mirror/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-09-28 17:11:11 -09:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'GP-0_ryanmkurtz_PR-9379_malx-labs_delay-import-int-iat-warning'

Browse Source
This commit is contained in:
Ryan Kurtz
2026-07-16 13:36:18 -04:00
parent 7f63987fe7 a6ded89c27
commit 5651b93720
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/DelayImportDescriptor.java
View File

@@ -84,6 +84,18 @@ public class DelayImportDescriptor implements StructConverter {
if (thunksINT == null) {
return;
}
// Warn if the INT and IAT declare different numbers of entries. These are parallel arrays
// so a length mismatch is malformed. The thunk lists include the trailing null terminator,
// so the import count is size() - 1. This only surfaces the discrepancy; it does not change
// import enumeration.
if (pIAT != 0 && pINT != 0 && thunksIAT.size() != thunksINT.size()) {
int intCount = Math.max(0, thunksINT.size() - 1);
int iatCount = Math.max(0, thunksIAT.size() - 1);
Msg.warn(this, "Delay-load INT/IAT import count mismatch for '%s': INT=%d IAT=%d"
.formatted(dllName != null ? dllName : "unknown DLL", intCount, iatCount));
}
thunksBoundIAT = readThunks(ntHeader, reader, pBoundIAT, false);
if (thunksBoundIAT == null) {
return;