development/ghidra
development/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra synced 2024-10-01 07:54:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

GP-3519: Fixed a bug that caused PE symbol .exports files to always get

Browse source 
deleted after import (Closes #5348)
This commit is contained in:
Ryan Kurtz 2023-06-06 07:25:59 -04:00
parent 69fa35638b
commit a31063dcb0
2 changed files with 15 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/ResourceDataDirectory.java
View file

@ -15,9 +15,8 @@
*/
package ghidra.app.util.bin.format.pe;
import java.util.*;
import java.io.IOException;
import java.util.*;
import ghidra.app.util.bin.BinaryReader;
import ghidra.app.util.bin.format.pe.resource.*;
@ -67,9 +66,6 @@ public class ResourceDataDirectory extends DataDirectory {
"MessageTable", "GroupCursor", "13", "GroupIcon", "15", "Version", "DialogInclude", "18",
"PlugAndPlay", "VXD", "ANI_Cursor", "ANI_Icon", "HTML", "Manifest" };
public final static String PE_PROPERTY_PROGINFO_PREFIX = "PE Property[";
public final static String PE_PROPERTY_PROGINFO_SUFFIX = "]";
/**
* Not defined in documentation but PNGs and WAVs are both this type
*/
@ -161,6 +157,16 @@ public class ResourceDataDirectory extends DataDirectory {
*/
public final static byte RT_MANIFEST = 24;
/**
* Gets a program property name to represent PE resource property with the given key name
*
* @param key The key name
* @return A program property name to represent PE resource property with the given key name
*/
public static String getPeResourceProperty(String key) {
return "PE Property[" + key.replaceAll("\\.", "_dot_") + "]";
}
private ResourceDirectory rootDirectory;
public static Set<Integer> directoryMap;
@ -419,16 +425,10 @@ public class ResourceDataDirectory extends DataDirectory {
return;
}
String value = versionInfo.getValue(key);
String optionKey = PE_PROPERTY_PROGINFO_PREFIX + escapeProgInfoKeyValue(key) +
PE_PROPERTY_PROGINFO_SUFFIX;
programInfoOptions.setString(optionKey, value);
programInfoOptions.setString(getPeResourceProperty(key), value);
}
}
private static String escapeProgInfoKeyValue(String key) {
return key.replaceAll("\\.", "_dot_");
}
private void markupChild(VS_VERSION_CHILD child, Address parentAddr, Program program,
MessageLog log, TaskMonitor monitor) {
Address childAddr = parentAddr.add(child.getRelativeOffset());

5
Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/LibraryLookupTable.java
View file

@ -20,6 +20,7 @@ import java.io.IOException;
import java.util.*;
import generic.jar.ResourceFile;
import ghidra.app.util.bin.format.pe.ResourceDataDirectory;
import ghidra.app.util.importer.MessageLog;
import ghidra.framework.Application;
import ghidra.framework.options.Options;
@ -147,8 +148,8 @@ public class LibraryLookupTable {
Options props = program.getOptions(Program.PROGRAM_INFO);
String format = program.getExecutableFormat();
String company = props.getString("CompanyName", "");
String version = props.getString("FileVersion", "");
String company = props.getString(ResourceDataDirectory.getPeResourceProperty("CompanyName"), "");
String version = props.getString(ResourceDataDirectory.getPeResourceProperty("FileVersion"), "");
boolean save =
!format.equals(PeLoader.PE_NAME) || company.toLowerCase().contains("microsoft");