mirror/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-09-28 17:11:11 -09:00
Code Issues Packages Projects Releases Wiki Activity

GP-765: Fixing bad datatype for PE Delay Load imports

Browse Source
This commit is contained in:
Ryan Kurtz
2021-03-11 13:01:02 -05:00
parent 79fce9b032
commit ecb46d0acd
2 changed files with 17 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/StructConverter.java
View File

@@ -71,6 +71,10 @@ public interface StructConverter {
* Reusable 32-bit image base offset datatype. * Reusable 32-bit image base offset datatype.
*/ */
public final static DataType IBO32 = new ImageBaseOffset32DataType(); public final static DataType IBO32 = new ImageBaseOffset32DataType();
/**
* Reusable 64-bit image base offset datatype.
*/
public final static DataType IBO64 = new ImageBaseOffset64DataType();
/** /**
* Returns a structure datatype representing the * Returns a structure datatype representing the

22
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/DelayImportDataDirectory.java
View File

@@ -136,13 +136,13 @@ public class DelayImportDataDirectory extends DataDirectory {
createSymbol(program, tmpAddr, SymbolUtilities.getAddressAppendedName( createSymbol(program, tmpAddr, SymbolUtilities.getAddressAppendedName(
DelayImportDescriptor.NAME + "_IAT", tmpAddr)); DelayImportDescriptor.NAME + "_IAT", tmpAddr));
markupThunk(program, isBinary, space, descriptor, descriptor.getAddressOfIAT(), markupThunk(program, isBinary, space, descriptor, descriptor.getAddressOfIAT(),
descriptor.getThunksIAT(), monitor, log); descriptor.getThunksIAT(), true, monitor, log);
tmpAddr = addr(space, isBinary, descriptor, descriptor.getAddressOfINT()); tmpAddr = addr(space, isBinary, descriptor, descriptor.getAddressOfINT());
createSymbol(program, tmpAddr, SymbolUtilities.getAddressAppendedName( createSymbol(program, tmpAddr, SymbolUtilities.getAddressAppendedName(
DelayImportDescriptor.NAME + "_INT", tmpAddr)); DelayImportDescriptor.NAME + "_INT", tmpAddr));
markupThunk(program, isBinary, space, descriptor, descriptor.getAddressOfINT(), markupThunk(program, isBinary, space, descriptor, descriptor.getAddressOfINT(),
descriptor.getThunksINT(), monitor, log); descriptor.getThunksINT(), false, monitor, log);
// This table is optional // This table is optional
if (descriptor.getAddressOfBoundIAT() != 0) { if (descriptor.getAddressOfBoundIAT() != 0) {
@@ -150,7 +150,7 @@ public class DelayImportDataDirectory extends DataDirectory {
createSymbol(program, tmpAddr, SymbolUtilities.getAddressAppendedName( createSymbol(program, tmpAddr, SymbolUtilities.getAddressAppendedName(
DelayImportDescriptor.NAME + "_Bound_IAT", tmpAddr)); DelayImportDescriptor.NAME + "_Bound_IAT", tmpAddr));
markupThunk(program, isBinary, space, descriptor, descriptor.getAddressOfBoundIAT(), markupThunk(program, isBinary, space, descriptor, descriptor.getAddressOfBoundIAT(),
descriptor.getThunksBoundIAT(), monitor, log); descriptor.getThunksBoundIAT(), false, monitor, log);
} }
// This table is optional // This table is optional
@@ -159,8 +159,8 @@ public class DelayImportDataDirectory extends DataDirectory {
createSymbol(program, tmpAddr, SymbolUtilities.getAddressAppendedName( createSymbol(program, tmpAddr, SymbolUtilities.getAddressAppendedName(
DelayImportDescriptor.NAME + "_Unload_IAT", tmpAddr)); DelayImportDescriptor.NAME + "_Unload_IAT", tmpAddr));
markupThunk(program, isBinary, space, descriptor, markupThunk(program, isBinary, space, descriptor,
descriptor.getAddressOfOriginalIAT(), descriptor.getThunksUnloadIAT(), monitor, descriptor.getAddressOfOriginalIAT(), descriptor.getThunksUnloadIAT(), false,
log); monitor, log);
} }
@@ -224,9 +224,11 @@ public class DelayImportDataDirectory extends DataDirectory {
DelayImportDescriptor descriptor, DelayImportDescriptor descriptor,
long ptr, long ptr,
List<ThunkData> thunks, List<ThunkData> thunks,
boolean isIAT,
TaskMonitor monitor, TaskMonitor monitor,
MessageLog log) { MessageLog log) {
boolean is64bit = ntHeader.getOptionalHeader().is64bit();
long thunkPtr = va(ptr, isBinary); long thunkPtr = va(ptr, isBinary);
if (!descriptor.isUsingRVA()) { if (!descriptor.isUsingRVA()) {
thunkPtr -= ntHeader.getOptionalHeader().getImageBase(); thunkPtr -= ntHeader.getOptionalHeader().getImageBase();
@@ -237,12 +239,14 @@ public class DelayImportDataDirectory extends DataDirectory {
return; return;
} }
DataType dt; DataType dt;
if (thunk.getAddressOfData() == 0) { if (thunk.isOrdinal() || thunk.getAddressOfData() == 0) {
dt = ntHeader.getOptionalHeader().is64bit() ? QWORD : DWORD; dt = is64bit ? QWORD : DWORD;
}
else if (isIAT) {
dt = is64bit ? Pointer64DataType.dataType : Pointer32DataType.dataType;
} }
else { else {
dt = ntHeader.getOptionalHeader().is64bit() ? Pointer64DataType.dataType dt = is64bit ? IBO64 : IBO32;
: Pointer32DataType.dataType;
} }
Address thunkAddress = space.getAddress(thunkPtr); Address thunkAddress = space.getAddress(thunkPtr);