ghidra.program.model.symbol.SymbolTable Java Examples

/**
 * Performs markup on the ControlFlowGuard check function, if it exists.
 * 
 * @param lcd The PE LoadConfigDirectory.
 * @param is64bit True if the PE is 64-bit; false if it's 32-bit.
 * @param space The program's address space.
 * @param mem The program's memory.
 * @param symbolTable The program's symbol table.
 */
private static void markupCfgCheckFunction(LoadConfigDirectory lcd, boolean is64bit,
		AddressSpace space,
		Memory mem, SymbolTable symbolTable) {

	if (lcd.getCfgCheckFunctionPointer() == 0) {
		return;
	}

	try {
		Address functionPointerAddr = space.getAddress(lcd.getCfgCheckFunctionPointer());
		Address functionAddr = space.getAddress(
			is64bit ? mem.getLong(functionPointerAddr) : mem.getInt(functionPointerAddr));
		symbolTable.createLabel(functionAddr, "_guard_check_icall", SourceType.IMPORTED);
	}
	catch (MemoryAccessException | AddressOutOfBoundsException | InvalidInputException e) {
		Msg.warn(ControlFlowGuard.class, "Unable to label ControlFlowGuard check function.", e);
	}
}
 

private VTMatch getMatch(String sourceLabel, VTAssociationType matchType) {
	List<VTMatchSet> matchSets = session.getMatchSets();
	for (VTMatchSet vtMatchSet : matchSets) {
		Collection<VTMatch> matches = vtMatchSet.getMatches();
		for (VTMatch vtMatch : matches) {
			VTAssociation association = vtMatch.getAssociation();
			VTAssociationType type = association.getType();
			if (type != matchType) {
				continue;
			}
			Address sourceAddr = association.getSourceAddress();
			SymbolTable symbolTable = sourceProgram.getSymbolTable();
			Symbol primarySymbol = symbolTable.getPrimarySymbol(sourceAddr);
			String name = primarySymbol.getName(false);
			if (name.equals(sourceLabel)) {
				return vtMatch;
			}
		}
	}
	return null;
}
 

@Test
public void testTabUpdatesOnProgramChange() throws Exception {
	ProgramBuilder builder = new ProgramBuilder("notepad", ProgramBuilder._TOY);
	builder.createMemory("test", "0x0", 100);
	Program p = doOpenProgram(builder.getProgram(), true);
	p.setTemporary(false); // we need to be notified of changes 

	// select notepad
	panel.setSelectedProgram(p);
	int transactionID = p.startTransaction("test");
	try {
		SymbolTable symTable = p.getSymbolTable();
		symTable.createLabel(builder.addr("0x10"), "fred", SourceType.USER_DEFINED);
	}
	finally {
		p.endTransaction(transactionID, true);
	}
	p.flushEvents();
	runSwing(() -> panel.refresh(p));

	JPanel tab = panel.getTab(p);
	JLabel label = (JLabel) findComponentByName(tab, "objectName");
	assertTrue(label.getText().startsWith("*"));
}
 

private Symbol getSymbol(ProgramLocation rowObject, Program program)
		throws IllegalArgumentException {
	ProgramLocation location = rowObject;
	if (rowObject instanceof VariableLocation) {
		Variable var = ((VariableLocation) rowObject).getVariable();
		if (var != null) {
			return var.getSymbol();
		}
	}
	Address address = location.getAddress();
	SymbolTable symbolTable = program.getSymbolTable();
	Symbol symbol = symbolTable.getPrimarySymbol(address);
	if (symbol != null) {
		return symbol;
	}
	return null;
}
 

private static List<Symbol> getSymbols(String rawText, Program program) {
	List<Symbol> list = NamespaceUtils.getSymbols(rawText, program);
	if (!list.isEmpty()) {
		return list;
	}

