mirror/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-09-28 17:11:11 -09:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/caheckman_FidAdjustments'

Browse Source
This commit is contained in:
ghidravore
2020-09-24 17:33:36 -04:00
parent d8c7074d6f 3d150a796e
commit b7c8056c8a
8 changed files with 544 additions and 203 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
Ghidra/Features/FunctionID/data/common_symbols_win32.txt
View File

@@ -1,4 +1,10 @@
??$AtlMultiply@I@ATL@@YAJPAIII@Z
??$_Allocate@$07U_Default_allocate_traits@std@@$0A@@std@@YAPAXI@Z
??$_Construct_in_place@PADABQAD@std@@YAXAAPADABQAD@Z
??$_Deallocate@$07$0A@@std@@YAXPAXI@Z
??$_Min_value@I@std@@YAABIABI0@Z
??$_Unfancy@D@std@@YAPADPAD@Z
??$addressof@PAD@std@@YAPAPADAAPAD@Z
??0?$CHeapPtr@_WVCCRTAllocator@ATL@@@ATL@@QAE@XZ
??0?$CSimpleStringT@D$0A@@ATL@@QAE@PAUIAtlStringMgr@1@@Z
??0?$CSimpleStringT@_W$0A@@ATL@@QAE@PAUIAtlStringMgr@1@@Z
@@ -7,6 +13,7 @@
??0?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@@V?$allocator@D@@@@QAE@PBDABV?$allocator@D@@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@QBD@Z
??0AFX_MAINTAIN_STATE2@@QAE@PAVAFX_MODULE_STATE@@@Z
??0COleVariant@@QAE@PBDG@Z
??0CPreserveLastError@ATL@@QAE@XZ
@@ -19,32 +26,45 @@
??0DName@@QAE@ABV0@@Z
??0DName@@QAE@W4DNameStatus@@@Z
??0_LocaleUpdate@@QAE@PAUlocaleinfo_struct@@@Z
??0_LocaleUpdate@@QAE@QAU__crt_locale_pointers@@@Z
??0_Locinfo@@QAE@PBD@Z
??0_Locinfo@std@@QAE@PBD@Z
??0_Lockit@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
??0bad_cast@@QAE@PBD@Z
??0bad_cast@std@@QAE@XZ
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABV0@@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@QBD@Z
??0facet@locale@@IAE@I@Z
??0invalid_argument@std@@QAE@PBD@Z
??0ios@@IAE@XZ
??0locale@std@@QAE@ABV01@@Z
??1?$CHeapPtr@_WVCCRTAllocator@ATL@@@ATL@@QAE@XZ
??1?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@QAE@XZ
??1?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1AFX_MAINTAIN_STATE2@@QAE@XZ
??1CGdiObject@@UAE@XZ
??1COleVariant@@QAE@XZ
??1CPreserveLastError@ATL@@QAE@XZ
??1CString@@QAE@XZ
??1_Locinfo@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??1exception@std@@UAE@XZ
??1ios@@UAE@XZ
??1locale@std@@QAE@XZ
??2@YAPAXI@Z
??2@YAPAXIPAX@Z
??2@YAPAXIPBDH@Z
??2CObject@@SGPAXIPBDH@Z
??2_Crt_new_delete@std@@SAPAXI@Z
??3@YAXPAX@Z
??3@YAXPAXI@Z
??3CObject@@SGXPAX@Z
??3_Crt_new_delete@std@@SAXPAX@Z
??4CString@@QAEABV0@ABV0@@Z
??4CString@@QAEABV0@PBD@Z
??4DName@@QAEAAV0@ABV0@@Z
@@ -59,10 +79,15 @@
??BCString@@QBEPBDXZ
??BCTraceCategory@ATL@@QBEKXZ
??Bid@locale@@QAEIXZ
??Bid@locale@std@@QAEIXZ
??RCTraceFileAndLineInfo@ATL@@QBAXHIPBDZZ
??RCTraceFileAndLineInfo@ATL@@QBAXKIPBDZZ
??RCTraceFileAndLineInfo@ATL@@QBAXKIPB_WZZ
??_M@YGXPAXIIP6EX0@Z@Z
??_U@YAPAXI@Z
??_U@YAPAXIABUnothrow_t@std@@@Z
??_V@YAXPAX@Z
??_V@YAXPAXI@Z
?AfxAssertFailedLine@@YAHPBDH@Z
?AfxAssertFailedLine@@YGHPBDH@Z
?AfxAssertValidObject@@YAXPBVCObject@@PBDH@Z
@@ -95,6 +120,7 @@
?Attach@?$CSimpleStringT@D$0A@@ATL@@AAEXPAUCStringData@2@@Z
?Attach@?$CSimpleStringT@_W$0A@@ATL@@AAEXPAUCStringData@2@@Z
?Attach@CGdiObject@@QAEHPAX@Z
?CheckFailed@__sanitizer@@YAXPBDH0_K1@Z
?CloneData@?$CSimpleStringT@D$0A@@ATL@@CAPAUCStringData@2@PAU32@@Z
?CloneData@?$CSimpleStringT@_W$0A@@ATL@@CAPAUCStringData@2@PAU32@@Z
?CopyChars@?$CSimpleStringT@D$0A@@ATL@@SAXPADIPBDH@Z
@@ -161,6 +187,8 @@
?_AtlGetConversionACP@ATL@@YGIXZ
?_AtlGetStringResourceImage@ATL@@YAPBUATLSTRINGRESOURCEIMAGE@1@PAUHINSTANCE__@@PAUHRSRC__@@I@Z
?_AtlGetThreadACPThunk@ATL@@YGIXZ
?_Calculate_growth@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEII@Z
?_ConcRT_CoreAssert@details@Concurrency@@YAXPBD0H@Z
?_Copy@?$basic_string@DU?$char_traits@D@@V?$allocator@D@@@@AAEPADI@Z
?_Copy@?$basic_string@GU?$char_traits@G@@V?$allocator@G@@@@AAEPAGI@Z
?_Copy_s@?$char_traits@D@std@@SAPADPADIPBDI@Z
@@ -168,44 +196,65 @@
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEXI@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@V_STL70@@@std@@IAEXI@Z
?_Facet_Register@std@@YAXPAV_Facet_base@1@@Z
?_Freeze@?$basic_string@DU?$char_traits@D@@V?$allocator@D@@@@AAEXXZ
?_Get_data@?$_String_alloc@U?$_String_base_types@DV?$allocator@D@std@@@std@@@std@@QAEAAV?$_String_val@U?$_Simple_types@D@std@@@2@XZ
?_Get_data@?$_String_alloc@U?$_String_base_types@DV?$allocator@D@std@@@std@@@std@@QBEABV?$_String_val@U?$_Simple_types@D@std@@@2@XZ
?_Getal@?$_String_alloc@U?$_String_base_types@DV?$allocator@D@std@@@std@@@std@@QAEAAV?$allocator@D@2@XZ
?_Getal@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAV?$allocator@D@2@XZ
?_Getfacet@locale@@QBEPBVfacet@1@IH@Z
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?_Grow@?$basic_string@DU?$char_traits@D@@V?$allocator@D@@@@AAEHIH@Z
?_Grow@?$basic_string@GU?$char_traits@G@@V?$allocator@G@@@@AAEHIH@Z
?_Incref@facet@locale@@QAEXXZ
?_Incref@facet@locale@std@@QAEXXZ
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
?_Iscloc@locale@@QBEHXZ
?_Myptr@?$_String_val@U?$_Simple_types@D@std@@@std@@QAEPADXZ
?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
?_Peek@?$istreambuf_iterator@DU?$char_traits@D@@@@AAEDXZ
?_Peek@?$istreambuf_iterator@GU?$char_traits@G@@@@AAEGXZ
?_Refcnt@?$basic_string@DU?$char_traits@D@@V?$allocator@D@@@@AAEAAEPBD@Z
?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ
?_Throw_bad_cast@std@@YAXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@@V?$allocator@D@@@@AAEXH@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEX_NI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@V_STL70@@@std@@IAEX_NI@Z
?_Tidy@?$basic_string@GU?$char_traits@G@@V?$allocator@G@@@@AAEXH@Z
?_Tidy_deallocate@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Tidy_deallocate@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?_Widen@@YADDPAD@Z
?_Widen@@YAGDPAG@Z
?_Xlen@@YAXXZ
?_Xran@@YAXXZ
?__global_delete@@YAXPAXI@Z
?append@?$basic_string@DU?$char_traits@D@@V?$allocator@D@@@@QAEAAV1@ID@Z
?assign@?$_Narrow_char_traits@DH@std@@SAXAADABD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@QBDI@Z
?assign@?$char_traits@D@std@@SAXAADABD@Z
?atlBadThunkCall@ATL@@YAXXZ
?atlBadThunkCall@ATL@@YGXXZ
?c_str@?$basic_string@DU?$char_traits@D@@V?$allocator@D@@@@QBEPBDXZ
?c_str@locale@std@@QBEPBDXZ
?clear@ios_base@std@@QAEXH_N@Z
?copy@?$char_traits@D@@SAPADPADPBDI@Z
?copy@?$char_traits@D@std@@SAPADQADQBDI@Z
?data@CStringData@ATL@@QAEPAXXZ
?flags@ios_base@@QBEHXZ
?g_pfnGetThreadACP@ATL@@3P6GIXZA
?getloc@ios_base@@QBE?AVlocale@@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?isEmpty@DName@@QBEHXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?memcpy_s@Checked@ATL@@YAXPAXIPBXI@Z
?size@?$basic_string@DU?$char_traits@D@@V?$allocator@D@@@@QBEIXZ
@_RTC_CheckStackVars@8
@__security_check_cookie@4
@_guard_check_icall@4
_DeleteCriticalSection
_FastWppTraceMessage
_GetTheFunctionPtr@8
_HRESULT_FROM_WIN32
_InitializeCriticalSection
@@ -215,6 +264,7 @@ _ResolveThunk@20
_SendMessageW
_SetLastError@4
_UnregisterClassW
_WmlTrace
__CrtDbgReport
__CrtDbgReportW
__CxxThrowException@8
@@ -235,6 +285,7 @@ __SEH_prolog4
___doserrno
___guard_check_icall_fptr
___local_stdio_printf_options
___std_exception_copy
___std_exception_destroy
__alloca_probe
__dosmaperr
@@ -273,6 +324,7 @@ __imp__WideCharToMultiByte@32
__imp__lstrlenA@4
__invalid_parameter
__invalid_parameter_noinfo
__invalid_parameter_noinfo_noreturn
__invoke_watson
__isctype
__lock
@@ -289,6 +341,7 @@ _memmove
_memmove_s
_memset
_sprintf
_sprintf_s
_strcpy
_strlen
_swprintf_s

