Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

MZ EXE loader segments get out of sync with Program Tree fragments #6277

Closed
agatti opened this issue Mar 5, 2024 · 5 comments
Closed

MZ EXE loader segments get out of sync with Program Tree fragments #6277

agatti opened this issue Mar 5, 2024 · 5 comments
Assignees
Labels
Feature: Loader/MZ Status: Internal This is being tracked internally by the Ghidra team
Milestone

Comments

@agatti
Copy link
Contributor

agatti commented Mar 5, 2024

Describe the bug

Program Tree fragments start/end addresses do not reflect memory block adjustments applied by the MZ DOS EXE loader after blocks creation.

To Reproduce
Steps to reproduce the behavior:

  1. Import the attached EXE file with default settings.
  2. Open the file, skip the analysis (the issue still occurs even after analysis).
  3. Bring into view the CODE_2 block from the "Program Trees" pane.
  4. Scroll down to the end, the block should end at 11C3:29DD, but the listing is cut off at 11C3:29CF.

Expected behavior
Program Tree fragments start/end addresses should match the ones from the Memory Map pane and listing should allow viewing the whole block.

Screenshots

block_selection

Attachments
mz_dos_blocks.zip

Environment (please complete the following information):

  • OS: Linux Arch x86_64
  • Java Version: 17.0.10
  • Ghidra Version: 11.1
  • Ghidra Origin: locally built at 317a881

Additional context
You can also try to bring CODE_3 into view, the start offset does not consider the block adjustment - see screenshot.

@ryanmkurtz ryanmkurtz self-assigned this Mar 5, 2024
@ryanmkurtz ryanmkurtz added Feature: Loader/MZ Status: Triage Information is being gathered labels Mar 5, 2024
@haarlaj
Copy link
Contributor

haarlaj commented Mar 12, 2024

I'm working on another DOS executable (CATS.EXE in bug report #5970) and it has the same behavior as this. It seems to be related to the CODE sections where the source is defined as empty in the memory map, e.g. CODE_3 above.

This bug seems to present itself in places where CODE section where source is "mz" is followed by CODE section where source is empty.

Should there be any CODE sections where source is empty in the first place?

@agatti
Copy link
Contributor Author

agatti commented Mar 12, 2024

@haarlaj I missed the detail about the lack of blocks' source! From a quick look at the code it happens to blocks that are split and joined together as part of the adjustment process:

if (val == FAR_RETURN_OPCODE) {
// split here and join to previous
Address splitAddr = offAddr.add(1);
String oldName = block.getName();
memory.split(block, splitAddr);
memory.join(blocks[i - 1], blocks[i]);
blocks = memory.getBlocks();
blocks[i].setName(oldName);
break;
}

So I guess it's those extra blocks whose address bounds are not in sync with the program tree list.

@ryanmkurtz
Copy link
Collaborator

This is correct. The initial Program Tree is automatically formed when the memory blocks are created. Any kind of memory block manipulation that happens later will not be automatically reflected in the Program Tree...it requires manual fix up (which we are not currently doing).

@ryanmkurtz ryanmkurtz added Status: Prioritize This is currently being prioritized Status: Internal This is being tracked internally by the Ghidra team and removed Status: Triage Information is being gathered Status: Prioritize This is currently being prioritized labels Mar 13, 2024
@ryanmkurtz
Copy link
Collaborator

I am going to (at some point) work on fixing this Program Tree syncing issue. In the meantime, if you just create a new Program Tree, it will reflect the current memory map.

@agatti
Copy link
Contributor Author

agatti commented Mar 15, 2024

It worked, thank you!

@ryanmkurtz ryanmkurtz added this to the 11.1 milestone May 22, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature: Loader/MZ Status: Internal This is being tracked internally by the Ghidra team
Projects
None yet
Development

No branches or pull requests

3 participants