NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
51.49k stars 5.86k forks source link

Non compliance of user choice for union's type (using `Force Field` facility) #6465

Open Wall-AF opened 6 months ago

Wall-AF commented 6 months ago

Describe the bug When using a structure containing a 'type description value' followed by a union of possible structures (representing those types) using the Force Field option to correct Ghidra's choice is sometimes ignored.

To Reproduce Steps to reproduce the behavior:

  1. Load in the enclosed function (from the Decompile:Panels Debug Function Decompilation menu)
  2. Goto case 41a: and try to coerce the datatype used in the line pszName = (pDataToCopy->u).d402.szName + 8; to be (pDataToCopy->u).d41a (line 318)
  3. See no change

Expected behavior If the user wishes to correct the datatype, Ghidra should accept and use it.

Screenshots N/A

Attachments dgndmn32_ProcessRPCRequest.zip

Environment (please complete the following information):

Additional context N/A

Wall-AF commented 6 months ago

For reference, replacing the union with the actual datatype results in pszName = (pDataToCopy->u).szParamName;

Wall-AF commented 6 months ago

Also, if I change the member of the datatype of d402 to a char array of size 8 or less, that automatically fixes the issue!

Wall-AF commented 6 months ago

Also, in case 0x402, the actual use of the union type is missing from nLen = _strlen((char *)&pDataToCopy->u); and memcpy(g_szBringUpGroupName,&pDataToCopy->u,nLen + 1); and cannot be forced as the option isn't available!