64
Ghidra/Features/FunctionID/data/common_symbols_win64.txt
View File

@@ -1,10 +1,15 @@
??$?0D@?$allocator@U_Container_proxy@std@@@std@@QEAA@AEBV?$allocator@D@1@@Z
??$AtlMultiply@_K@ATL@@YAJPEA_K_K1@Z
??$_Allocate_manually_vector_aligned@U_Default_allocate_traits@std@@@std@@YAPEAX_K@Z
??$_Deallocate@$0BA@$0A@@std@@YAXPEAX_K@Z
??$construct@PEADAEBQEAD@?$_Default_allocator_traits@V?$allocator@D@std@@@std@@SAXAEAV?$allocator@D@1@QEAPEADAEBQEAD@Z
??0?$CHeapPtr@_WVCCRTAllocator@ATL@@@ATL@@QEAA@XZ
??0?$CSimpleStringT@_W$0A@@ATL@@QEAA@PEAUIAtlStringMgr@1@@Z
??0?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@QEAA@XZ
??0?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QEAA@PEB_W@Z
??0?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QEAA@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@PEBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@QEBD@Z
??0AFX_MAINTAIN_STATE2@@QEAA@PEAVAFX_MODULE_STATE@@@Z
??0CObject@@IEAA@XZ
??0CPoint@@QEAA@HH@Z
@@ -17,8 +22,11 @@
??0_LocaleUpdate@@QEAA@QEAU__crt_locale_pointers@@@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@AEAV123@@Z
??0bad_cast@std@@QEAA@XZ
??0exception@std@@QEAA@AEBQEBD@Z
??0exception@std@@QEAA@AEBV01@@Z
??0invalid_argument@std@@QEAA@PEBD@Z
??1?$CHeapPtr@_WVCCRTAllocator@ATL@@@ATL@@QEAA@XZ
??1?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@QEAA@XZ
??1?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QEAA@XZ
@@ -32,15 +40,18 @@
??1_LocaleUpdate@@QEAA@XZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@XZ
??1exception@std@@UEAA@XZ
??1locale@std@@QEAA@XZ
??2@YAPEAX_K@Z
??2@YAPEAX_KAEAVHeapManager@@H@Z
??2@YAPEAX_KPEAX@Z
??2CObject@@SAPEAX_KPEBDH@Z
??2_Crt_new_delete@std@@SAPEAX_K@Z
??3@YAXPEAX@Z
??3@YAXPEAX_K@Z
??3CObject@@SAXPEAX@Z
??3_Crt_new_delete@std@@SAXPEAX@Z
??4?$CSimpleStringT@D$0A@@ATL@@QEAAAEAV01@AEBV01@@Z
??4?$CSimpleStringT@_W$0A@@ATL@@QEAAAEAV01@AEBV01@@Z
??6CDumpContext@@QEAAAEAV0@PEBD@Z
@@ -53,8 +64,11 @@
??RCTraceFileAndLineInfo@ATL@@QEBAX_KIPEBDZZ
??RCTraceFileAndLineInfo@ATL@@QEBAX_KIPEB_WZZ
??YDName@@QEAAAEAV0@AEBV0@@Z
??_M@YAXPEAX_K1P6AX0@Z@Z
??_U@YAPEAX_K@Z
??_U@YAPEAX_KAEBUnothrow_t@std@@@Z
??_V@YAXPEAX@Z
??_V@YAXPEAX_K@Z
?AfxAssertFailedLine@@YAHPEBDH@Z
?AfxAssertValidObject@@YAXPEBVCObject@@PEBDH@Z
?AfxCrtErrorCheck@@YAHH@Z
@@ -85,6 +99,7 @@
?Delete@CException@@QEAAXXZ
?Empty@?$CSimpleStringT@D$0A@@ATL@@QEAAXXZ
?Empty@?$CSimpleStringT@_W$0A@@ATL@@QEAAXXZ
?FastCurrentContext@SchedulerBase@details@Concurrency@@SAPEAVContextBase@23@XZ
?FillBuffer@CArchive@@QEAAXI@Z
?Flush@CArchive@@QEAAXXZ
?Fork@?$CSimpleStringT@D$0A@@ATL@@AEAAXH@Z
@@ -105,6 +120,7 @@
?GetInstance@CMFCVisualManager@@SAPEAV1@XZ
?GetLength@?$CSimpleStringT@D$0A@@ATL@@QEBAHXZ
?GetLength@?$CSimpleStringT@_W$0A@@ATL@@QEBAHXZ
?GetLocaleT@_LocaleUpdate@@QEAAPEAU__crt_locale_pointers@@XZ
?GetNext@CObList@@QEAAAEAPEAVCObject@@AEAPEAU__POSITION@@@Z
?GetParent@CWnd@@QEBAPEAV1@XZ
?GetParentFrame@CWnd@@QEBAPEAVCFrameWnd@@XZ
@@ -149,39 +165,75 @@
?_Allocate@std@@YAPEAX_K0_N@Z
?_AtlGetConversionACP@ATL@@YAIXZ
?_AtlGetStringResourceImage@ATL@@YAPEBUATLSTRINGRESOURCEIMAGE@1@PEAUHINSTANCE__@@PEAUHRSRC__@@I@Z
?_ConcRT_CoreAssert@details@Concurrency@@YAXPEBD0H@Z
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IEAAX_K0@Z
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@V_STL70@@@std@@IEAAX_K0@Z
?_Deallocate@std@@YAXPEAX_K1@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAX_K@Z
?_Facet_Register@std@@YAXPEAV_Facet_base@1@@Z
?_Get_data@?$_String_alloc@U?$_String_base_types@DV?$allocator@D@std@@@std@@@std@@QEAAAEAV?$_String_val@U?$_Simple_types@D@std@@@2@XZ
?_Get_data@?$_String_alloc@U?$_String_base_types@DV?$allocator@D@std@@@std@@@std@@QEBAAEBV?$_String_val@U?$_Simple_types@D@std@@@2@XZ
?_Getal@?$_String_alloc@U?$_String_base_types@DV?$allocator@D@std@@@std@@@std@@QEAAAEAV?$allocator@D@2@XZ
?_Getal@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAAAEAV?$allocator@D@2@XZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z
?_Mbrtowc@@YAHPEA_WPEBD_KPEAHPEBU_Cvtvec@@@Z
?_Myptr@?$_String_val@U?$_Simple_types@D@std@@@std@@QEAAPEADXZ
?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IEAAPEADXZ
?_Orphan_all@_Container_base12@std@@QEAAXXZ
?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QEAA_NXZ
?_Throw_bad_array_new_length@std@@YAXXZ
?_Throw_bad_cast@std@@YAXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAX_N_K@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlen@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBAXXZ
?_Xlen@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@SAXXZ
?_Xlen@_String_base@std@@SAXXZ
?_Xlen_string@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?__global_delete@@YAXPEAX_K@Z
?allocate@?$allocator@D@std@@QEAAPEAD_K@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV12@QEBD_K@Z
?assign@?$_Narrow_char_traits@DH@std@@SAXAEADAEBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV12@AEBV12@_K1@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@V_STL70@@@std@@QEAAAEAV12@AEBV12@_K1@Z
?assign@?$char_traits@D@std@@SAXAEADAEBD@Z
?clear@ios_base@std@@QEAAXH_N@Z
?copy@?$_Narrow_char_traits@DH@std@@SAPEADQEADQEBD_K@Z
?copy@?$char_traits@D@std@@SAPEADQEADQEBD_K@Z
?data@CStringData@ATL@@QEAAPEAXXZ
?deallocate@?$allocator@D@std@@QEAAXQEAD_K@Z
?g_pfnGetThreadACP@ATL@@3P6AIXZEA
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KXZ
AtlTraceVA
FastWppTraceMessage
GdiplusShutdown
GetTheFunctionPtr
HRESULT_FROM_WIN32
WmlTrace
_CrtDbgReport
_CrtDbgReportW
_CxxThrowException
_Getctype
_Getcvt
_Init_thread_footer
_Init_thread_header
_Mbrtowc
_RTC_CheckStackVars
_Wcrtomb
__acrt_getptd
__acrt_update_locale_info
__acrt_update_multibyte_info
__guard_check_icall_fptr
__guard_dispatch_icall_fptr
__imp_ActivateActCtx
__imp_CloseHandle
__imp_CoTaskMemFree
__imp_DeleteDC
__imp_EnterCriticalSection
__imp_ExFreePoolWithTag
__imp_FindResourceA
__imp_FindResourceW
__imp_GetClientRect
@@ -207,6 +259,7 @@ __imp_SetLastError
__imp_SetRectEmpty
__imp_SizeofResource
__imp_WideCharToMultiByte
__imp_free
__local_stdio_printf_options
__security_check_cookie
__std_exception_copy
@@ -216,6 +269,7 @@ __stdio_common_vsprintf_s
__stdio_common_vswprintf_s
__updatetlocinfo
__updatetmbcinfo
__xmlRaiseError
_errno
_free_base
_free_dbg
@@ -223,13 +277,16 @@ _getptd
_guard_check_icall
_invalid_parameter
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_invoke_watson
_lock
_malloc_dbg
_unlock
_unlock_file
_vswprintf_s_l
atexit
free
log
malloc
memcmp
memcpy
@@ -237,11 +294,18 @@ memcpy_s
memmove
memmove_s
memset
sprintf_s
sqrt
strcpy_s
strlen
strnlen
swprintf_s
terminate
wcscpy_s
wcslen
wcsnlen
wmemcpy_s
xmlFree
xmlMalloc
xmlStrEqual
xmlStrdup

