You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When there is a string code unit with only references to parts of the string that are not the beginning, the string will not have a symbol for its start. For example the Test3.exe x86_32 Windows executable compiled and linked with the Visual Studio 2005 Professional Edition toolchain in Test3.zip. In the function starting at 0x00401000 there are 4 references to characters in the string starting at 0x00403018:
Ghidra correctly makes a code unit for the whole string and symbols for the individual characters. But I also want a symbol for the beginning of the string to resolve an issue raised in boricj/ghidra-delinker-extension#6 (comment). I have been using this script to check what Ghidra is doing:
array(ghidra.program.model.symbol.Reference, [From: 00401000 To: 00403024 Type: READ Op: 1 DEFAULT])From: 00401000 To: 00403024 Type: READ Op: 1 DEFAULTds "PATCH_FLAGS_p_D_b_l"Nones_p_D_b_l_00403024
I understand why this would not be the default behavior for Ghidra, but is there an analyzer, script, or option somewhere that can do this already using the same format for the symbol that Ghidra would normally use if there was a reference to the start of the string?
This discussion was converted from issue #6743 on July 25, 2024 15:16.
Heading
Bold
Italic
Quote
Code
Link
Numbered list
Unordered list
Task list
Attach files
Mention
Reference
Menu
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
-
When there is a string code unit with only references to parts of the string that are not the beginning, the string will not have a symbol for its start. For example the
Test3.exe
x86_32 Windows executable compiled and linked with the Visual Studio 2005 Professional Edition toolchain in Test3.zip. In the function starting at0x00401000
there are 4 references to characters in the string starting at0x00403018
:Ghidra correctly makes a code unit for the whole string and symbols for the individual characters. But I also want a symbol for the beginning of the string to resolve an issue raised in boricj/ghidra-delinker-extension#6 (comment). I have been using this script to check what Ghidra is doing:
And its output:
I understand why this would not be the default behavior for Ghidra, but is there an analyzer, script, or option somewhere that can do this already using the same format for the symbol that Ghidra would normally use if there was a reference to the start of the string?
Beta Was this translation helpful? Give feedback.
All reactions