mirror/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-07-30 07:18:37 -09:00
Code Issues Packages Projects Releases Wiki Activity

9396: Fix unsigned PE export ordinal-table indexes

Browse Source 
The PE Export Ordinal Table stores unsigned 16-bit indexes into the
Export Address Table. Reading these values with readShort() sign-extends
entries from 0x8000 through 0xffff, preventing them from matching the
nonnegative function index and causing their export names to be lost.
This commit is contained in:
Fereydoun Memarzanjany
2026-07-20 00:45:01 -06:00
committed by Ryan Kurtz
parent fe841ab92d
commit 683b8dae88
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/ExportDataDirectory.java
View File

@@ -314,7 +314,7 @@ public class ExportDataDirectory extends DataDirectory implements StructConverte
// See if this function has an associated name exported for it.
for (int j = 0; j < numberOfNames; ++j) {
int jthOrdinalVal = reader.readShort(pointerToOrdinals + (j * 2));
int jthOrdinalVal = reader.readUnsignedShort(pointerToOrdinals + (j * 2));
if (jthOrdinalVal == i) {
int jthNameRVA = reader.readInt(pointerToNames + (j * 4));
int jthNamePtr = ntHeader.rvaToPointer(jthNameRVA);