90
Ghidra/Features/FunctionID/ghidra_scripts/FidStatistics.java
View File

@@ -27,6 +27,7 @@ import ghidra.program.database.ProgramContentHandler;
import ghidra.program.model.lang.Language;
import ghidra.program.model.listing.*;
import ghidra.program.model.mem.MemoryAccessException;
import ghidra.program.model.symbol.Symbol;
import ghidra.util.exception.CancelledException;
import ghidra.util.exception.VersionException;
@@ -64,7 +65,9 @@ public class FidStatistics extends GhidraScript {
@Override
public int compareTo(SymbolPair o) {
int val = sym1.compareTo(o.sym1);
if (val != 0) return val;
if (val != 0) {
return val;
}
return sym2.compareTo(o.sym2);
}
@@ -118,6 +121,7 @@ public class FidStatistics extends GhidraScript {
public int totalFunction;
public int matchUniquely;
public int matchMultiply;
public int hitCount;
public int noMatch;
public int nameMatched;
public int falsePositive;
@@ -126,14 +130,16 @@ public class FidStatistics extends GhidraScript {
totalFunction = 0;
matchUniquely = 0;
matchMultiply = 0;
hitCount = 0;
noMatch = 0;
nameMatched = 0;
falsePositive = 0;
}
public static void indent(StringBuilder buf,String last) {
for(int i=last.length();i<10;++i)
for(int i=last.length();i<10;++i) {
buf.append(' ');
}
}
public void print(StringBuilder buf) {
@@ -143,9 +149,12 @@ public class FidStatistics extends GhidraScript {
str = Integer.toString(noMatch);
buf.append(str);
indent(buf,str);
str = Integer.toString(matchUniquely+matchMultiply);
str = Integer.toString(matchUniquely + matchMultiply);
buf.append(str);
indent(buf,str);
indent(buf, str);
str = Integer.toString(hitCount);
buf.append(str);
indent(buf, str);
str = '(' + Integer.toString(matchUniquely) + ',' + Integer.toString(matchMultiply) + ')';
buf.append(str);
indent(buf,str);
@@ -157,7 +166,7 @@ public class FidStatistics extends GhidraScript {
}
public static String getColumns() {
return "Total No Match Hits uniq/mult N-Match False";
return "Total No Match Possible Hits uniq/mult N-Match False";
}
}
@@ -331,6 +340,8 @@ public class FidStatistics extends GhidraScript {
addEquivSymbols("WPP_SF_qqDD","WPP_SF_qqdd");
addEquivSymbols("WPP_SF_DqD","WPP_SF_dqd");
addEquivSymbols("WPP_SF_Dq","WPP_SF_dq");
addEquivSymbols("std::vector<>::_Assign_rv", "std::vector<>::_Move_assign_from");
addEquivSymbols("std::vector<>::_Assign_rv", "std::vector<>::_Move_from");
}
private void findDomainFiles(LinkedList<DomainFile> programs, DomainFolder folder)
@@ -350,11 +361,25 @@ public class FidStatistics extends GhidraScript {
}
private boolean checkNames(String a,String b) {
if (a.equals(b))
if (a.equals(b)) {
return true;
}
return equivSymbols.contains(new SymbolPair(a,b));
}
private String chooseFunctionName(FidSearchResult result) {
Program program = result.function.getProgram();
Symbol[] symbols = program.getSymbolTable().getSymbols(result.function.getEntryPoint());
if (symbols.length > 1) {
for (Symbol symbol : symbols) {
if (matchAnalysis.containsRawName(symbol.getName())) {
return symbol.getName();
}
}
}
return result.function.getName();
}
private void processFunctionResult(FidSearchResult result)
throws CancelledException, IOException {
StatRecord record = statRecord;
@@ -378,7 +403,8 @@ public class FidStatistics extends GhidraScript {
matchHappened = true; // FID will put down a single match
finalMatchName = matchAnalysis.getNameIterator().next();
}
NameVersions nameVersions = NameVersions.generate(result.function.getName(), program);
String funcName = chooseFunctionName(result);
NameVersions nameVersions = NameVersions.generate(funcName, program);
String strippedTemplateName = null;
if (nameVersions.demangledBaseName != null) {
strippedTemplateName =
@@ -389,7 +415,9 @@ public class FidStatistics extends GhidraScript {
while(iter.hasNext()) {
String raw = iter.next();
NameVersions matchNames = NameVersions.generate(raw, program);
if (matchNames.rawName == null) continue;
if (matchNames.rawName == null) {
continue;
}
if (checkNames(nameVersions.rawName,matchNames.rawName)) {
exactNameMatch = true;
break;
@@ -398,8 +426,26 @@ public class FidStatistics extends GhidraScript {
exactNameMatch = true;
break;
}
if (nameVersions.demangledBaseName == null) continue;
if (matchNames.demangledBaseName == null) continue;
if (nameVersions.demangledBaseName != null) {
if (checkNames(nameVersions.demangledBaseName, matchNames.rawName) ||
checkNames(nameVersions.demangledBaseName, matchNames.similarName)) {
exactNameMatch = true;
break;
}
}
if (matchNames.demangledBaseName != null) {
if (checkNames(nameVersions.rawName, matchNames.demangledBaseName) ||
checkNames(nameVersions.similarName, matchNames.demangledBaseName)) {
exactNameMatch = true;
break;
}
}
if (nameVersions.demangledBaseName == null) {
continue;
}
if (matchNames.demangledBaseName == null) {
continue;
}
if (checkNames(nameVersions.demangledBaseName,matchNames.demangledBaseName)) {
exactNameMatch = true;
break;
@@ -408,17 +454,21 @@ public class FidStatistics extends GhidraScript {
String strippedName =
MatchNameAnalysis.removeTemplateParams(matchNames.demangledBaseName);
if (strippedName != null) {
if (strippedName.equals(strippedTemplateName)) {
if (checkNames(strippedName, strippedTemplateName)) {
exactNameMatch = true;
break;
}
}
}
}
if (exactNameMatch)
if (exactNameMatch) {
record.nameMatched += 1;
}
float score = result.matches.get(0).getOverallScore();
if (score >= scoreThreshold && matchHappened) {
record.hitCount += 1;
}
if (exactNameMatch && ((score < scoreThreshold) || !matchHappened)) {
MatchRecord matchRecord = new MatchRecord(result,null,false);
StringBuilder buffer = new StringBuilder();
@@ -440,13 +490,19 @@ public class FidStatistics extends GhidraScript {
private void processProgram(Program program,FidQueryService queryService) throws MemoryAccessException, CancelledException, VersionException, IOException {
FidProgramSeeker programSeeker = service.getProgramSeeker(program,queryService, 10.0f);
monitor.setMessage("Processing " + program.getName());
monitor.initialize(program.getFunctionManager().getFunctionCount());
FunctionIterator iter = program.getFunctionManager().getFunctionsNoStubs(true);
while(iter.hasNext()) {
Function func = iter.next();
if (func.getName().startsWith("FUN_") || func.getName().startsWith("Ordinal_"))
monitor.incrementProgress(1);
if (func.getName().startsWith("FUN_") || func.getName().startsWith("Ordinal_")) {
continue;
}
FidSearchResult searchResult = programSeeker.searchFunction(func, monitor);
if (searchResult == null) continue; // Could not hash function
if (searchResult == null) {
continue; // Could not hash function
}
processFunctionResult(searchResult);
}
}
@@ -496,8 +552,9 @@ public class FidStatistics extends GhidraScript {
try {
program = (Program) domainFile.getDomainObject(this, false, false, monitor);
if (queryService == null || !lastLanguage.equals(program.getLanguage())) {
if (queryService != null)
if (queryService != null) {
queryService.close();
}
lastLanguage = program.getLanguage();
queryService = service.openFidQueryService(lastLanguage, false);
}
@@ -508,8 +565,9 @@ public class FidStatistics extends GhidraScript {
monitor.setProgress(counter);
}
finally {
if (program != null)
if (program != null) {
program.release(this);
}
}
}
} catch(CancelledException ex) {

