Mirrors_Framework/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-05-29 02:45:31 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Correct wrong GCC/VS compiler detection

Browse Source 
The GCC's offset to code may not necessarily be 0x1000.
This commit is contained in:
Xiaoyin Liu
2022-08-07 07:12:34 +04:00
committed by ghidra007
parent bdc6f56c40
commit 417b784e27
1 changed files with 1 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/PeLoader.java
+1 -8
View File
@@ -1054,14 +1054,7 @@ public class PeLoader extends AbstractPeDebugLoader {
// return compilerType; // return compilerType;
// } // }
// Now look for offset to code (0x1000 for gcc) and PointerToSymbols // Now look for PointerToSymbols (0 for VS, non-zero for gcc)
// (0 for VS, non-zero for gcc)
int addrCode = br.readInt(dh.e_lfanew() + 40);
if (addrCode != 0x1000) {
compilerType = CompilerEnum.VisualStudio;
return compilerType;
}
int ptrSymTable = br.readInt(dh.e_lfanew() + 12); int ptrSymTable = br.readInt(dh.e_lfanew() + 12);
if (ptrSymTable != 0) { if (ptrSymTable != 0) {
compilerType = CompilerEnum.GCC; compilerType = CompilerEnum.GCC;