rndtrash/JSRF-Decompilation
1
0
Fork 0
mirror of https://codeberg.org/KeybadeBlox/JSRF-Decompilation.git synced 2026-02-20 02:07:02 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Refine for virtual method check in mangling script

Browse source 
We used the flimsy heuristic of a reference from non-executable memory
to try to guess at whether a reference was a vtable, but now we just
check whether it's been named as a vtable.
This commit is contained in:
KeybadeBlox 2026-02-11 21:14:46 -05:00
parent 53b0e82417
commit 0e84f9ab1f
1 changed files with 19 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

33
ghidra/ghidra_scripts/MSVC7Mangle.java
View file

@ -264,24 +264,29 @@ public class MSVC7Mangle extends GhidraScript{
}
private boolean isVirtual(final Function f) {
/* Attempt to determine whether a method is virtual
We essentially try to figure out if any references are from a vtable
by checking if they lie in non-executable memory, or from a scalar
deleting destructor.
/* Determine whether a method is virtual
We essentially check whether any references are from a vtable or a
scalar deleting destructor.
*/
final Reference[] refs = getReferencesTo(f.getEntryPoint());
for (int i = 0; i < refs.length; i++) {
final Address addr = refs[i].getFromAddress();
final Optional<String> caller = Optional.ofNullable(getFunctionContaining(addr))
.map(x -> x.getName(false));
final Data data = getDataContaining (refs[i].getFromAddress());
final Function func = getFunctionContaining(refs[i].getFromAddress());
if (
!getMemoryBlock(addr).isExecute() ||
caller.map(x -> x.equals("`scalar_deleting_destructor'"))
.orElse(false) ||
caller.map(x -> x.startsWith("??_G")) // From mangled name
.orElse(false)
) return true;
if (data != null) {
final String name = getSymbolAt(data.getRoot()
.getAddress()).getName(false);
if (
name.equals("`vftable'") ||
name.startsWith("??_7")
) return true;
} else if (func != null) {
final String name = func.getName(false);
if (
name.equals("`scalar_deleting_destructor'") ||
name.startsWith("??_G")
) return true;
}
}
return false;