Fix PDB sizing/root parsing, LF_ARRAY sizing, and .pdata functions#33
Open
SaveEditors wants to merge 6 commits intozeroKilo:masterfrom
Open
Fix PDB sizing/root parsing, LF_ARRAY sizing, and .pdata functions#33SaveEditors wants to merge 6 commits intozeroKilo:masterfrom
SaveEditors wants to merge 6 commits intozeroKilo:masterfrom
Conversation
# Conflicts: # README.md # XEXLoaderWV/extension.properties
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
LF_ARRAYimports so the stored byte length is converted to an element count using the resolved element type size.pdataentries into real Ghidra functions instead of leaving label-onlyFunction_<addr>symbolsWhat Was Broken
TPIStream.AddEnumTypealways createdEnumDataTypewith a size of8, even when the CodeViewLF_ENUMrecord specified a smaller underlying type.PDBFilealso rounded root stream page counts incorrectly. When the PDB root directory or a root stream was smaller than one page, the loader could compute0pages and fail to read the stream layout correctly.TPIStream.AddArrayTypetreated the CodeViewLF_ARRAYlength value as an element count. On real samples that produced oversized arrays whenever the PDB stored total byte length, which is the CodeView behavior..pdataprocessing only created labels. Ghidra would showFunction_<addr>symbols without actually creating functions at those entry points.What Changed
TPIStreamnow resolves enum storage size from the enum's CodeView underlying type. Primitive backing types map directly to the correct byte width, and non-primitive cases fall back to the resolved Ghidra datatype length.PDBFilenow uses correct page-count rounding for the root directory and root streams, so small modern PDBs are parsed instead of being dropped.TPIStreamnow rebuilds arrays using the final resolved element size, converts byte length to element count, clears stale array datatypes before rebuild, and logs skipped-array reasons in aggregate so unresolved cases are no longer silent.XEXHeader.ProcessPDatanow attempts disassembly and explicit function creation for each.pdataentry instead of only assigning a label.Validation
Mesh.xex+Mesh.pdb:ValidatePdbArrayLengths.javareportedchecked=782 skipped=175 mismatches=0Aurora.xex: headless import succeeded and.pdatadefined35421functionsMesh.xex: headless import succeeded and.pdatadefined3649functionsJRPC2.xex:XeCLI rgh ghidra install-loader --archive <zip>installed this build cleanly into Ghidra 12.0.4, andrgh ghidra analyzethen imported/analyzed successfully with.pdatadefining459functionsXDRPC.xex: headless import succeeded and.pdatadefined488functionsxbdm.xex: headless import succeeded and.pdataloaded259entries while defining252new functionsAuditPdbArrayImport.javaonMesh.pdbclassified the remaining skipped arrays as38zero-length,119missing element type, and18non-divisible byte lengths; those are broader pre-existing type-resolution gaps, not regressions from this PRAddresses #26, #30, and #31.
Validations were completed with the help of XeCLI.