mirror/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-09-28 17:11:11 -09:00
Code Issues Packages Projects Releases Wiki Activity

Issue #9375 Warn on delay-load INT/IAT import count mismatch

Browse Source
This commit is contained in:
malx-labs
2026-07-16 14:02:54 +01:00
parent 7462bcec30
commit 60c227d494
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/DelayImportDescriptor.java
View File

@@ -84,6 +84,20 @@ public class DelayImportDescriptor implements StructConverter {
if (thunksINT == null) {
return;
}
// Warn if the INT and IAT declare different numbers of entries.
// These are parallel arrays so a length mismatch is malformed.
// The thunk lists include the trailing null terminator, so the
// import count is size() - 1. This only surfaces the discrepancy;
// it does not change import enumeration.
if (pIAT != 0 && pINT != 0 && thunksIAT.size() != thunksINT.size()) {
int intCount = Math.max(0, thunksINT.size() - 1);
int iatCount = Math.max(0, thunksIAT.size() - 1);
Msg.warn(this, "Delay-load INT/IAT import count mismatch for " +
(dllName != null ? dllName : "unknown DLL") +
": INT=" + intCount + " IAT=" + iatCount);
}
thunksBoundIAT = readThunks(ntHeader, reader, pBoundIAT, false);
if (thunksBoundIAT == null) {
return;