142
Ghidra/Features/FunctionID/ghidra_scripts/RemoveFunctions.java
View File

@@ -28,6 +28,7 @@ import ghidra.feature.fid.db.*;
*/
public class RemoveFunctions extends GhidraScript {
private LinkedList<Pair<Short, Long>> REMOVE_HASHES = new LinkedList<>();
private LinkedList<Pair<Short, Long>> REMOVE_SPECHASHES = new LinkedList<>();
private LinkedList<Pair<Short, Long>> FORCE_SPECIFIC = new LinkedList<>();
private LinkedList<Pair<Short, Long>> FORCE_RELATION = new LinkedList<>();
private LinkedList<Pair<Short, Long>> AUTO_PASS = new LinkedList<>();
@@ -146,6 +147,7 @@ public class RemoveFunctions extends GhidraScript {
FORCE_RELATION.add(fh(15, 0x3cd4904368bf315cL)); // ??_G?$_MallocaArrayHolder@PAVContext@Concurrency@@@details@Concurrency@@UAEPAXI@Z
FORCE_RELATION.add(fh(4, 0xb8db1dacc3441a8fL)); // ??1_Timer@details@Concurrency@@MAE@XZ
FORCE_RELATION.add(fh(14, 0x7b2255d33cddad65L)); // ??_GThreadInternalContext@details@Concurrency@@UAEPAXI@Z
FORCE_RELATION.add(fh(15, 0xfe727990231ca423L)); // Generic constructor
REMOVE_HASHES.add(fh(4, 0x8f0554c0936e0e0dL)); // ?AddPaneToList@CPaneContainerManager@@QAEXPAVCDockablePane@@@Z
REMOVE_HASHES.add(fh(17, 0x6875ba2bfa94ae88L)); // ??1?$CComPtrBase@UIAccessibleProxy@@@ATL@@QAE@XZ
@@ -161,6 +163,7 @@ public class RemoveFunctions extends GhidraScript {
REMOVE_HASHES.add(fh(8, 0x3d7242fc6eb079a7L)); // ??1<lambda_61f7764e5b8087545c74b0c2f4f68b12>@@QAE@XZ
REMOVE_HASHES.add(fh(7, 0x690dec263cb912aaL)); // ?OnDrawTasksGroupAreaBorder@CMFCVisualManagerOfficeXP@@MAEXPAVCDC@@VCRect@@HH@Z
REMOVE_HASHES.add(fh(7, 0x6b745608ae7e77fbL)); // ??1?$CArray@... destructors based on CArray
REMOVE_HASHES.add(fh(3, 0xfcc148b0692f6a69L)); // thunk
FORCE_SPECIFIC.add(fh(2, 0x5ef2f47ee7151243L)); // __SEH_epilog4_GS, __EH_epilog3_GS, and __EH_epilog3_catch_GS
FORCE_RELATION.add(fh(2, 0x5ef2f47ee7151243L));
@@ -261,6 +264,52 @@ public class RemoveFunctions extends GhidraScript {
REMOVE_HASHES.add(fh(23, 0x1c009fbde7812ed5L)); // ??0failure@ios_base@std@@QEAA@AEBV012@@Z
REMOVE_HASHES.add(fh(10, 0x7e10fbe69b976818L)); // ??1CAudioMediaType@@MEAA@XZ
REMOVE_HASHES.add(fh(15, 0x79c797eb8032b47L)); // ??_G?$CList@IAEAI@@UEAAPEAXI@Z
REMOVE_HASHES.add(fh(6, 0x1198931964e874fbL)); // ??0XRibbonInfoParserRoot@CMFCRibbonInfo@@IEAA@XZ
REMOVE_HASHES.add(fh(6, 0x1524536d78c0da92L)); // ??1?$shared_ptr@V__ExceptionPtr@@@std@@QEAA@XZ
REMOVE_HASHES.add(fh(7, 0x020d6fdf4571e246L)); // max_size
REMOVE_HASHES.add(fh(13, 0x225ba93763be05b1L)); // operator==
REMOVE_HASHES.add(fh(13, 0x287ae8c33777713cL)); // ??1CStreamOnCString@@UEAA@XZ
REMOVE_HASHES.add(fh(9, 0x288020713ca1ea5bL)); // ??0?$move_iterator@V?$_Vector_iterator@V?$_Vector_val@U?$_Simple_types@V?$shared_ptr@U?$_Task_impl@E@details@Concurrency@@@std@@@std@@@std@@@std@@@std@@QEAA@AEBV01@@Z
REMOVE_HASHES.add(fh(10, 0x2b3bd58383bd38e9L)); // ??1VirtualProcessorRoot@details@Concurrency@@UEAA@XZ
REMOVE_HASHES.add(fh(7, 0x30a80a215b0bb2c4L)); // Generic destructor
REMOVE_HASHES.add(fh(7, 0x53a0821862961cb4L)); // constructor
REMOVE_HASHES.add(fh(4, 0x556c824f94bb014fL)); // return value derefed from first parameter ptr
REMOVE_HASHES.add(fh(12, 0x6581a15f3efa819eL)); // copy two fields between pointer parameters
REMOVE_HASHES.add(fh(9, 0x65e3ed6682944d20L)); // ??1CTraceSnapshot@@QEAA@XZ
REMOVE_HASHES.add(fh(8, 0x6ce601a9094cc769L)); // destructor
REMOVE_HASHES.add(fh(7, 0x6e6e4f635fd59012L)); // destructor
REMOVE_HASHES.add(fh(8, 0xad4b1b8ef3775874L)); // pass derefed first param to subfunc
REMOVE_HASHES.add(fh(8, 0xba8d3a7590fcc497L)); // destructor
REMOVE_HASHES.add(fh(7, 0xc4312b6b7324334aL)); // destructor
REMOVE_HASHES.add(fh(11, 0xd6650c343cfb0baeL)); // constructor
REMOVE_HASHES.add(fh(13, 0xe6202628da545409L)); // ??0CXMLParserRoot@@QEAA@XZ
REMOVE_HASHES.add(fh(6, 0xebd9388fe0c5b3d5L)); // operator++
REMOVE_HASHES.add(fh(8, 0xebfa00c4b493da85L)); // constructor
REMOVE_HASHES.add(fh(11, 0xf5d1f9d9b010f936L)); // constructor
REMOVE_HASHES.add(fh(11, 0xf7f34c91b43fa7d3L)); // destructor
REMOVE_HASHES.add(fh(8, 0xfcffed6fce4974a8L)); // constructor
REMOVE_HASHES.add(fh(9, 0x1c82d67f2be6ec3cL)); // constructor
REMOVE_HASHES.add(fh(10, 0x7dd643f9a75d75c4L)); // constructor
REMOVE_HASHES.add(fh(5, 0x88b326842c8ac560L)); // constructor
REMOVE_HASHES.add(fh(6, 0xa03ab775e8816d83L)); // wrapper
REMOVE_HASHES.add(fh(15, 0xe964369cf92d003fL)); // constructor
REMOVE_HASHES.add(fh(10, 0xf36c24d70ec93888L)); // wrapper
REMOVE_HASHES.add(fh(7, 0x763a8202f3d3c655L)); // constructor
REMOVE_HASHES.add(fh(12, 0x108d55ea8a0d124cL)); // scalar_deleting_destructor
REMOVE_HASHES.add(fh(13, 0x73f55a446deac3b1L)); // scalar_deleting_destructor
REMOVE_HASHES.add(fh(14, 0x3266cd569ab4eeffL)); // comparator
REMOVE_HASHES.add(fh(34, 0x8069e1fe2475e7c0L)); // inlined copies followed by method call
REMOVE_HASHES.add(fh(8, 0xa5c0d8da585783d3L)); // constructor
REMOVE_HASHES.add(fh(14, 0xad597a6e08b319b6L)); // destructor
REMOVE_HASHES.add(fh(17, 0xa552112bff535b06L)); // destructor
REMOVE_HASHES.add(fh(13, 0xac7036a5a6a27973L)); // destructor
REMOVE_HASHES.add(fh(6, 0x561ffc1c6cdb8a09L)); // Mysize
REMOVE_HASHES.add(fh(8, 0x6838c16db21b0fcdL)); // ??1_AsyncTaskCollection@details@Concurrency@@UEAA@XZ
REMOVE_HASHES.add(fh(6, 0x69e6a6ae661a1d17L)); // Generic size()
REMOVE_HASHES.add(fh(4, 0xd4c0bfb00c09e33dL)); // Access field
REMOVE_HASHES.add(fh(4, 0xdcfb1bce9467ae7fL)); // Save registers
REMOVE_HASHES.add(fh(6, 0xef1dcb79b04b45a7L)); // 2 calls
REMOVE_HASHES.add(fh(10, 0xa234bc1264c50f3eL)); // vector destructor
FORCE_RELATION.add(fh(6, 0x508d431b82512d5bL)); // Generic wrapper, one obvious child
FORCE_RELATION.add(fh(19, 0x1e68c4d4d83e7585L)); // A little too generic stream thing, force parent
@@ -275,12 +324,84 @@ public class RemoveFunctions extends GhidraScript {
FORCE_RELATION.add(fh(25, 0x6a5c4f8adc931359L)); // scalar_deleting_destructor force parent
FORCE_RELATION.add(fh(13, 0xf1e4167aedf569aL)); // Generic form, with many children
FORCE_RELATION.add(fh(20, 0x678b611a60783c98L)); // Generic form with children
FORCE_RELATION.add(fh(15, 0x51980975b49f9f73L)); // ??1SchedulingNode@details@Concurrency@@QEAA@XZ
FORCE_RELATION.add(fh(18, 0xcf323a39c909432bL)); // ?_Future_error_map@std@@YAPEBDH@Z
FORCE_RELATION.add(fh(14, 0x41110421841870bdL)); // iterator::operator=
FORCE_RELATION.add(fh(15, 0x4750629cadd994f2L)); // Uninitialized_move
FORCE_RELATION.add(fh(17, 0x4b561bb90906f120L)); // pair constructor
FORCE_RELATION.add(fh(12, 0x5bd6de97fe12c3deL)); // ??0_WDI_RECEIVE_COALESCING_CAPABILITIES@@QEAA@XZ
FORCE_RELATION.add(fh(15, 0x708244492155654L)); // _Ucopy
FORCE_RELATION.add(fh(11, 0x809e950df92527a5L)); // Emplace
FORCE_RELATION.add(fh(17, 0xb33a994d051dd9a0L)); // ??_G_AsyncTaskCollection@details@Concurrency@@UEAAPEAXI@Z
FORCE_RELATION.add(fh(14, 0xee6fd3046cf7ee06L)); // ??0_WDI_CHECKSUM_OFFLOAD_CAPABILITIES_CONTAINER@@QEAA@XZ
FORCE_RELATION.add(fh(16, 0xfb2a575f03442e59L)); // ?Equals@Guid@Platform@@QEAA_NAEBU_GUID@@@Z
FORCE_RELATION.add(fh(17, 0x2d294fe5f48b3f3fL)); // Find_unchecked
FORCE_RELATION.add(fh(13, 0x64bd12c74e7fa730L)); // boolean check on field
FORCE_RELATION.add(fh(17, 0xa9e139912ed9207aL)); // Generic initializer
FORCE_RELATION.add(fh(13, 0xe624a060e19a0c64L)); // copy
FORCE_RELATION.add(fh(35, 0x4423b59693bfd81L)); // Generic destructor
FORCE_RELATION.add(fh(19, 0x637ebec60980e058L)); // operator=
FORCE_RELATION.add(fh(25, 0xa6ea183912b2677dL)); // Generic copy
FORCE_RELATION.add(fh(11, 0xb7e0a1d58b88d05cL)); // Generic constructor
FORCE_RELATION.add(fh(12, 0xceece41b9d9525cbL)); // Generic constructor
FORCE_SPECIFIC.add(fh(26, 0xf0f7f2439683bfeaL)); // Variants with specialized constants
FORCE_SPECIFIC.add(fh(17, 0xf468f6c40495d8caL)); // Dispatcher form with lots of specific constants
FORCE_SPECIFIC.add(fh(13, 0x8779436db6c1d90L)); // ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@XZ
FORCE_SPECIFIC.add(fh(75, 0x48156d182763009dL)); // _write confused with _read
FORCE_SPECIFIC.add(fh(51, 0x5c02a83d7b53cabbL)); // ??1CCommandLineInfo@@UEAA@XZ
FORCE_SPECIFIC.add(fh(15, 0x4389c3585fa0606aL)); // has_flag
FORCE_SPECIFIC.add(fh(15, 0xcc72f3219032eacfL)); // ?__acrt_stdio_parse_mode_D@@YA_NAEAU__acrt_stdio_stream_mode@@@Z
FORCE_SPECIFIC.add(fh(36, 0xa07803de9bbbebbbL)); // vector deleting destructor
FORCE_SPECIFIC.add(fh(20, 0x4af9f6ef9467bbcaL)); // ??_GFileLCRec@@QEAAPEAXI@Z
FORCE_SPECIFIC.add(fh(11, 0x17c3832d5e7abe3L)); // isnan, isinf
FORCE_SPECIFIC.add(fh(12, 0x1997c3c57f1359d6L)); // ?dtor$9@?0??AddMenuCommands@CMFCToolBarsCustomizeDialog@@QEAAXPEBVCMenu@@HPEB_W1@Z@4HA
FORCE_RELATION.add(fh(12, 0x1997c3c57f1359d6L));
FORCE_SPECIFIC.add(fh(11, 0x2c36a67a489920daL)); // ??1ContextBase@details@Concurrency@@UEAA@XZ
FORCE_RELATION.add(fh(11, 0x2c36a67a489920daL));
FORCE_SPECIFIC.add(fh(15, 0x69156cfc34e915e7L)); // ??0<lambda_6dd2c61d572e92a64c8eda4035773505>@@QEAA@AEBV0@@Z
FORCE_RELATION.add(fh(15, 0x69156cfc34e915e7L));
FORCE_SPECIFIC.add(fh(11, 0x781f34966e8ef7deL)); // FreeNode
FORCE_RELATION.add(fh(11, 0x781f34966e8ef7deL));
FORCE_SPECIFIC.add(fh(11, 0x86b8837a96bb2fadL)); // ??0NumaInformation@SchedulerBase@details@Concurrency@@QEAA@XZ
FORCE_RELATION.add(fh(11, 0x86b8837a96bb2fadL));
FORCE_SPECIFIC.add(fh(10, 0x87dd953d6c34861eL)); // get_allocator
FORCE_RELATION.add(fh(10, 0x87dd953d6c34861eL));
FORCE_SPECIFIC.add(fh(14, 0x8c77a958beb620dfL)); // ?HasRealizedChores@ScheduleGroupSegmentBase@details@Concurrency@@IEBA_NXZ
FORCE_RELATION.add(fh(14, 0x8c77a958beb620dfL));
FORCE_SPECIFIC.add(fh(10, 0x90181c81962ce711L)); // ??1CStreamOnCString@@QEAA@XZ
FORCE_RELATION.add(fh(10, 0x90181c81962ce711L));
FORCE_SPECIFIC.add(fh(17, 0x9248e909511b8ddaL)); // ??0FreeVirtualProcessorRoot@details@Concurrency@@QEAA@PEAVSchedulerProxy@12@PEAUSchedulerNode@12@I@Z
FORCE_RELATION.add(fh(17, 0x9248e909511b8ddaL));
FORCE_SPECIFIC.add(fh(15, 0x977e6c2c25e8f389L)); // ??1CMFCVisualManagerBitmapCache@@UEAA@XZ
FORCE_RELATION.add(fh(15, 0x977e6c2c25e8f389L));
FORCE_SPECIFIC.add(fh(17, 0xad2d41b71db78df0L)); // ??1COleDispatchException@@UEAA@XZ
FORCE_RELATION.add(fh(17, 0xad2d41b71db78df0L));
FORCE_SPECIFIC.add(fh(26, 0xb5b192b00955d1feL)); // ??1_Locinfo@std@@QEAA@XZ
FORCE_RELATION.add(fh(26, 0xb5b192b00955d1feL));
FORCE_SPECIFIC.add(fh(10, 0xd6a5fc3691b7f101L)); // DelRegTree
FORCE_RELATION.add(fh(10, 0xd6a5fc3691b7f101L));
FORCE_SPECIFIC.add(fh(13, 0xd75e6989aec2a5a9L)); // destructor form
FORCE_RELATION.add(fh(13, 0xd75e6989aec2a5a9L));
FORCE_SPECIFIC.add(fh(13, 0xdcfdfd3a9345b3a5L)); // constructor form
FORCE_RELATION.add(fh(13, 0xdcfdfd3a9345b3a5L));
FORCE_SPECIFIC.add(fh(14, 0xf323b038a8b540faL)); // ?GetPolicy@SchedulerBase@details@Concurrency@@UEBA?AVSchedulerPolicy@3@XZ
FORCE_RELATION.add(fh(14, 0xf323b038a8b540faL));
FORCE_SPECIFIC.add(fh(10, 0x6862321b024d5c83L)); // constructor
FORCE_RELATION.add(fh(10, 0x6862321b024d5c83L));
FORCE_SPECIFIC.add(fh(11, 0xa61ae8d54cfc35d6L)); // comparator, empty
FORCE_RELATION.add(fh(11, 0xa61ae8d54cfc35d6L));
FORCE_SPECIFIC.add(fh(12, 0x892067d7b5484452L)); // anonymous destructor
FORCE_RELATION.add(fh(12, 0x892067d7b5484452L));
FORCE_SPECIFIC.add(fh(12, 0x2155a28b83bb2704L)); // destructor
FORCE_RELATION.add(fh(12, 0x2155a28b83bb2704L));
FORCE_SPECIFIC.add(fh(14, 0x205bb2f03257b770L)); // destructor
FORCE_RELATION.add(fh(14, 0x205bb2f03257b770L));
FORCE_SPECIFIC.add(fh(12, 0xbdcafd32892d723L)); // ??1_Locimp@locale@std@@MEAA@XZ
FORCE_RELATION.add(fh(12, 0xbdcafd32892d723L));
FORCE_SPECIFIC.add(fh(12, 0xcd7e1f68717240f8L)); // destructor
FORCE_RELATION.add(fh(12, 0xcd7e1f68717240f8L));
FORCE_SPECIFIC.add(fh(10, 0x5c4a91ec77ecc3d2L)); // strnlen
AUTO_PASS.add(fh(10, 0x5c4a91ec77ecc3d2L));
@@ -292,6 +413,16 @@ public class RemoveFunctions extends GhidraScript {
AUTO_PASS.add(fh(10, 0xaba76591680821c6L));
FORCE_SPECIFIC.add(fh(10, 0x6244ea7ccad27b93L)); // wcsnlen
AUTO_PASS.add(fh(10, 0x6244ea7ccad27b93L));
FORCE_SPECIFIC.add(fh(9, 0x347bdce6848098d1L)); // strncnt
AUTO_PASS.add(fh(9, 0x347bdce6848098d1L));
FORCE_SPECIFIC.add(fh(10, 0x668ac85a3d5bf04bL)); // raise_securityfailure
AUTO_PASS.add(fh(10, 0x668ac85a3d5bf04bL));
// Must exhibit relation and constants, plus one specific set of constants are marked as auto-fail
FORCE_SPECIFIC.add(fh(11, 0xf8ff33ae3bb6b9e9L)); // constructor
FORCE_RELATION.add(fh(11, 0xf8ff33ae3bb6b9e9L));
REMOVE_SPECHASHES.add(fh(11, 0xc03985b32a1f76ceL));
}
private static Pair<Short, Long> fh(int codeUnits, long digest) {
@@ -403,6 +534,17 @@ public class RemoveFunctions extends GhidraScript {
monitor.incrementProgress(1);
}
monitor.setMaximum(REMOVE_SPECHASHES.size());
monitor.setProgress(0);
for (Pair<Short, Long> pair : REMOVE_SPECHASHES) {
List<FunctionRecord> listSpecHash =
modifiableFidDB.findFunctionsBySpecificHash(pair.second.longValue());
for (FunctionRecord funcRec : listSpecHash) {
modifiableFidDB.setAutoFailOnFunction(funcRec, true);
}
monitor.checkCanceled();
monitor.incrementProgress(1);
}
modifiableFidDB.saveDatabase("", monitor);
}
finally {

