mirror/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-09-10 09:13:58 -09:00
Code Issues Packages Projects Releases Wiki Activity

GP-765: Fixing bad datatype for PE Delay Load imports

Browse Source
This commit is contained in:
Ryan Kurtz
2021-03-11 13:01:02 -05:00
parent 79fce9b032
commit ecb46d0acd
2 changed files with 17 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/StructConverter.java
View File

@@ -71,6 +71,10 @@ public interface StructConverter {
* Reusable 32-bit image base offset datatype.
*/
public final static DataType IBO32 = new ImageBaseOffset32DataType();
/**
* Reusable 64-bit image base offset datatype.
*/
public final static DataType IBO64 = new ImageBaseOffset64DataType();
/**
* Returns a structure datatype representing the

22
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/DelayImportDataDirectory.java
View File

@@ -136,13 +136,13 @@ public class DelayImportDataDirectory extends DataDirectory {
createSymbol(program, tmpAddr, SymbolUtilities.getAddressAppendedName(
DelayImportDescriptor.NAME + "_IAT", tmpAddr));
markupThunk(program, isBinary, space, descriptor, descriptor.getAddressOfIAT(),
descriptor.getThunksIAT(), monitor, log);
descriptor.getThunksIAT(), true, monitor, log);
tmpAddr = addr(space, isBinary, descriptor, descriptor.getAddressOfINT());
createSymbol(program, tmpAddr, SymbolUtilities.getAddressAppendedName(
DelayImportDescriptor.NAME + "_INT", tmpAddr));
markupThunk(program, isBinary, space, descriptor, descriptor.getAddressOfINT(),
descriptor.getThunksINT(), monitor, log);
descriptor.getThunksINT(), false, monitor, log);
// This table is optional
if (descriptor.getAddressOfBoundIAT() != 0) {
@@ -150,7 +150,7 @@ public class DelayImportDataDirectory extends DataDirectory {
createSymbol(program, tmpAddr, SymbolUtilities.getAddressAppendedName(
DelayImportDescriptor.NAME + "_Bound_IAT", tmpAddr));
markupThunk(program, isBinary, space, descriptor, descriptor.getAddressOfBoundIAT(),
descriptor.getThunksBoundIAT(), monitor, log);
descriptor.getThunksBoundIAT(), false, monitor, log);
}
// This table is optional
@@ -159,8 +159,8 @@ public class DelayImportDataDirectory extends DataDirectory {
createSymbol(program, tmpAddr, SymbolUtilities.getAddressAppendedName(
DelayImportDescriptor.NAME + "_Unload_IAT", tmpAddr));
markupThunk(program, isBinary, space, descriptor,
descriptor.getAddressOfOriginalIAT(), descriptor.getThunksUnloadIAT(), monitor,
log);
descriptor.getAddressOfOriginalIAT(), descriptor.getThunksUnloadIAT(), false,
monitor, log);
}
@@ -224,9 +224,11 @@ public class DelayImportDataDirectory extends DataDirectory {
DelayImportDescriptor descriptor,
long ptr,
List<ThunkData> thunks,
boolean isIAT,
TaskMonitor monitor,
MessageLog log) {
boolean is64bit = ntHeader.getOptionalHeader().is64bit();
long thunkPtr = va(ptr, isBinary);
if (!descriptor.isUsingRVA()) {
thunkPtr -= ntHeader.getOptionalHeader().getImageBase();
@@ -237,12 +239,14 @@ public class DelayImportDataDirectory extends DataDirectory {
return;
}
DataType dt;
if (thunk.getAddressOfData() == 0) {
dt = ntHeader.getOptionalHeader().is64bit() ? QWORD : DWORD;
if (thunk.isOrdinal() || thunk.getAddressOfData() == 0) {
dt = is64bit ? QWORD : DWORD;
}
else if (isIAT) {
dt = is64bit ? Pointer64DataType.dataType : Pointer32DataType.dataType;
}
else {
dt = ntHeader.getOptionalHeader().is64bit() ? Pointer64DataType.dataType
: Pointer32DataType.dataType;
dt = is64bit ? IBO64 : IBO32;
}
Address thunkAddress = space.getAddress(thunkPtr);