	// if we get here, then see if the value is an address
	Address address = program.getAddressFactory().getAddress(rawText);
	if (address != null) {
		SymbolTable symbolTable = program.getSymbolTable();
		Symbol symbol = symbolTable.getPrimarySymbol(address);
		if (symbol != null) {
			return Arrays.asList(symbol);
		}
	}

	return Collections.emptyList();
}
 

@Override
public void load(ByteProvider provider, LoadSpec loadSpec, List<Option> options, Program prog,
		TaskMonitor monitor, MessageLog log) throws IOException {

	if (!prog.getExecutableFormat().equals(PeLoader.PE_NAME)) {
		throw new IOException("Program must be a " + PeLoader.PE_NAME);
	}

	SymbolTable symtab = prog.getSymbolTable();
	AddressSpace space = prog.getAddressFactory().getDefaultAddressSpace();
	List<MapExport> exports = parseExports(provider, log);
	int successCount = 0;
	for (MapExport exp : exports) {
		try {
			symtab.createLabel(space.getAddress(exp.addr), exp.name,
				SourceType.IMPORTED).setPrimary();
			successCount++;
		}
		catch (InvalidInputException e) {
			log.appendMsg(e.getMessage());
		}
	}
	log.appendMsg("Added " + successCount + " symbols.");
}
 

/**
 * Performs markup on the ReturnFlowGuard verify stack pointer function, if it exists.
 * 
 * @param lcd The PE LoadConfigDirectory.
 * @param is64bit True if the PE is 64-bit; false if it's 32-bit.
 * @param space The program's address space.
 * @param mem The program's memory.
 * @param symbolTable The program's symbol table.
 */
private static void markupRfgDefaultStackPointerFunction(LoadConfigDirectory lcd,
		boolean is64bit, AddressSpace space, Memory mem, SymbolTable symbolTable) {

	if (lcd.getRfgVerifyStackPointerFunctionPointer() == 0) {
		return;
	}

	try {
		Address functionPointerAddr =
			space.getAddress(lcd.getRfgVerifyStackPointerFunctionPointer());
		Address functionAddr = space.getAddress(
			is64bit ? mem.getLong(functionPointerAddr) : mem.getInt(functionPointerAddr));
		symbolTable.createLabel(functionAddr, "_guard_ss_verify_sp_default",
			SourceType.IMPORTED);
	}
	catch (MemoryAccessException | AddressOutOfBoundsException | InvalidInputException e) {
		Msg.warn(ControlFlowGuard.class,
			"Unable to label ReturnFlowGuard verify stack pointer function.", e);
	}
}
 

/**
 * Performs markup on the ReturnFlowGuard "default" failure routine function, if it exists.
 * 
 * @param lcd The PE LoadConfigDirectory.
 * @param is64bit True if the PE is 64-bit; false if it's 32-bit.
 * @param space The program's address space.
 * @param mem The program's memory.
 * @param symbolTable The program's symbol table.
 */
private static void markupRfgDefaultFailureRoutine(LoadConfigDirectory lcd, boolean is64bit,
		AddressSpace space, Memory mem, SymbolTable symbolTable) {

	if (lcd.getRfgFailureRoutineFunctionPointer() == 0) {
		return;
	}

	try {
		Address functionPointerAddr =
			space.getAddress(lcd.getRfgFailureRoutineFunctionPointer());
		Address functionAddr = space.getAddress(
			is64bit ? mem.getLong(functionPointerAddr) : mem.getInt(functionPointerAddr));
		symbolTable.createLabel(functionAddr, "_guard_ss_verify_failure_default",
			SourceType.IMPORTED);
	}
	catch (MemoryAccessException | AddressOutOfBoundsException | InvalidInputException e) {
		Msg.warn(ControlFlowGuard.class,
			"Unable to label ReturnFlowGuard default failure routine.", e);
	}
}
 

