mirror/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-08-08 07:40:39 -09:00
Code Issues Packages Projects Releases Wiki Activity

GP-0 Fix for trust write memory flag ignored, don't disassemble in

Browse Source 
non-executable memory on computed references
This commit is contained in:
emteere
2023-05-09 06:37:40 +00:00
parent 22e228dd8e
commit d19bf87a60
2 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/ConstantPropagationContextEvaluator.java
View File

@@ -23,8 +23,7 @@ import ghidra.program.model.address.*;
import ghidra.program.model.data.*;
import ghidra.program.model.data.DataUtilities.ClearDataMode;
import ghidra.program.model.listing.*;
import ghidra.program.model.mem.MemoryBlock;
import ghidra.program.model.mem.MemoryBufferImpl;
import ghidra.program.model.mem.*;
import ghidra.program.model.pcode.PcodeOp;
import ghidra.program.model.symbol.*;
import ghidra.program.model.util.CodeUnitInsertionException;
@@ -220,8 +219,10 @@ public class ConstantPropagationContextEvaluator extends ContextEvaluatorAdapter
}
// if flowing to an address, disassemble it
// only disassemble in executable memory
Memory memory = program.getMemory();
if (refType.isFlow() && !refType.isIndirect() &&
!program.getMemory().isExternalBlockAddress(address)) {
!memory.isExternalBlockAddress(address) && memory.getExecuteSet().contains(address)) {
Data udata = program.getListing().getUndefinedDataAt(address);
if (udata != null) {
DisassembleCommand cmd = new DisassembleCommand(address, null, true);

9
Ghidra/Features/Base/src/main/java/ghidra/program/util/VarnodeContext.java
View File

@@ -530,7 +530,8 @@ public class VarnodeContext implements ProcessorContext {
}
// If the memory is Writeable, then maybe don't trust it
if (!isReadOnly(addr)) {
boolean isReadOnly = isReadOnly(addr);
if (!isReadOnly) {
// don't try to see how far away if it is in a different space.
if (addr.getAddressSpace()
.equals(this.spaceContext.getAddress().getAddressSpace())) {
@@ -572,8 +573,10 @@ public class VarnodeContext implements ProcessorContext {
value = (value << 8 * (8 - size)) >> 8 * (8 - size);
}
// constants pulled from memory are always suspect
return createVarnode(value, SUSPECT_OFFSET_SPACEID, size);
// constants pulled from memory are suspec
// unless memory is readonly, or given access from evaluator (trustWriteAccess)
int spaceId = (isReadOnly || evaluator.allowAccess(this, addr)) ? 0 : SUSPECT_OFFSET_SPACEID;
return createVarnode(value, spaceId, size);
}
catch (MemoryAccessException e) {