301
Ghidra/Features/FunctionID/src/main/java/ghidra/feature/fid/cmd/ApplyFidEntriesCommand.java
View File

@@ -18,6 +18,7 @@ package ghidra.feature.fid.cmd;
import java.io.IOException;
import java.util.*;
import ghidra.app.cmd.label.SetLabelPrimaryCmd;
import ghidra.app.util.demangler.DemangledObject;
import ghidra.feature.fid.db.FidQueryService;
import ghidra.feature.fid.service.*;
@@ -32,12 +33,16 @@ import ghidra.util.task.TaskMonitor;
public class ApplyFidEntriesCommand extends BackgroundCommand {
public static final String FID_CONFLICT = "FID_conflict:";
public static final String FID_BOOKMARK_CATEGORY = "Function ID Analyzer";
public static final String FIDCONFLICT_BOOKMARK_CATEGORY = "Function ID Conflict";
public static final int MAGIC_MULTIPLE_MATCH_LIMIT = 10;
public static final int MAGIC_MULTIPLE_LIBRARY_LIMIT = 5;
public static final int MAX_PLATE_COMMENT_LINE_LENGTH = 58;
private MatchNameAnalysis nameAnalysis = new MatchNameAnalysis();
private AddressSet affectedLocations = new AddressSet();
private TreeMap<String, Address> multiMatchNames = new TreeMap<String, Address>();
private LinkedList<Address> conflictFunctions = new LinkedList<Address>();
private boolean alwaysApplyFidLabels;
private float scoreThreshold;
private float multiNameScoreThreshold;
@@ -66,6 +71,7 @@ public class ApplyFidEntriesCommand extends BackgroundCommand {
try (FidQueryService fidQueryService =
service.openFidQueryService(program.getLanguage(), false)) {
monitor.setMessage("FID Analysis");
List<FidSearchResult> processProgram =
service.processProgram(program, fidQueryService, scoreThreshold, monitor);
if (processProgram == null) {
@@ -88,6 +94,7 @@ public class ApplyFidEntriesCommand extends BackgroundCommand {
" at " + entry.function.getEntryPoint());
}
}
applyConflictLabels(program);
}
catch (CancelledException e) {
return false;
@@ -143,8 +150,8 @@ public class ApplyFidEntriesCommand extends BackgroundCommand {
}
// multiple matches - TODO: change to show classes vs libraries - libraries with same name don't put "base" name only for class ones
plateCommentContents = generateComment(plateCommentContents, true, false, monitor);
bookmarkContents = generateBookmark(bookmarkContents, true, false, monitor);
plateCommentContents = generateComment(plateCommentContents, monitor);
bookmarkContents = generateBookmark(bookmarkContents);
applyMarkup(result.function, newFunctionName, plateCommentContents, bookmarkContents,
monitor);
@@ -155,20 +162,19 @@ public class ApplyFidEntriesCommand extends BackgroundCommand {
int counter = 0;
if (nameAnalysis.numNames() < MAGIC_MULTIPLE_MATCH_LIMIT) {
buffer.append("Name: ");
Iterator<String> iterator = nameAnalysis.getNameIterator();
while (iterator.hasNext()) {
monitor.checkCanceled();
if (counter != 0) {
buffer.append(", ");
}
buffer.append(iterator.next());
counter++;
Iterator<String> iterator = nameAnalysis.getNameIterator();
while (iterator.hasNext()) {
monitor.checkCanceled();
buffer.append(' ');
buffer.append(iterator.next());
buffer.append('\n');
counter++;
if (counter > 3) {
break;
}
}
else {
buffer.append("Names: " + nameAnalysis.numSimilarNames() + " - too many to list");
if (iterator.hasNext()) {
buffer.append(" " + nameAnalysis.numNames() + " names - too many to list\n");
}
return buffer.toString();
@@ -203,8 +209,7 @@ public class ApplyFidEntriesCommand extends BackgroundCommand {
return buffer.toString();
}
private String generateComment(String header, boolean includeNames, boolean includeNamespaces,
TaskMonitor monitor) throws CancelledException {
private String generateComment(String header, TaskMonitor monitor) throws CancelledException {
StringBuilder buffer = new StringBuilder();
buffer.append(header);
@@ -217,18 +222,13 @@ public class ApplyFidEntriesCommand extends BackgroundCommand {
return buffer.toString();
}
private String generateBookmark(String bookmark, boolean includeNames,
boolean includeNamespaces, TaskMonitor monitor) throws CancelledException {
private String generateBookmark(String bookmark) {
StringBuilder buffer = new StringBuilder();
if (createBookmarksEnabled) {
buffer.append(bookmark);
// append names, class, and library info buffer
buffer.append(" ");
buffer.append(listNames(monitor));
buffer.append(", ");
buffer.append(listLibraries(monitor));
buffer.append(nameAnalysis.getNameIterator().next());
}
return buffer.toString();
@@ -242,25 +242,22 @@ public class ApplyFidEntriesCommand extends BackgroundCommand {
return;
}
int numUniqueLabelNames;
// single name case ok
if (newFunctionName != null) {
addFunctionLabel(function, newFunctionName, monitor);
numUniqueLabelNames = 1;
}
// multiple names
else {
numUniqueLabelNames = addFunctionLabelMultipleMatches(function, monitor);
addFunctionLabelMultipleMatches(function, monitor);
}
if (numUniqueLabelNames < MAGIC_MULTIPLE_MATCH_LIMIT) {
if (plateCommentContents != null && !plateCommentContents.equals("")) {
function.setComment(plateCommentContents);
}
if (bookmarkContents != null && !bookmarkContents.equals("")) {
function.getProgram().getBookmarkManager().setBookmark(function.getEntryPoint(),
BookmarkType.ANALYSIS, "Function ID Analyzer", bookmarkContents);
}
if (plateCommentContents != null && !plateCommentContents.equals("")) {
function.setComment(plateCommentContents);
}
if (bookmarkContents != null && !bookmarkContents.equals("")) {
function.getProgram()
.getBookmarkManager()
.setBookmark(function.getEntryPoint(),
BookmarkType.ANALYSIS, FID_BOOKMARK_CATEGORY, bookmarkContents);
}
}
@@ -283,8 +280,7 @@ public class ApplyFidEntriesCommand extends BackgroundCommand {
return false;
}
private void addFunctionLabel(Function function, String newFunctionName, TaskMonitor monitor)
throws CancelledException {
private void addFunctionLabel(Function function, String newFunctionName, TaskMonitor monitor) {
removeConflictSymbols(function, newFunctionName, monitor);
@@ -292,106 +288,64 @@ public class ApplyFidEntriesCommand extends BackgroundCommand {
addSymbolToFunction(function, newFunctionName);
}
// This is called when a single library match is made. It checks to see if the label of the single match is contained in
// any "libID_conflict" labels. If it is, that label is removed from the other function(s) since it is no longer a possibility.
// Also checks those locations to see if there is only one other libID_conflict label left and if so, removes the "libID_conflict"
// prefix
private void removeConflictSymbols(Function function, String matchName, TaskMonitor monitor)
throws CancelledException {
Program program = function.getProgram();
SymbolTable symTab = program.getSymbolTable();
//get all currently created FID functions
BookmarkManager bkMgr = program.getBookmarkManager();
Iterator<Bookmark> bkmkIterator = bkMgr.getBookmarksIterator("Function ID Analyzer");
//iterate over all instances of libID_conflict_<matchName>_<possibly addr> and delete them
while (bkmkIterator.hasNext()) {
monitor.checkCanceled();
Bookmark nextBkmark = bkmkIterator.next();
Symbol symbols[] = symTab.getSymbols(nextBkmark.getAddress());
for (Symbol symbol : symbols) {
monitor.checkCanceled();
//if the symbol matches prefix+matchName exactly
//OR if no _ exists immediately after the prefix + matchName part of the found symbol (meaning there is no address following)
//OR if there is an _ immediately following the prefix+Name AND and address directly following it we can be sure it is a good symbol match and can delete it
//otherwise it contains extra characters indicating an invalid match and we don't want to delete it
String name = symbol.getName();
if (name.startsWith(FID_CONFLICT)) {
String baseName = name.substring(FID_CONFLICT.length());
Address symAddr = symbol.getAddress();
if (baseName.equals(matchName)) {
symbol.delete();
// check to see if there is only one symbol left on that function
// that has a libID_conflict name and if so remove the conflict part
removeConflictFromSymbolWhenOnlyOneLeft(symTab, symAddr, monitor);
break;
/**
* Delete a symbol of the given name and address, knowing there are multiple Symbols at the address.
* If the symbol is primary, make another Symbol at the address primary before deleting
