search

NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
51.9k stars 5.89k forks source link

Some names for imported symbols from MFC120.dll do not update #6796

Open Gunoshozo opened 3 months ago

Gunoshozo commented 3 months ago

Describe the bug The program has multiple .dll files, among them is UnivUI.dll, mfc120.dll, msvcr120.dll. UniUI.dll is a dll directly related to a program, it imports some functions from mfc120.dll and msvcr120.dll. PDB was loaded for mfc120, it was autoanalysed and symbols were applied for names inside mfc120. Same was done for msvcr120.dll. When looking at pointers to external function for mfc120.dll names are present as Ordinal_xxxx, however for msvcr120 all names were updated. I've found post related to similar issue https://www.reddit.com/r/ghidra/comments/hmea8i/apply_pdbdefined_symbols_for_a_dll_to_the/

To Reproduce Steps to reproduce the behavior:

  1. Import mfc120.dll, load pdb, autoanalyse, names should be updated
  2. Import msvcr120.dll, load pdb, autoanalyse, names should be updated
  3. Import UnivUI.dll, autoanaluse.
  4. Names for msvcr120 are updated, names for mfc120 are Ordinals

Expected behavior Names for imported functions from mfc120.dll should be updated and present as they are inside analysed mfc120 iteself.

Screenshots From inside UnivUI.dll impors of mfc120.dll: mfc120 not bound From inside mfc120.dll same oridnal_10083: image From inside UnivUI.dll impors of msvcr120.dll: image From inside msvcr120.dll: image

Attachments Archive with those dlls dlls in question.zip

Environment (please complete the following information):

ryanmkurtz commented 2 months ago

Relates to #6392?