Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Certain types fail to parse properly #2

Open
jhol opened this issue Apr 17, 2024 · 2 comments
Open

Certain types fail to parse properly #2

jhol opened this issue Apr 17, 2024 · 2 comments

Comments

@jhol
Copy link

jhol commented Apr 17, 2024

The following type definition stabs were all found to fail with a similar errror:

  • long long int:t(0,6)=@s64;r(0,6);01000000000000000000000;0777777777777777777777;
  • long long unsigned int:t(0,7)=@s64;r(0,7);0000000000000;01777777777777777777777;
  • short int:t(0,8)=@s16;r(0,8);-32768;32767;
  • short unsigned int:t(0,9)=@s16;r(0,9);0;65535;
  • signed char:t(0,10)=@s8;r(0,10);-128;127;
  • unsigned char:t(0,11)=@s8;r(0,11);0;255;
  • complex float:t(0,16)=R3;8;0;
  • complex double:t(0,17)=R3;16;0;
  • complex long double:t(0,18)=R3;24;0;
  • _Bool:t(0,21)=@s8;-16
StabsScript.java> parseStab("_Bool:t(0,21)=@s8;-16")
> Error running script: StabsScript.java
java.lang.reflect.InvocationTargetException
	at ghidra.app.plugin.core.analysis.AutoAnalysisManager$AnalysisWorkerCommand.applyTo(AutoAnalysisManager.java:1713)
	at ghidra.app.plugin.core.analysis.AutoAnalysisManager$AnalysisTaskWrapper.run(AutoAnalysisManager.java:688)
	at ghidra.app.plugin.core.analysis.AutoAnalysisManager.startAnalysis(AutoAnalysisManager.java:788)
	at ghidra.app.plugin.core.analysis.AutoAnalysisManager.startAnalysis(AutoAnalysisManager.java:667)
	at ghidra.app.plugin.core.analysis.AutoAnalysisManager.startAnalysis(AutoAnalysisManager.java:632)
	at ghidra.app.plugin.core.analysis.AnalysisBackgroundCommand.applyTo(AnalysisBackgroundCommand.java:58)
	at ghidra.framework.plugintool.mgr.BackgroundCommandTask.run(BackgroundCommandTask.java:102)
	at ghidra.framework.plugintool.mgr.ToolTaskManager.run(ToolTaskManager.java:319)
	at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: java.lang.RuntimeException: Struct size mismatch structType.getLength() = 1, structSize = 8
	at StabsVisitor.visitStructType(StabsVisitor.java:233)
	at StabsVisitor.visitStructType(StabsVisitor.java:11)
	at stabs.StabsParser$StructTypeContext.accept(StabsParser.java:477)
	at org.antlr.v4.runtime.tree.AbstractParseTreeVisitor.visit(AbstractParseTreeVisitor.java:18)
	at StabsVisitor.visitTypeDesc(StabsVisitor.java:254)
	at StabsVisitor.visitTypeDesc(StabsVisitor.java:11)
	at stabs.StabsParser$TypeDescContext.accept(StabsParser.java:615)
	at org.antlr.v4.runtime.tree.AbstractParseTreeVisitor.visit(AbstractParseTreeVisitor.java:18)
	at StabsVisitor.visitType(StabsVisitor.java:277)
	at StabsVisitor.visitType(StabsVisitor.java:11)
	at stabs.StabsParser$TypeContext.accept(StabsParser.java:771)
	at org.antlr.v4.runtime.tree.AbstractParseTreeVisitor.visit(AbstractParseTreeVisitor.java:18)
	at StabsVisitor.visitSymbol(StabsVisitor.java:292)
	at StabsVisitor.visitSymbol(StabsVisitor.java:11)
	at stabs.StabsParser$SymbolContext.accept(StabsParser.java:834)
	at org.antlr.v4.runtime.tree.AbstractParseTreeVisitor.visit(AbstractParseTreeVisitor.java:18)
	at StabsScript.parseStab(StabsScript.java:279)
	at StabsScript.run(StabsScript.java:395)
	at ghidra.app.script.GhidraScript.executeNormal(GhidraScript.java:379)
	at ghidra.app.script.GhidraScript$1.analysisWorkerCallback(GhidraScript.java:361)
	at ghidra.app.plugin.core.analysis.AutoAnalysisManager$AnalysisWorkerCommand.applyTo(AutoAnalysisManager.java:1707)
	... 8 more
@RidgeX
Copy link
Owner

RidgeX commented Apr 20, 2024

Do you know which version of GCC produced those types? My best guess is GCC 3.4.4 from Cygwin 1.5. Negative type numbers (e.g. -16 for boolean) are specific to COFF and other Windows distributions of GCC (MinGW, DJGPP) do not opt for Stabs as the default debug info format.

I am open to adding support for the PE/COFF format and the builtin types introduced by GCC 3 and stabs-in-COFF.

@jhol
Copy link
Author

jhol commented Apr 22, 2024

Wow, I think you might be precisely right. To my understanding the binary was produced using GCC 3.4.4 on Cygwin.

I built a hacky mod to the script that loads PE files: 023999a , but there are many parsing errors.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants