Skip to content

Commit 6507dc9

Browse files
emteereghidra1
authored andcommitted
GP-649_emteere Relaxed valid code check and added .nep as a valid
section for vftable entries
1 parent 2dc8e04 commit 6507dc9

File tree

2 files changed

+15
-6
lines changed

2 files changed

+15
-6
lines changed

Ghidra/Features/MicrosoftCodeAnalyzer/src/main/java/ghidra/app/cmd/data/rtti/RttiUtil.java

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,7 @@ public static int getVfTableCount(Program program, Address vfTableBaseAddress) {
128128

129129
Memory memory = program.getMemory();
130130
MemoryBlock textBlock = memory.getBlock(".text");
131+
MemoryBlock nepBlock = memory.getBlock(".nep");
131132
AddressSetView initializedAddresses = memory.getLoadedAndInitializedAddressSet();
132133
PseudoDisassembler pseudoDisassembler = new PseudoDisassembler(program);
133134

@@ -148,17 +149,24 @@ public static int getVfTableCount(Program program, Address vfTableBaseAddress) {
148149
if (!initializedAddresses.contains(referencedAddress)) {
149150
break; // Not pointing to initialized memory.
150151
}
151-
if ((textBlock != null) ? !textBlock.equals(memory.getBlock(referencedAddress))
152-
: false) {
153-
break; // Not pointing to text section.
152+
153+
// check in .text and .nep if either exists
154+
if ( textBlock != null || nepBlock != null) {
155+
MemoryBlock refedBlock = memory.getBlock(referencedAddress);
156+
boolean inTextBlock = ((textBlock != null) && textBlock.equals(refedBlock));
157+
boolean inNepBlock = ((nepBlock != null) && nepBlock.equals(refedBlock));
158+
// if not in either labeled .text/.nep block, then bad vftable pointer
159+
if (!(inTextBlock || inNepBlock)) {
160+
break; // Not pointing to good section.
161+
}
154162
}
155163

156164
// any references after the first one ends the table
157165
if (tableSize > 0 && program.getReferenceManager().hasReferencesTo(currentVfPointerAddress)) {
158166
break;
159167
}
160168

161-
if (!pseudoDisassembler.isValidSubroutine(referencedAddress, true)) {
169+
if (!pseudoDisassembler.isValidSubroutine(referencedAddress, true, false)) {
162170
break; // Not pointing to possible function.
163171
}
164172

Ghidra/Features/MicrosoftCodeAnalyzer/src/main/java/ghidra/app/cmd/data/rtti/VfTableModel.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,13 +37,14 @@
3737
public class VfTableModel extends AbstractCreateDataTypeModel {
3838

3939
public static final String DATA_TYPE_NAME = "vftable";
40+
private static final int NO_LAST_COUNT = -1;
4041

4142
private DataType dataType;
4243
private Rtti4Model rtti4Model;
4344

4445
private Program lastProgram;
4546
private DataType lastDataType;
46-
private int lastElementCount = -1;
47+
private int lastElementCount = NO_LAST_COUNT;
4748
private int elementCount = 0;
4849

4950
/**
@@ -126,7 +127,7 @@ public void validateModelSpecificInfo() throws InvalidDataTypeException {
126127
*/
127128
private DataType getDataType(Program program) {
128129

129-
if (program != lastProgram) {
130+
if (program != lastProgram || lastElementCount == NO_LAST_COUNT) {
130131
setIsDataTypeAlreadyBasedOnCount(true);
131132

132133
lastProgram = program;

0 commit comments

Comments
 (0)