Mirrors_Framework/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-05-27 14:31:29 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/patch'

Browse Source
This commit is contained in:
Ryan Kurtz
2026-02-18 18:40:03 -05:00
parent e3c1b6393b dfaf0106b8
commit 668a6f714d
5 changed files with 80 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Ghidra/Features/Decompiler/ghidra_scripts/classrecovery/RTTIWindowsClassRecoverer.java
+27
View File
@@ -1516,6 +1516,9 @@ public class RTTIWindowsClassRecoverer extends RTTIClassRecoverer {
highFunction, recoveredClass, constructor, vbtableOffset);
if (vbtableAddress != null) {
if (isInvalidVbtable(vbtableAddress)) {
continue;
}
return vbtableAddress;
}
}
@@ -1541,6 +1544,9 @@ public class RTTIWindowsClassRecoverer extends RTTIClassRecoverer {
highFunction, recoveredClass, constructor, vbtableOffset);
if (vbtableAddress != null) {
if (isInvalidVbtable(vbtableAddress)) {
continue;
}
return vbtableAddress;
}
}
@@ -1549,6 +1555,27 @@ public class RTTIWindowsClassRecoverer extends RTTIClassRecoverer {
}
private boolean isInvalidVbtable(Address address) {
// check to see if already has a non-default symbol that is not vbtable
Symbol symbol = program.getSymbolTable().getPrimarySymbol(address);
if (symbol.getSource() != SourceType.DEFAULT &&
!symbol.getName().contains("vbtable")) {
return true;
}
// check to see if table contains an address reference
// if it is an address then is very unlikely this is a vbtable since
// it needs offset values and most are either large negatives (FFFFF....) or small offsets
// both of which are not valid addresses in a normal PE binary
Address referencedAddress = extendedFlatAPI.getPointer(address);
if (program.getMemory().contains(referencedAddress)) {
return true;
}
return false;
}
/**
* Method to find the address of the vbtable referenced at the given offset in the given function
* @param fillStructHelper a reusable {@link FillOutStructureHelper} instance to be used