* @param matchName is the given Symbol name
* @param addr is the given Address
* @param program is the Program
* @return the number of Symbols remaining at the address
*/
private int deleteSymbol(String matchName, Address addr, Program program) {
int numSymbols = 0;
for (int i = 0; i < 2; ++i) { // Try to find non-primary matching Symbol at most twice
Symbol[] symbols = program.getSymbolTable().getSymbols(addr);
numSymbols = symbols.length;
if (numSymbols <= 1) {
break;
}
for (Symbol sym : symbols) { // Among Symbols at the Address
if (sym.getName().equals(matchName)) { // Find one with matching name
if (!sym.isPrimary()) { // If it is not primary
sym.delete(); // delete it immediately
numSymbols -= 1;
break; // and we are done
}
}
}
}
}
//check to see if there is only one symbol left on that function
// that has a libID_conflict name and if so remove the conflict part
private void removeConflictFromSymbolWhenOnlyOneLeft(SymbolTable symTab, Address symAddr,
TaskMonitor monitor) throws CancelledException {
//First get all symbols at the removed symbol address
Symbol[] symbols = symTab.getSymbols(symAddr);
//Next, check to see if there is only one symbol, if it has prefix remove the prefix, otherwise just skip to end
if (symbols.length == 1) {
if (symbols[0].getName().startsWith(FID_CONFLICT)) {
removeConflictFromSymbol(symbols[0].getSource(), symbols[0]);
}
}
// if more than one symbol, check to see if only one has libIDconflict
else {
int conflictCount = 0;
Symbol keepSymbol = null;
SourceType keepSymbolSource = null;
for (Symbol symbol : symbols) {
monitor.checkCanceled();
if (conflictCount > 1) {
keepSymbol = null;
keepSymbolSource = null;
Symbol otherSym = symbols[0];
if (otherSym == sym) { // Otherwise find another Symbol, which must not be primary
otherSym = symbols[1];
}
// Set the other symbol to primary
SetLabelPrimaryCmd cmd = new SetLabelPrimaryCmd(addr, otherSym.getName(),
otherSym.getParentNamespace());
cmd.applyTo(program);
break;
}
if (symbol.getName().startsWith(FID_CONFLICT)) {
conflictCount++;
keepSymbol = symbol;
keepSymbolSource = symbol.getSource();
}
}
if (keepSymbol != null) {
removeConflictFromSymbol(keepSymbolSource, keepSymbol);
}
}
return numSymbols;
}
private void removeConflictFromSymbol(SourceType sourceType, Symbol symbol) {
// This is called when a single library match is made. It checks to see if the label of the single match is contained in
// the set of "FID conflict" functions with multiple matches.
// If it is, that label is removed from the other function(s) since it is no longer a possibility.
// Also checks those locations to see if there is only one label left and if so, removes the "FID conflict" bookmark.
private void removeConflictSymbols(Function function, String matchName, TaskMonitor monitor) {
String newName = symbol.getName().substring(FID_CONFLICT.length());
try {
symbol.setName(newName, sourceType);
Address addr = multiMatchNames.get(matchName);
if (addr == null) {
return;
}
catch (DuplicateNameException e) {
Msg.warn(SymbolUtilities.class,
"Duplicate symbol name \"" + newName + "\" at " + symbol.getAddress());
}
catch (InvalidInputException e) {
throw new AssertException(e); // unexpected
Program program = function.getProgram();
int numSymbols = deleteSymbol(matchName, addr, program);
if (numSymbols <= 1) {
// Only one symbol left, delete the "FID conflict" bookmark
BookmarkManager bookmarkManager = program.getBookmarkManager();
Bookmark bookmark = bookmarkManager.getBookmark(addr, BookmarkType.ANALYSIS,
FIDCONFLICT_BOOKMARK_CATEGORY);
if (bookmark != null) {
bookmarkManager.removeBookmark(bookmark);
}
}
}
@@ -399,51 +353,93 @@ public class ApplyFidEntriesCommand extends BackgroundCommand {
throws CancelledException {
Program program = function.getProgram();
Set<String> matchNames = nameAnalysis.getAppriateNamesSet();
if (matchNames.size() >= MAGIC_MULTIPLE_MATCH_LIMIT) {
return matchNames.size();
if (nameAnalysis.numNames() >= MAGIC_MULTIPLE_MATCH_LIMIT) {
return nameAnalysis.numNames();
}
Set<String> unusedNames = getFIDNamesThatDontExistSomewhereElse(program, matchNames);
Symbol symbol = function.getSymbol();
boolean preexistingSymbol = (symbol != null && symbol.getSource() != SourceType.DEFAULT);
for (String baseName : unusedNames) {
Set<String> unusedNames =
getFIDNamesThatDontExistSomewhereElse(program, nameAnalysis.getNameIterator());
Address addr = function.getEntryPoint();
for (String functionName : unusedNames) {
monitor.checkCanceled();
String functionName = getFunctionNameForBaseName(program, baseName, unusedNames);
addSymbolToFunction(function, functionName);
multiMatchNames.put(functionName, addr);
}
if (unusedNames.size() > 1) {
if (!preexistingSymbol) {
conflictFunctions.add(addr);
}
if (createBookmarksEnabled) {
BookmarkManager bookmarkManager = function.getProgram().getBookmarkManager();
bookmarkManager.setBookmark(addr, BookmarkType.ANALYSIS,
FIDCONFLICT_BOOKMARK_CATEGORY,
"Multiple likely matching functions");
}
}
return unusedNames.size();
}
/**
* Returns the symbol name to use based on if there are multiple conficts for a function
* If there is only one matching name, then it is used directly. Otherwise, "FID_conflict:"
* is prepended to the name.
* Apply special FID_CONFLICT to the primary symbol on functions where we had multiple matches
* @param program is the Program
*/
private String getFunctionNameForBaseName(Program program, String baseName,
Set<String> unusedNames) {
if (unusedNames.size() == 1) {
return baseName;
private void applyConflictLabels(Program program) {
SymbolTable symbolTable = program.getSymbolTable();
for (Address addr : conflictFunctions) {
Symbol[] symbols = symbolTable.getSymbols(addr);
if (symbols.length <= 1) {
continue; // Only apply conflict label if more than one symbol at address
}
Symbol symbol = null;
for (Symbol symbol2 : symbols) {
if (symbol2.isPrimary()) {
symbol = symbol2;
break;
}
}
if (symbol == null || !symbol.isGlobal()) {
continue;
}
String baseName = symbol.getName();
if (baseName.startsWith(FID_CONFLICT)) {
continue; // Conflict label previously applied
}
DemangledObject demangle = NameVersions.demangle(program, baseName);
if (demangle != null) {
baseName = demangle.getName();
}
baseName = FID_CONFLICT + baseName;
try {
symbol = symbolTable.createLabel(addr, baseName, null, SourceType.ANALYSIS);
SetLabelPrimaryCmd cmd =
new SetLabelPrimaryCmd(addr, symbol.getName(), symbol.getParentNamespace());
cmd.applyTo(program);
}
catch (InvalidInputException e) {
Msg.warn(SymbolUtilities.class,
"Invalid symbol name: \"" + baseName + "\" at " + addr);
}
}
DemangledObject demangledObj = NameVersions.demangle(program, baseName);
if (demangledObj != null) {
baseName = demangledObj.getName();
}
return FID_CONFLICT + baseName;
}
/**
* Takes a set of FID matching names and returns a subset that includes only names that don't exist
* somewhere else in the program.
*/
private Set<String> getFIDNamesThatDontExistSomewhereElse(Program program,
Set<String> matchNames) {
private static Set<String> getFIDNamesThatDontExistSomewhereElse(Program program,
Iterator<String> iter) {
Set<String> unusedNames = new HashSet<String>();
for (String name : matchNames) {
if (!nameExistsSomewhereElse(program.getSymbolTable(), name)) {
SymbolTable symbolTable = program.getSymbolTable();
while (iter.hasNext()) {
String name = iter.next();
if (!nameExistsSomewhereElse(symbolTable, name)) {
unusedNames.add(name);
}
}
@@ -451,7 +447,7 @@ public class ApplyFidEntriesCommand extends BackgroundCommand {
}
//Check to see if other functions exist with the same baseName or _baseName or __baseName
private boolean nameExistsSomewhereElse(SymbolTable symTab, String baseName) {
private static boolean nameExistsSomewhereElse(SymbolTable symTab, String baseName) {
//I did it this way because doing it with an iterator and wildcard was really really slow
List<Symbol> globalSymbols = symTab.getLabelOrFunctionSymbols(baseName, null);
@@ -470,7 +466,6 @@ public class ApplyFidEntriesCommand extends BackgroundCommand {
}
return false;
}
private void addSymbolToFunction(Function function, String name) {

