Address : possibleRtti0Addresses) {
monitor.checkCanceled();
@@ -277,7 +277,7 @@ public class RttiAnalyzer extends AbstractAnalyzer {
}
// Each time a match for this byte pattern validate as an RTTI4 and add to list
GenericMatchAction<Address> action = new GenericMatchAction<Address>(rtti0Address) {
GenericMatchAction<Address> action = new GenericMatchAction<>(rtti0Address) {
@Override
public void apply(Program prog, Address addr, Match match) {
Address possibleRtti4Address;
@@ -311,7 +311,7 @@ public class RttiAnalyzer extends AbstractAnalyzer {
// create a Pattern of the bytes and the MatchAction to perform upon a match
GenericByteSequencePattern<Address> genericByteMatchPattern =
new GenericByteSequencePattern<Address>(bytes, action);
new GenericByteSequencePattern<>(bytes, action);
searcher.addPattern(genericByteMatchPattern);
}
Ghidra/Features/MicrosoftCodeAnalyzer/src/test/java/ghidra/app/cmd/data/rtti/RttiModelTest.java
+2 -3
View File
@@ -512,7 +512,7 @@ public class RttiModelTest extends AbstractRttiTest {
}
@Test
public void testInvalidRtti4_64NonVS() throws Exception {
public void testInvalidRtti4_UnalignedRtti0() throws Exception {
ProgramBuilder builder = build64BitX86NonVS();
ProgramDB program = builder.getProgram();
setupRtti4_32(builder, 0x101001340L, 0, 0, 0, "0x00005364", "0x0000137c");
@@ -522,8 +522,7 @@ public class RttiModelTest extends AbstractRttiTest {
model.validate();
}
catch (InvalidDataTypeException e) {
assertEquals(
"RTTICompleteObjectLocator data type model is only valid for Visual Studio windows PE.",
assertEquals("TypeDescriptor data type is not properly aligned at 101005364.",
e.getMessage());
}
}