Mirrors_Framework/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-05-28 14:25:32 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

GP-5526 Added section tag to function start patterns. New thunk patterns

Browse Source 
in x86 gcc .plt section.  Changed priority of pre analyzer and
disassembly.
This commit is contained in:
emteere
2025-09-10 22:55:14 +00:00
parent 0613d364fc
commit 4b6d90366c
5 changed files with 60 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Ghidra/Processors/x86/data/patterns/prepatternconstraints.xml
+10 -1
View File
@@ -7,6 +7,15 @@
<compiler id="borlandcpp">
<patternfile>x86win_prepatterns.xml</patternfile>
</compiler>
<compiler id="gcc">
<patternfile>x86gcc_prepatterns.xml</patternfile>
</compiler>
</language>
<language id="x86:LE:64:default">
<compiler id="gcc">
<patternfile>x86gcc_prepatterns.xml</patternfile>
</compiler>
</language>
</patternconstraints>
Ghidra/Processors/x86/data/patterns/x86gcc_prepatterns.xml
+20
View File
@@ -0,0 +1,20 @@
<patternlist>
<pattern>
<data>
0xff25........ <!-- jmp -->
0x68......00 <!-- push -->
0xe9......ff <!-- jmp -addr -->
</data> <!-- .plt thunk -->
<funcstart thunk="true" section=".plt"/>
</pattern>
<pattern>
<data>
0xf3 0x0f 0x1e 0x1a <!-- ENDBR64 -->
0xf2 0xff 0x25 .. .. .. .. <!-- jmp -->
</data> <!-- .plt thunk -->
<funcstart thunk="true" section=".plt"/>
</pattern>
</patternlist>