From 683b8dae88074c629ee2d8a7b69e1c2994d6d0ef Mon Sep 17 00:00:00 2001 From: Fereydoun Memarzanjany Date: Mon, 20 Jul 2026 00:45:01 -0600 Subject: [PATCH] 9396: Fix unsigned PE export ordinal-table indexes The PE Export Ordinal Table stores unsigned 16-bit indexes into the Export Address Table. Reading these values with readShort() sign-extends entries from 0x8000 through 0xffff, preventing them from matching the nonnegative function index and causing their export names to be lost. --- .../java/ghidra/app/util/bin/format/pe/ExportDataDirectory.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/ExportDataDirectory.java b/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/ExportDataDirectory.java index 54d14c39cf..01bb7df906 100644 --- a/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/ExportDataDirectory.java +++ b/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/ExportDataDirectory.java @@ -314,7 +314,7 @@ public class ExportDataDirectory extends DataDirectory implements StructConverte // See if this function has an associated name exported for it. for (int j = 0; j < numberOfNames; ++j) { - int jthOrdinalVal = reader.readShort(pointerToOrdinals + (j * 2)); + int jthOrdinalVal = reader.readUnsignedShort(pointerToOrdinals + (j * 2)); if (jthOrdinalVal == i) { int jthNameRVA = reader.readInt(pointerToNames + (j * 4)); int jthNamePtr = ntHeader.rvaToPointer(jthNameRVA);