mirror/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-09-28 17:11:11 -09:00
Code Issues Packages Projects Releases Wiki Activity

GP-6070 fixed issue with memory search regEx with look-behind across buffer boundaries

Browse Source 
tmp
This commit is contained in:
ghidragon
2026-01-13 16:12:17 -05:00
parent c3cf370203
commit dc9a056ad0
10 changed files with 257 additions and 121 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
Ghidra/Features/MicrosoftCodeAnalyzer/src/main/java/ghidra/app/plugin/prototype/MicrosoftCodeAnalyzerPlugin/PEExceptionAnalyzer.java
View File

@@ -26,8 +26,7 @@ import ghidra.app.util.importer.MessageLog;
import ghidra.features.base.memsearch.bytesource.AddressableByteSource;
import ghidra.features.base.memsearch.bytesource.ProgramByteSource;
import ghidra.features.base.memsearch.gui.SearchSettings;
import ghidra.features.base.memsearch.matcher.ByteMatcher;
import ghidra.features.base.memsearch.matcher.RegExByteMatcher;
import ghidra.features.base.memsearch.matcher.*;
import ghidra.features.base.memsearch.searcher.MemoryMatch;
import ghidra.features.base.memsearch.searcher.MemorySearcher;
import ghidra.framework.cmd.Command;
@@ -94,7 +93,7 @@ public class PEExceptionAnalyzer extends AbstractAnalyzer {
SearchSettings settings = new SearchSettings().withAlignment(alignment);
settings = settings.withIncludeInstructions(false); // only search data
ByteMatcher matcher = new RegExByteMatcher(pattern, settings);
ByteMatcher<SearchData> matcher = new RegExByteMatcher(pattern, settings);
AddressableByteSource byteSource = new ProgramByteSource(program);
Memory memory = program.getMemory();
AddressSet addresses = memory.getLoadedAndInitializedAddressSet().intersect(set);
@@ -102,11 +101,12 @@ public class PEExceptionAnalyzer extends AbstractAnalyzer {
// Only want to search exception handling memory blocks.
addresses = getAddressSet(ehBlocks).intersect(addresses);
MemorySearcher searcher = new MemorySearcher(byteSource, matcher, addresses, MATCH_LIMIT);
MemorySearcher<SearchData> searcher =
new MemorySearcher<>(byteSource, matcher, addresses, MATCH_LIMIT);
ListAccumulator<MemoryMatch> accumulator = new ListAccumulator<>();
ListAccumulator<MemoryMatch<SearchData>> accumulator = new ListAccumulator<>();
searcher.findAll(accumulator, monitor);
List<MemoryMatch> results = accumulator.asList();
List<MemoryMatch<SearchData>> results = accumulator.asList();
// Establish the options to use when creating the exception handling data.
// For now these are fixed. Later these may need to come from analysis options.