/**
 * Performs markup on the ReturnFlowGuard failure routine, if it exists.
 * 
 * @param lcd The PE LoadConfigDirectory.
 * @param space The program's address space.
 * @param symbolTable The program's symbol table.
 */
private static void markupRfgFailureRoutine(LoadConfigDirectory lcd, AddressSpace space,
		SymbolTable symbolTable) {

	if (lcd.getRfgFailureRoutine() == 0) {
		return;
	}

	try {
		Address routineAddr = space.getAddress(lcd.getRfgFailureRoutine());
		symbolTable.createLabel(routineAddr, "_guard_ss_verify_failure", SourceType.IMPORTED);
	}
	catch (AddressOutOfBoundsException | InvalidInputException e) {
		Msg.warn(ControlFlowGuard.class, "Unable to label ReturnFlowGuard failure routine.", e);
	}
}
 

/**
 * Performs markup on the ControlFlowGuard dispatch function, if it exists.
 * 
 * @param lcd The PE LoadConfigDirectory.
 * @param is64bit True if the PE is 64-bit; false if it's 32-bit.
 * @param space The program's address space.
 * @param mem The program's memory.
 * @param symbolTable The program's symbol table.
 */
private static void markupCfgDispatchFunction(LoadConfigDirectory lcd, boolean is64bit,
		AddressSpace space, Memory mem, SymbolTable symbolTable) {

	if (lcd.getCfgDispatchFunctionPointer() == 0) {
		return;
	}

	try {
		Address functionPointerAddr = space.getAddress(lcd.getCfgDispatchFunctionPointer());
		Address functionAddr = space.getAddress(
			is64bit ? mem.getLong(functionPointerAddr) : mem.getInt(functionPointerAddr));
		symbolTable.createLabel(functionAddr, "_guard_dispatch_icall", SourceType.IMPORTED);
	}
	catch (MemoryAccessException | AddressOutOfBoundsException | InvalidInputException e) {
		Msg.warn(ControlFlowGuard.class, "Unable to label ControlFlowGuard dispatch function.",
			e);
	}
}
 

/**
 * Perform markup on the supported ControlFlowGuard and ReturnFlowGuard functions and 
 * tables, if they exist.
 * 
 * @param lcd The PE LoadConfigDirectory.
 * @param program The program.
 * @param log The log.
 * @param ntHeader The PE NTHeader.
 */
public static void markup(LoadConfigDirectory lcd, Program program, MessageLog log,
		NTHeader ntHeader) {

	boolean is64bit = ntHeader.getOptionalHeader().is64bit();
	AddressSpace space = program.getAddressFactory().getDefaultAddressSpace();
	Memory mem = program.getMemory();
	SymbolTable symbolTable = program.getSymbolTable();

	// ControlFlowGuard
	markupCfgCheckFunction(lcd, is64bit, space, mem, symbolTable);
	markupCfgDispatchFunction(lcd, is64bit, space, mem, symbolTable);
	markupCfgFunctionTable(lcd, program, log);
	
	// ReturnFlowGuard
	markupRfgFailureRoutine(lcd, space, symbolTable);
	markupRfgDefaultFailureRoutine(lcd, is64bit, space, mem, symbolTable);
	markupRfgDefaultStackPointerFunction(lcd, is64bit, space, mem, symbolTable);
}
 

private static String getAddressRepresentation(Program program, Address address,
		CodeUnitFormat formatter) {
	SymbolTable symbolTable = program.getSymbolTable();
	Symbol symbol = symbolTable.getPrimarySymbol(address);
	if (symbol != null) { // try label first
		return truncateAsNecessary(symbol.getName());
	}

	Listing listing = program.getListing();
	CodeUnit codeUnit = listing.getCodeUnitAt(address);
	if (codeUnit == null) {
		return null;
	}
	String displayString = formatter.getRepresentationString(codeUnit);
	if (displayString != null) {
		return truncateAsNecessary(displayString);
	}
	return null;
}
 

@Test
public void testArrayVariable() throws Exception { // NullPointerException
	String mangled = "?Te@NS1@BobsStuff@@0QAY0BAA@$$CBIA";

