diff --git a/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/StructConverter.java b/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/StructConverter.java index b58676d8a0..23259ebcfe 100644 --- a/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/StructConverter.java +++ b/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/StructConverter.java @@ -71,6 +71,10 @@ public interface StructConverter { * Reusable 32-bit image base offset datatype. */ public final static DataType IBO32 = new ImageBaseOffset32DataType(); + /** + * Reusable 64-bit image base offset datatype. + */ + public final static DataType IBO64 = new ImageBaseOffset64DataType(); /** * Returns a structure datatype representing the diff --git a/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/DelayImportDataDirectory.java b/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/DelayImportDataDirectory.java index 24c8a3d42a..376604e513 100644 --- a/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/DelayImportDataDirectory.java +++ b/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/DelayImportDataDirectory.java @@ -136,13 +136,13 @@ public class DelayImportDataDirectory extends DataDirectory { createSymbol(program, tmpAddr, SymbolUtilities.getAddressAppendedName( DelayImportDescriptor.NAME + "_IAT", tmpAddr)); markupThunk(program, isBinary, space, descriptor, descriptor.getAddressOfIAT(), - descriptor.getThunksIAT(), monitor, log); + descriptor.getThunksIAT(), true, monitor, log); tmpAddr = addr(space, isBinary, descriptor, descriptor.getAddressOfINT()); createSymbol(program, tmpAddr, SymbolUtilities.getAddressAppendedName( DelayImportDescriptor.NAME + "_INT", tmpAddr)); markupThunk(program, isBinary, space, descriptor, descriptor.getAddressOfINT(), - descriptor.getThunksINT(), monitor, log); + descriptor.getThunksINT(), false, monitor, log); // This table is optional if (descriptor.getAddressOfBoundIAT() != 0) { @@ -150,7 +150,7 @@ public class DelayImportDataDirectory extends DataDirectory { createSymbol(program, tmpAddr, SymbolUtilities.getAddressAppendedName( DelayImportDescriptor.NAME + "_Bound_IAT", tmpAddr)); markupThunk(program, isBinary, space, descriptor, descriptor.getAddressOfBoundIAT(), - descriptor.getThunksBoundIAT(), monitor, log); + descriptor.getThunksBoundIAT(), false, monitor, log); } // This table is optional @@ -159,8 +159,8 @@ public class DelayImportDataDirectory extends DataDirectory { createSymbol(program, tmpAddr, SymbolUtilities.getAddressAppendedName( DelayImportDescriptor.NAME + "_Unload_IAT", tmpAddr)); markupThunk(program, isBinary, space, descriptor, - descriptor.getAddressOfOriginalIAT(), descriptor.getThunksUnloadIAT(), monitor, - log); + descriptor.getAddressOfOriginalIAT(), descriptor.getThunksUnloadIAT(), false, + monitor, log); } @@ -224,9 +224,11 @@ public class DelayImportDataDirectory extends DataDirectory { DelayImportDescriptor descriptor, long ptr, List thunks, + boolean isIAT, TaskMonitor monitor, MessageLog log) { + boolean is64bit = ntHeader.getOptionalHeader().is64bit(); long thunkPtr = va(ptr, isBinary); if (!descriptor.isUsingRVA()) { thunkPtr -= ntHeader.getOptionalHeader().getImageBase(); @@ -237,12 +239,14 @@ public class DelayImportDataDirectory extends DataDirectory { return; } DataType dt; - if (thunk.getAddressOfData() == 0) { - dt = ntHeader.getOptionalHeader().is64bit() ? QWORD : DWORD; + if (thunk.isOrdinal() || thunk.getAddressOfData() == 0) { + dt = is64bit ? QWORD : DWORD; + } + else if (isIAT) { + dt = is64bit ? Pointer64DataType.dataType : Pointer32DataType.dataType; } else { - dt = ntHeader.getOptionalHeader().is64bit() ? Pointer64DataType.dataType - : Pointer32DataType.dataType; + dt = is64bit ? IBO64 : IBO32; } Address thunkAddress = space.getAddress(thunkPtr);