From 83313a7b5ae77e80225f71c5bc174f0883b07a8f Mon Sep 17 00:00:00 2001 From: Ryan Kurtz Date: Tue, 17 Oct 2023 14:18:57 -0400 Subject: [PATCH] GP-3926: Tweaking how the MachoLoader handles binaries with obfuscated segment and section names (#3876) --- .../java/ghidra/app/util/bin/format/macho/MachHeader.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/MachHeader.java b/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/MachHeader.java index 01b97f98ae..d4b07d5091 100644 --- a/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/MachHeader.java +++ b/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/MachHeader.java @@ -403,7 +403,9 @@ public class MachHeader implements StructConverter { List
sections = segment.getSections(); for (int j = 0; j < sections.size(); j++) { Section section = sections.get(j); - section.setSegmentName(segment.getSegmentName()); + if (invalid.apply(section.getSegmentName())) { + section.setSegmentName("__INVALID.%d".formatted(i)); + } if (invalid.apply(section.getSectionName())) { section.setSectionName("__invalid.%d".formatted(j)); }