	MicrosoftDemangler demangler = new MicrosoftDemangler();
	DemangledObject demangledObject = demangler.demangle(mangled);

	int txID = program.startTransaction("Test");

	SymbolTable st = program.getSymbolTable();
	st.createLabel(addr("01001000"), mangled, SourceType.ANALYSIS);

	DemanglerOptions options = new DemanglerOptions();
	demangledObject.applyTo(program, addr("01001000"), options, TaskMonitor.DUMMY);
	program.endTransaction(txID, false);
}
 

private Symbol getSymbol(DecompilerActionContext context) {

		ProgramLocation location = context.getLocation();
		if (location == null) {
			return null;
		}

		Address address = getDecompilerSymbolAddress(location);
		if (address == null) {
			address = location.getAddress();
		}
		Program program = context.getProgram();
		SymbolTable symbolTable = program.getSymbolTable();
		Symbol symbol = symbolTable.getPrimarySymbol(address);
		return symbol;
	}
 

private void createDifferences() throws Exception {
	Project project = env.getProject();
	ProjectData projectData = project.getProjectData();
	DomainFile file = projectData.getRootFolder().getFile("WinHelloCpp.exe");
	Program p = (Program) file.getDomainObject(this, false, false, dummyMonitor);
	int id = p.startTransaction("Test");

	Listing listing = p.getListing();
	listing.clearCodeUnits(addr(0x408dcd), addr(0x408dcd), false);
	SymbolTable symbolTable = p.getSymbolTable();
	symbolTable.createLabel(addr(0x408dd9), "BOB", SourceType.USER_DEFINED);
	symbolTable.createLabel(addr(0x408deb), "EXTRA", SourceType.USER_DEFINED);

	p.endTransaction(id, true);
	p.save("some changes", dummyMonitor);
	p.release(this);
}
 

private void createDifferencesAt401417() throws Exception {
	Address addr = addr(0x401417);
	Project project = env.getProject();
	ProjectData projectData = project.getProjectData();
	DomainFile file = projectData.getRootFolder().getFile("WinHelloCpp.exe");
	Program p = (Program) file.getDomainObject(this, false, false, dummyMonitor);
	int id = p.startTransaction("Test");

	Function function = p.getFunctionManager().getFunctionContaining(addr);
	SymbolTable symbolTable = p.getSymbolTable();
	symbolTable.createLabel(addr, "MyLabel", function, SourceType.USER_DEFINED);

	p.endTransaction(id, true);
	p.save("some changes", dummyMonitor);
	p.release(this);

	// now make a similar change in the current program, but use the global namespace
	ProgramManager service = tool.getService(ProgramManager.class);
	p = service.getCurrentProgram();
	id = p.startTransaction("Test");
	symbolTable = p.getSymbolTable();
	symbolTable.createLabel(addr, "MyLabel", SourceType.USER_DEFINED);
	p.endTransaction(id, true);
}
 

private static Object getValueObject(SymbolTable st, AddressFactory af, String tok) {

		try {
			return new Long(NumericUtilities.parseHexLong(tok));
		}
		catch (NumberFormatException e) {
			// ignore
		}
		Address address = af.getAddress(tok);
		if (address != null) {
			return address;
		}

		List<Symbol> globalSymbols = st.getLabelOrFunctionSymbols(tok, null);
		if (globalSymbols.size() == 1) {
			return globalSymbols.get(0).getAddress();
		}
		return null;
	}
 

@Test
public void testCreateFragFromCUwithLabel() throws Exception {
	SymbolTable symbolTable = program.getSymbolTable();

	Address start = getAddr(0x0100101c);
	Address end = getAddr(0x0100101f);

	AddressSet set = new AddressSet();
	set.addRange(start, end);

	int transactionID = program.startTransaction("Test");
	symbolTable.createLabel(start, "MyLabel", SourceType.USER_DEFINED);
	program.endTransaction(transactionID, true);

	set.addRange(getAddr(0x01001190), getAddr(0x01001193));

	int childCount = root.getChildCount();

	addCodeUnits(root, set);

	program.flushEvents();

	assertEquals(childCount + 1, root.getChildCount());
	ProgramNode node = (ProgramNode) root.getChildAt(childCount);
	assertEquals("MyLabel", node.getName());

	ProgramFragment f = node.getFragment();
	assertTrue(f.hasSameAddresses(set));

	undo();
	assertEquals(childCount, root.getChildCount());
	redo();
	assertEquals(childCount + 1, root.getChildCount());
	node = (ProgramNode) root.getChildAt(childCount);
	assertEquals("MyLabel", node.getName());
}
 

@Test
public void testAutoLabelOff() throws Exception {

	// do the search
	pressButton(search);
	waitForSwing();
	AutoTableDisassemblerModel model = plugin.getModel();
	waitForModel(model);
	assertEquals(8, model.getRowCount());

	// note: this button is disabled
	runSwing(() -> autoLabel.setSelected(false));

	// select a result and make a table
	selectRow(0, 0);
	waitFor(() -> pressButton(makeTable));

	SymbolTable st = program.getSymbolTable();

	assertEquals(0, st.getSymbols(addr("0x0401030")).length);

	Listing l = program.getListing();
	Data d = l.getDataAt(addr("0x401030"));
	assertTrue(d.getDataType() instanceof Pointer);
	assertEquals("DAT_00401014", st.getSymbols(d.getAddress(0))[0].getName());
	d = l.getDataAt(addr("0x401034"));
	assertTrue(d.getDataType() instanceof Pointer);
	assertEquals("DAT_00401019", st.getSymbols(d.getAddress(0))[0].getName());
	d = l.getDataAt(addr("0x401038"));
	assertTrue(d.getDataType() instanceof Pointer);
	assertEquals("DAT_0040101e", st.getSymbols(d.getAddress(0))[0].getName());
	d = l.getDataAt(addr("0x40103c"));
	assertTrue(d.getDataType() instanceof Pointer);
	assertEquals("DAT_00401023", st.getSymbols(d.getAddress(0))[0].getName());
}
 

private void checkLabelExists(boolean shouldExist, String labelString, String addressString) {
	SymbolTable symbolTable = program.getSymbolTable();
	Symbol symbol;
	if (addressString != null) {
		symbol = symbolTable.getGlobalSymbol(labelString, addr(addressString));
	}
	else {
		symbol = getUniqueSymbol(program, labelString);
	}
	assertEquals(shouldExist, (symbol != null));
}
 

private Symbol getSymbol(ProgramLocation rowObject, Program program)
		throws IllegalArgumentException {
	ProgramLocation location = rowObject;
	if (rowObject instanceof VariableLocation) {
		Variable var = ((VariableLocation) rowObject).getVariable();
		if (var != null) {
			return var.getSymbol();
		}
	}
	Address address = location.getAddress();
	SymbolTable symbolTable = program.getSymbolTable();

	return symbolTable.getPrimarySymbol(address);
}
 

protected void createHistoryEntry(Program program, String symbolName)
		throws InvalidInputException, IOException, CancelledException {
	int transactionID = program.startTransaction("test");
	try {
		SymbolTable symTable = program.getSymbolTable();
		symTable.createLabel(program.getMinAddress().getNewAddress(0x010001000), symbolName,
			SourceType.USER_DEFINED);
	}
	finally {
		program.endTransaction(transactionID, true);
		program.save(null, TaskMonitor.DUMMY);
	}
}
 

@Override
public String getValue(ProgramLocation rowObject, Settings settings, Program program,
		ServiceProvider serviceProvider) throws IllegalArgumentException {
	SymbolTable symbolTable = program.getSymbolTable();
	Symbol primarySymbol = symbolTable.getPrimarySymbol(rowObject.getAddress());
	if (primarySymbol != null) {
		return primarySymbol.getSource().toString();
	}
	return null;
}
 

