@@ -128,6 +128,7 @@ public static int getVfTableCount(Program program, Address vfTableBaseAddress) {
128
128
129
129
Memory memory = program .getMemory ();
130
130
MemoryBlock textBlock = memory .getBlock (".text" );
131
+ MemoryBlock nepBlock = memory .getBlock (".nep" );
131
132
AddressSetView initializedAddresses = memory .getLoadedAndInitializedAddressSet ();
132
133
PseudoDisassembler pseudoDisassembler = new PseudoDisassembler (program );
133
134
@@ -148,17 +149,24 @@ public static int getVfTableCount(Program program, Address vfTableBaseAddress) {
148
149
if (!initializedAddresses .contains (referencedAddress )) {
149
150
break ; // Not pointing to initialized memory.
150
151
}
151
- if ((textBlock != null ) ? !textBlock .equals (memory .getBlock (referencedAddress ))
152
- : false ) {
153
- break ; // Not pointing to text section.
152
+
153
+ // check in .text and .nep if either exists
154
+ if ( textBlock != null || nepBlock != null ) {
155
+ MemoryBlock refedBlock = memory .getBlock (referencedAddress );
156
+ boolean inTextBlock = ((textBlock != null ) && textBlock .equals (refedBlock ));
157
+ boolean inNepBlock = ((nepBlock != null ) && nepBlock .equals (refedBlock ));
158
+ // if not in either labeled .text/.nep block, then bad vftable pointer
159
+ if (!(inTextBlock || inNepBlock )) {
160
+ break ; // Not pointing to good section.
161
+ }
154
162
}
155
163
156
164
// any references after the first one ends the table
157
165
if (tableSize > 0 && program .getReferenceManager ().hasReferencesTo (currentVfPointerAddress )) {
158
166
break ;
159
167
}
160
168
161
- if (!pseudoDisassembler .isValidSubroutine (referencedAddress , true )) {
169
+ if (!pseudoDisassembler .isValidSubroutine (referencedAddress , true , false )) {
162
170
break ; // Not pointing to possible function.
163
171
}
164
172
0 commit comments