mirror/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-09-28 17:11:11 -09:00
Code Issues Packages Projects Releases Wiki Activity

GP-5487 improved RecoverClassesFromRTTI gcc rtti detection

Browse Source 
(Closes #7904)
This commit is contained in:
ghidra007
2025-03-18 15:44:54 +00:00
committed by Ryan Kurtz
parent 6c00c68e2b
commit 39a6a73c6d
1 changed files with 20 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
Ghidra/Features/Decompiler/ghidra_scripts/RecoverClassesFromRTTIScript.java
View File

@@ -82,7 +82,7 @@ import ghidra.program.model.mem.MemoryBlock;
import ghidra.program.model.reloc.Relocation; import ghidra.program.model.reloc.Relocation;
import ghidra.program.model.reloc.Relocation.Status; import ghidra.program.model.reloc.Relocation.Status;
import ghidra.program.model.reloc.RelocationTable; import ghidra.program.model.reloc.RelocationTable;
import ghidra.program.model.symbol.Symbol; import ghidra.program.model.symbol.*;
import ghidra.program.util.GhidraProgramUtilities; import ghidra.program.util.GhidraProgramUtilities;
import ghidra.service.graph.*; import ghidra.service.graph.*;
import ghidra.util.exception.CancelledException; import ghidra.util.exception.CancelledException;
@@ -414,8 +414,8 @@ public class RecoverClassesFromRTTIScript extends GhidraScript {
runScript("FixElfExternalOffsetDataRelocationScript.java"); runScript("FixElfExternalOffsetDataRelocationScript.java");
// first check that there is even rtti by searching the special string in memory // first check that there is even rtti by searching the special string in memory
if (!isStringInProgramMemory("class_type_info")) { if (!isStringInProgramMemory("class_type_info") && !containsClassTypeinfoSymbol()) {
return ("This program does not contain RTTI."); return ("This program does not appear to contain RTTI.");
} }
// then check to see if the special typeinfo namespace is in external space // then check to see if the special typeinfo namespace is in external space
@@ -1612,9 +1612,25 @@ public class RecoverClassesFromRTTIScript extends GhidraScript {
return false; return false;
} }
// assume that if there are any symbols containing "class_type_info" there is rtti in program
private boolean containsClassTypeinfoSymbol() {
SymbolTable symbolTable = currentProgram.getSymbolTable();
SymbolIterator symbolIterator =
symbolTable.getSymbolIterator("*class_type_info*", true);
return symbolIterator.hasNext();
}
private boolean isExternalNamespace(String path) throws CancelledException { private boolean isExternalNamespace(String path) throws CancelledException {
List<Symbol> symbols = NamespaceUtils.getSymbols(path, currentProgram, true); // try exact namespace path if there is one
List<Symbol> symbols = NamespaceUtils.getSymbols(path, currentProgram, false);
// if not, try to find path in another namespace
if (symbols.isEmpty()) {
symbols = NamespaceUtils.getSymbols(path, currentProgram, true);
}
for (Symbol symbol : symbols) { for (Symbol symbol : symbols) {
monitor.checkCancelled(); monitor.checkCancelled();