Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Pointers do not seem to work properly. #2

Closed
Kneesnap opened this issue Oct 15, 2020 · 8 comments
Closed

Pointers do not seem to work properly. #2

Kneesnap opened this issue Oct 15, 2020 · 8 comments

Comments

@Kneesnap
Copy link

@astrelsky I hope everything is going well. I have an issue to report though.
It seems like many pointers are not interpretted correctly.

I compiled this code:
image

When disassembling in Ghidra, I get this:
image

I notice that 0x221700 is exactly double the real pointer address. Seems like an issue with the plugin to me.

cw_dbg_opt0.zip

astrelsky added a commit that referenced this issue Oct 15, 2020
astrelsky added a commit that referenced this issue Oct 15, 2020
@astrelsky
Copy link
Owner

So GitHub's auto link close feature thing has failed me.

I just removed all processing of R_MIPS_HI16 and R_MIPS_LO16 for now. If anything still doesn't seem right lmk.

@Kneesnap
Copy link
Author

Kneesnap commented Oct 17, 2020

EDIT: I have moved this into a separate issue, #2.

Unfortunately the issue still exists somewhat.

This is the same code screenshotted above. It now successfully gets the name of the symbol, which when clicked navigates to the real string. It isn't ideal, but it's good enough for me.
image

However, I have another seemingly related issue (which is why I've re-opened this one) affecting the executable I'd actually like to reverse.

image

image

The addresses shown here (eg. $227BB8h) are not correct.
I have not been able to figure out what the proper addresses are yet.

Both IDA and PCSX2's Debugger read some of these instructions different from Ghidra.
Ghidra:
image
PCSX2 / IDA Pro:
image

@astrelsky
Copy link
Owner

astrelsky commented Oct 18, 2020

In order for the string value to be used in place of the symbol the data needs to be marked as constant. To do so right click on the data, go to the data sub menu, then settings and choose constant under mutability. This is standard ghidra behavior. I typically set the default mutability to constant for string datatypes and will use a char array when I know the data is mutable.

@Kneesnap
Copy link
Author

This issue has not been fully resolved after all.

image
image
image

@Kneesnap
Copy link
Author

Furthermore there appears to be an issue with function detection too. These addresses point to callback functions.
image
image

@astrelsky
Copy link
Owner

astrelsky commented Oct 24, 2020

This issue has not been fully resolved after all.

image
image
image

Please show the mutability settings of the string data. Ghidra will only use the value of a string if it is marked as a constant.

Furthermore there appears to be an issue with function detection too. These addresses point to callback functions.
image
image

For the callback parameters, if the function signature has not been committed yet ghidra will still assume the types of the parameters. It is assuming it to be an integer type here instead of a pointer. Try defining the function signatures for kcSetErrorHandler and kcSetTraceCallback

@Kneesnap
Copy link
Author

Kneesnap commented Oct 24, 2020

Please show the mutability settings of the string data. Ghidra will only use the value of a string if it is marked as a constant.

image

For the callback parameters, if the function signature has not been committed yet ghidra will still assume the types of the parameters. It is assuming it to be an integer type here instead of a pointer. Try defining the function signatures for kcSetErrorHandler and kcSetTraceCallback

Ah, I see. That's my fault then.

@astrelsky
Copy link
Owner

Set the mutability to constant.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants