Mirrors_Framework/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-05-20 21:34:44 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

GP-1832 improved isGcc checks in RecoverClassesFromRTTI script.

Browse Source
This commit is contained in:
ghidra007
2022-03-18 13:39:41 +00:00
parent 7daa822523
commit 1ae9218eba
2 changed files with 6 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Ghidra/Features/Decompiler/ghidra_scripts/RecoverClassesFromRTTIScript.java
+3 -4
View File
@@ -69,6 +69,7 @@ import ghidra.app.util.bin.format.dwarf4.next.sectionprovider.DWARFSectionProvid
import ghidra.app.util.bin.format.dwarf4.next.sectionprovider.DWARFSectionProviderFactory;
import ghidra.app.util.bin.format.pdb.PdbParserConstants;
import ghidra.app.util.importer.MessageLog;
import ghidra.app.util.opinion.ElfLoader;
import ghidra.framework.options.Options;
import ghidra.framework.plugintool.PluginTool;
import ghidra.program.model.address.*;
@@ -574,8 +575,7 @@ public class RecoverClassesFromRTTIScript extends GhidraScript {
*/
private boolean isGcc() {
boolean isELF = currentProgram.getExecutableFormat().contains("ELF");
if (!isELF) {
if (!ElfLoader.ELF_NAME.equals(currentProgram.getExecutableFormat())) {
return false;
}
@@ -591,11 +591,10 @@ public class RecoverClassesFromRTTIScript extends GhidraScript {
return false;
}
if (!commentBlock.isLoaded()) {
if (!commentBlock.isInitialized()) {
return false;
}
// check memory bytes in block for GCC: bytes
byte[] gccBytes = { (byte) 0x47, (byte) 0x43, (byte) 0x43, (byte) 0x3a };
byte[] maskBytes = { (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff };