Mirrors_Framework/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-05-31 15:46:16 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

GP-1832 improved isGcc checks in RecoverClassesFromRTTI script.

Browse Source
This commit is contained in:
ghidra007
2022-03-18 13:39:41 +00:00
parent 7daa822523
commit 1ae9218eba
2 changed files with 6 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Ghidra/Features/Decompiler/ghidra_scripts/RecoverClassesFromRTTIScript.java
+3 -4
View File
@@ -69,6 +69,7 @@ import ghidra.app.util.bin.format.dwarf4.next.sectionprovider.DWARFSectionProvid
import ghidra.app.util.bin.format.dwarf4.next.sectionprovider.DWARFSectionProviderFactory; import ghidra.app.util.bin.format.dwarf4.next.sectionprovider.DWARFSectionProviderFactory;
import ghidra.app.util.bin.format.pdb.PdbParserConstants; import ghidra.app.util.bin.format.pdb.PdbParserConstants;
import ghidra.app.util.importer.MessageLog; import ghidra.app.util.importer.MessageLog;
import ghidra.app.util.opinion.ElfLoader;
import ghidra.framework.options.Options; import ghidra.framework.options.Options;
import ghidra.framework.plugintool.PluginTool; import ghidra.framework.plugintool.PluginTool;
import ghidra.program.model.address.*; import ghidra.program.model.address.*;
@@ -574,8 +575,7 @@ public class RecoverClassesFromRTTIScript extends GhidraScript {
*/ */
private boolean isGcc() { private boolean isGcc() {
boolean isELF = currentProgram.getExecutableFormat().contains("ELF"); if (!ElfLoader.ELF_NAME.equals(currentProgram.getExecutableFormat())) {
if (!isELF) {
return false; return false;
} }
@@ -591,11 +591,10 @@ public class RecoverClassesFromRTTIScript extends GhidraScript {
return false; return false;
} }
if (!commentBlock.isLoaded()) { if (!commentBlock.isInitialized()) {
return false; return false;
} }
// check memory bytes in block for GCC: bytes // check memory bytes in block for GCC: bytes
byte[] gccBytes = { (byte) 0x47, (byte) 0x43, (byte) 0x43, (byte) 0x3a }; byte[] gccBytes = { (byte) 0x47, (byte) 0x43, (byte) 0x43, (byte) 0x3a };
byte[] maskBytes = { (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff }; byte[] maskBytes = { (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff };
Ghidra/Features/Decompiler/ghidra_scripts/classrecovery/RTTIGccClassRecoverer.java
+3 -3
View File
@@ -21,6 +21,7 @@ import java.util.*;
import ghidra.app.cmd.label.DemanglerCmd; import ghidra.app.cmd.label.DemanglerCmd;
import ghidra.app.util.NamespaceUtils; import ghidra.app.util.NamespaceUtils;
import ghidra.app.util.demangler.*; import ghidra.app.util.demangler.*;
import ghidra.app.util.opinion.ElfLoader;
import ghidra.framework.plugintool.PluginTool; import ghidra.framework.plugintool.PluginTool;
import ghidra.program.flatapi.FlatProgramAPI; import ghidra.program.flatapi.FlatProgramAPI;
import ghidra.program.model.address.*; import ghidra.program.model.address.*;
@@ -133,8 +134,7 @@ public class RTTIGccClassRecoverer extends RTTIClassRecoverer {
private boolean isGcc() { private boolean isGcc() {
boolean isELF = program.getExecutableFormat().contains("ELF"); if (!ElfLoader.ELF_NAME.equals(program.getExecutableFormat())) {
if (!isELF) {
return false; return false;
} }
@@ -149,7 +149,7 @@ public class RTTIGccClassRecoverer extends RTTIClassRecoverer {
return false; return false;
} }
if (!commentBlock.isLoaded()) { if (!commentBlock.isInitialized()) {
return false; return false;
} }