search

NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
51.12k stars 5.82k forks source link

GnuDemanglerParser removes number from class name #1870

Closed astrelsky closed 4 years ago

astrelsky commented 4 years ago

Describe the bug The GnuDemanglerParser removes trailing numbers from a Demangled which are actually part of the class name.

To Reproduce Steps to reproduce the behavior:

  1. Demangle "_ZTI31class_with_trailing_numbers1234"
  2. See result of "class_with_trailing_numbers::typeinfo"

Expected behavior Trailing numbers which are part of the class name should not be removed. For the above example the class name is "class_with_trailing_numbers1234" so its demangled typeinfo symbol should be "class_with_trailing_numbers1234::typeinfo"

Environment (please complete the following information):

dragonmacher commented 4 years ago

This is a big deal. Not sure how I missed this ticket.

astrelsky commented 4 years ago

This is a big deal. Not sure how I missed this ticket.

I believe I tracked this down to GnuDemanglerParser.AddressTableHandler. I don't understand why trailing numbers are being removed though so I never submitted a patch for it and just used a temporary hack fix.

dragonmacher commented 4 years ago

so I never submitted a patch for it and just used a temporary hack fix.

For better or worse, Ghidra is built upon hack fixes, many of which are temporary, yet older than temporary should be. I intend to investigate the issue eventually. Feel free to include a code snippet if you'd like.

astrelsky commented 4 years ago

so I never submitted a patch for it and just used a temporary hack fix.

For better or worse, Ghidra is built upon hack fixes, many of which are temporary, yet older than temporary should be. I intend to investigate the issue eventually. Feel free to include a code snippet if you'd like.

My use case for it was extremely limited. I was just creating a mangled typeinfo symbol and demangling it to extract the class name. I literally just fetched the native demangler and used regex to pull out what was removed.

https://github.com/astrelsky/Ghidra-Cpp-Class-Analyzer/blob/1fc879cfb564dda0c42a144280f2495aa836ab26/src/main/java/ghidra/app/cmd/data/rtti/gcc/GnuUtils.java#L375