10
Ghidra/Features/FunctionID/src/main/java/ghidra/feature/fid/service/FidProgramSeeker.java
View File

@@ -342,6 +342,10 @@ public class FidProgramSeeker {
}
}
if (functionRecord.isForceRelation() && childCodeUnits == 0) {
return null;
}
int parentCodeUnits = 0;
if (family.getParents().size() < MAX_NUM_PARENTS_FOR_SCORE) {
@@ -355,12 +359,6 @@ public class FidProgramSeeker {
float functionScore = functionCodeUnits;
functionScore += 0.67 * specificCodeUnits; // Each specific constant count is worth 2/3 of a whole code unit
if (functionRecord.isForceRelation()) {
// If both auto-pass and force-relation are on, do not ding score if some children match
if (!functionRecord.autoPass() || (childCodeUnits == 0)) {
functionScore = 0;
}
}
float childScore = childCodeUnits;
float parentScore = parentCodeUnits;
if (functionScore + childScore + parentScore < scoreThreshold) {

43
Ghidra/Features/FunctionID/src/main/java/ghidra/feature/fid/service/MatchNameAnalysis.java
View File

@@ -47,6 +47,10 @@ public class MatchNameAnalysis {
return rawNames.iterator();
}
public boolean containsRawName(String name) {
return rawNames.contains(name);
}
public Iterator<String> getNameIterator() {
return finalNameList.iterator();
}
@@ -89,10 +93,12 @@ public class MatchNameAnalysis {
if (nameVersions.rawName != null) {
rawNames.add(nameVersions.rawName); // Dedup the raw names
similarBaseNames.add(nameVersions.similarName); // Dedup names with underscores removed
if (nameVersions.demangledBaseName != null) // If we can demangle
if (nameVersions.demangledBaseName != null) {
exactDemangledBaseNames.add(nameVersions.demangledBaseName); // Dedup demangled base name
else
}
else {
cannotDemangle += 1;
}
}
}
@@ -117,6 +123,12 @@ public class MatchNameAnalysis {
mostOptimisticCount = 1;
finalNameList = Collections.singleton(singleName);
}
else if (rawNames.size() > similarBaseNames.size()) {
// if names are the same except for underscores use the similar name
// list to remove dupes
finalNameList = similarBaseNames;
}
if (matches.size() > 0) {
overallScore = matches.get(0).getOverallScore();
}
@@ -132,8 +144,9 @@ public class MatchNameAnalysis {
if (library != null) {
libraries.add(library);
}
if (libraries.size() >= libraryLimit)
if (libraries.size() >= libraryLimit) {
break;
}
}
if (libraries.size() >= libraryLimit) { // Too many libraries to directly display
// Try getting rid of the variant field, to see if we can reduce the count
@@ -164,8 +177,9 @@ public class MatchNameAnalysis {
}
private String findCommonBaseName() {
if (similarBaseNames.size() == 1)
if (similarBaseNames.size() == 1) {
return rawNames.iterator().next();
}
return null;
}
@@ -223,25 +237,4 @@ public class MatchNameAnalysis {
}
return finalName;
}
/**
* returns the appropriate set of names to use for laying down fid symbols
*/
public Set<String> getAppriateNamesSet() {
// if the names were originally mangled and they demangle to more than
// one base name use the demangled base names
if (exactDemangledBaseNames.size() > 1 && rawNames.size() > 1) {
return exactDemangledBaseNames;
}
// if names are the same except for underscores use the similar name
// list to remove dupes
if (rawNames.size() == similarBaseNames.size() * 2) {
return similarBaseNames;
}
// else the names are not the same or similar so use the list of exact
// names
return rawNames;
}
}

44
Ghidra/Features/FunctionID/src/main/java/ghidra/feature/fid/service/NameVersions.java
View File

@@ -15,8 +15,7 @@
*/
package ghidra.feature.fid.service;
import ghidra.app.util.demangler.DemangledObject;
import ghidra.app.util.demangler.DemanglerUtil;
import ghidra.app.util.demangler.*;
import ghidra.program.model.listing.Program;
public class NameVersions {
@@ -44,12 +43,51 @@ public class NameVersions {
return null;
}
private static String getBaseClass(Demangled namespace) {
String name = namespace.getNamespaceName(); // First level of namespace
// Check for evidence of anonymous or unnamed namespace, which won't be distinguishing
if (name.length() > 1 && name.charAt(0) == '`') {
char firstChar = name.charAt(1);
if (firstChar >= '0' && firstChar <= '9') {
return namespace.getNamespaceString(); // Get full namespace
}
}
return name;
}
private static String constructBaseName(DemangledObject demangledObj) {
String origName = demangledObj.getName();
String name = origName.replaceFirst("_*", "");
Demangled namespace = demangledObj.getNamespace();
if (namespace != null) {
if (name.endsWith("destructor'") ||
name.startsWith("operator") ||
name.startsWith("dtor$")) {
String baseClassName = getBaseClass(namespace);
if (baseClassName == null) {
return null;
}
return baseClassName + "::" + origName;
}
String fullString = namespace.getNamespaceString();
if (fullString != null && fullString.startsWith("std::")) {
// Common containers, make sure we keep the whole name
if (fullString.startsWith("std::vector") || fullString.startsWith("std::list") ||
fullString.startsWith("std::map") || fullString.startsWith("std::set") ||
fullString.startsWith("std::basic_string")) {
return fullString + "::" + origName;
}
}
}
return name;
}
public static NameVersions generate(String rawName,Program program) {
NameVersions result = new NameVersions(rawName);
if (rawName != null) {
DemangledObject demangledObj = demangle(program, rawName);
if (demangledObj != null) {
result.demangledBaseName = demangledObj.getName().replaceFirst("_*", "");
result.demangledBaseName = constructBaseName(demangledObj);
}
// Put base names with underscores removed in a HashSet