Mirrors_Framework/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-06-02 05:57:56 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

GP-0: Only enable "PE Header Annotation" analyzer if BinaryLoader was

Browse Source 
used
This commit is contained in:
Ryan Kurtz
2026-04-01 11:18:24 -04:00
parent 789a9e12f6
commit e765ff7b77
1 changed files with 11 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Ghidra/Features/Base/src/main/java/ghidra/app/cmd/formats/PortableExecutableBinaryAnalysisCommand.java
+6 -5
View File
@@ -15,9 +15,8 @@
*/ */
package ghidra.app.cmd.formats; package ghidra.app.cmd.formats;
import java.util.List;
import java.io.IOException; import java.io.IOException;
import java.util.List;
import ghidra.app.plugin.core.analysis.AnalysisWorker; import ghidra.app.plugin.core.analysis.AnalysisWorker;
import ghidra.app.plugin.core.analysis.AutoAnalysisManager; import ghidra.app.plugin.core.analysis.AutoAnalysisManager;
@@ -27,6 +26,7 @@ import ghidra.app.util.bin.format.pe.*;
import ghidra.app.util.bin.format.pe.PortableExecutable.SectionLayout; import ghidra.app.util.bin.format.pe.PortableExecutable.SectionLayout;
import ghidra.app.util.bin.format.pe.debug.DebugCOFFSymbol; import ghidra.app.util.bin.format.pe.debug.DebugCOFFSymbol;
import ghidra.app.util.importer.MessageLog; import ghidra.app.util.importer.MessageLog;
import ghidra.app.util.opinion.BinaryLoader;
import ghidra.framework.cmd.BinaryAnalysisCommand; import ghidra.framework.cmd.BinaryAnalysisCommand;
import ghidra.program.flatapi.FlatProgramAPI; import ghidra.program.flatapi.FlatProgramAPI;
import ghidra.program.model.address.Address; import ghidra.program.model.address.Address;
@@ -47,6 +47,9 @@ public class PortableExecutableBinaryAnalysisCommand extends FlatProgramAPI
@Override @Override
public boolean canApply(Program program) { public boolean canApply(Program program) {
if (!BinaryLoader.BINARY_NAME.equals(program.getExecutableFormat())) {
return false;
}
try { try {
ByteProvider provider = ByteProvider provider =
MemoryByteProvider.createDefaultAddressSpaceByteProvider(program, false); MemoryByteProvider.createDefaultAddressSpaceByteProvider(program, false);
@@ -55,15 +58,13 @@ public class PortableExecutableBinaryAnalysisCommand extends FlatProgramAPI
DOSHeader dosHeader = new DOSHeader(reader); DOSHeader dosHeader = new DOSHeader(reader);
if (dosHeader.isDosSignature()) { if (dosHeader.isDosSignature()) {
reader.setPointerIndex(dosHeader.e_lfanew()); reader.setPointerIndex(dosHeader.e_lfanew());
short peMagic = reader.readNextShort(); //we should be pointing at the PE magic value! short peMagic = reader.readNextShort(); //we should be pointing at the PE magic value!
return (peMagic & 0x0000ffff) == Constants.IMAGE_NT_SIGNATURE; return (peMagic & 0x0000ffff) == Constants.IMAGE_NT_SIGNATURE;
} }
} }
catch (Exception e) { catch (Exception e) {
// safe to assume it's not a PE
} }
return false; return false;
} }