search

NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
51.13k stars 5.82k forks source link

Windows RTTI Analyzer doesn't markup all models #1408

Closed astrelsky closed 4 years ago

astrelsky commented 4 years ago

https://github.com/NationalSecurityAgency/ghidra/blob/02df944b0e62c6d94f55f93b6682d70a444c705c/Ghidra/Features/MicrosoftCodeAnalyzer/src/main/java/ghidra/app/plugin/prototype/MicrosoftCodeAnalyzerPlugin/RttiAnalyzer.java#L155-L161

It appears that the ClassHierarchyDescriptor and RTTI_Base_Class_Array models are only being built when a valid CompleteObjectLocator model is located. However, a CompleteObjectLocator only always exists when a Class has a virtual function or a base class with one. This leaves a potentially large amount of models which haven't been marked up.

The CreateRtti4BackgroundCmd is being left to create the rtti2 & rtti3 models yet it is possible for 2 & 3 to exist but not 4.

astrelsky commented 4 years ago

Resolved by 024a6190e0ae76c788d0ce6f3c8b161d2f52f8d1