@Override
public boolean applyTo(DomainObject obj) {
	SymbolTable symbolTable = ((Program) obj).getSymbolTable();
	Symbol symbol = symbolTable.getGlobalSymbol(name, addr);
	if (symbol == null) {
		message = "Could not find symbol named " + name + " at address " + addr;
		return false;
	}
	symbol.setPinned(pin);
	return true;
}
 

protected void createHistoryEntry(Program p, String symbolName)
		throws InvalidInputException, IOException, CancelledException {
	int transactionID = p.startTransaction("test");
	try {
		SymbolTable symTable = p.getSymbolTable();
		symTable.createLabel(p.getMinAddress().getNewAddress(0x010001000), symbolName,
			SourceType.USER_DEFINED);
	}
	finally {
		p.endTransaction(transactionID, true);
		p.save(null, TaskMonitor.DUMMY);
	}
}
 

@Override
protected List<String> getVertices(AddressSetView addrSet) {
	if (addrSet.isEmpty()) {
		return Collections.emptyList();
	}

	// Identify all blocks which have an entry point within the selection address set
	ArrayList<String> blockList = new ArrayList<String>();
	try {
		SymbolTable symTable = program.getSymbolTable();
		CodeBlockIterator cbIter =
			blockModel.getCodeBlocksContaining(addrSet, TaskMonitor.DUMMY);
		while (cbIter.hasNext()) {
			CodeBlock block = cbIter.next();
			String addrString;
			Address addr = block.getFirstStartAddress();
			if (addr.isExternalAddress()) {
				Symbol s = symTable.getPrimarySymbol(addr);
				addrString = s.getName(true);
			}
			else {
				addrString = addr.toString();
			}
			blockList.add(addrString);
		}
	}
	catch (CancelledException e) {
		// Will not happen with dummyMonitor
		// Model has already done the work when the graph was created
	}

	return blockList;
}
 

private String createTitle() {
	Address minAddress = addressSet.getMinAddress();
	String newTitle = minAddress.toString();
	SymbolTable symbolTable = program.getSymbolTable();
	Symbol primarySymbol = symbolTable.getPrimarySymbol(minAddress);
	if (primarySymbol != null) {
		newTitle += " - " + primarySymbol.getName(false);
	}
	return newTitle;
}
 

public Symbol createSymbol(Address addr, String name, boolean isPrimary, boolean pinAbsolute, Namespace namespace) throws InvalidInputException 
{
    // TODO: At this point, we should be marking as data or code
    SymbolTable symbolTable = program.getSymbolTable();
    Symbol sym = symbolTable.createLabel(addr, name, namespace, SourceType.IMPORTED);
    if (isPrimary) {
        checkPrimary(sym);
    }
    if (pinAbsolute && !sym.isPinned()) {
        sym.setPinned(true);
    }
    return sym;
}
 

@Override
void editLabel(JComponent parentComponent) {
	AddressSetView view = listingPanel.getView();
	Address minAddress = view.getMinAddress();
	SymbolTable symbolTable = program.getSymbolTable();
	Symbol primarySymbol = symbolTable.getPrimarySymbol(minAddress);

	AddEditDialog dialog = new AddEditDialog("", tool);
	if (primarySymbol == null) {
		dialog.addLabel(minAddress, program, parentComponent);
	}
	else {
		dialog.editLabel(primarySymbol, program, parentComponent);
	}
}
 

void createNewLabel(Address address, String name, Namespace namespace, SourceType sourceType) {
	SymbolTable symbolTable = currentProgram.getSymbolTable();
	if(getSymbolAt(address).getSource().equals(SourceType.DEFAULT)){
		try {
			symbolTable.createLabel(address, name, namespace, sourceType);
		} catch (InvalidInputException e) {
			println("Invalid input to create label.");
		}
	}
}