Mirrors_Framework/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-06-01 10:25:03 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

GP-2819: Don't parse PE symbol/string table when in SectionLayout.MEMORY

Browse Source 
mode
This commit is contained in:
Ryan Kurtz
2022-11-10 03:49:21 -05:00
parent c65c83794f
commit 0491bcf5ef
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/FileHeader.java
+9
View File
@@ -367,6 +367,11 @@ public class FileHeader implements StructConverter {
}
void processSymbols() throws IOException {
if (ntHeader.isRVAResoltionSectionAligned()) {
// Symbols table offsets are only valid when parsing from file, not memory
return;
}
if (isLordPE()) {
return;
}
@@ -414,6 +419,10 @@ public class FileHeader implements StructConverter {
* @throws IOException if io error
*/
long getStringTableOffset() throws IOException {
if (ntHeader.isRVAResoltionSectionAligned()) {
// String table offsets are only valid when parsing from file, not memory
return -1;
}
if (pointerToSymbolTable <= 0 || numberOfSymbols < 0) {
return -1;
}