From 7794bcfa9f8c51442a87f10a3475612dfc4435d8 Mon Sep 17 00:00:00 2001 From: Mason Reed Date: Tue, 3 Dec 2024 16:55:52 -0500 Subject: Handle relocated itanium ABI base vtables --- plugins/rtti/itanium.cpp | 29 ++++++++--------------------- 1 file changed, 8 insertions(+), 21 deletions(-) (limited to 'plugins/rtti/itanium.cpp') diff --git a/plugins/rtti/itanium.cpp b/plugins/rtti/itanium.cpp index cd80b7f9..f7ad9a70 100644 --- a/plugins/rtti/itanium.cpp +++ b/plugins/rtti/itanium.cpp @@ -208,14 +208,17 @@ std::optional ReadTypeInfoVariant(BinaryView *view, uint64_t ob // If there is a symbol at objectAddr pointing to a symbol starting with "vtable for __cxxabiv1" auto baseSym = view->GetSymbolByAddress(typeInfo.base); if (baseSym == nullptr) - return std::nullopt; + { + // Check relocation at objectAddr for symbol + for (const auto& r : view->GetRelocationsAt(objectAddr)) + if (auto relocSym = r->GetSymbol()) + baseSym = relocSym; + if (baseSym == nullptr) + return std::nullopt; + } if (baseSym->GetType() != ExternalSymbol) return std::nullopt; auto baseSymName = baseSym->GetShortName(); - - // TODO: __vmi_class_type_info seems to point to operator delete(void*) - // TODO: For now we just bruteforce it with the type_name check... - if (baseSymName.find("__cxxabiv1") != std::string::npos) { // symbol takes the form of `abi::base_name` @@ -230,22 +233,6 @@ std::optional ReadTypeInfoVariant(BinaryView *view, uint64_t ob if (baseSymName == "__vmi_class_type_info") return TIVVMIClass; } - else if (typeInfo.type_name.length() > 2) - { - // TODO: This is so ugly - switch (typeInfo.type_name.at(0)) - { - case '7': - return TIVClass; - case '9': - return TIVSIClass; - case '1': - if (typeInfo.type_name.at(1) == '4') - return TIVVMIClass; - default: - return std::nullopt; - } - } return std::nullopt; } -- cgit v1.3.1