grayhatacademy / ghidra_scripts

Port of devttyS0's IDA plugins to the Ghidra plugin framework, new plugins as well.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Important bug in rizzo script

VelocityRa opened this issue · comments

Hello,

Here:
https://github.com/tacnetsol/ghidra_scripts/blob/master/utils/rizzo.py#L349
Why is the last char removed?
hex() returns a string like 0x..., not ...h which would warrant the [:-1].
If i take out the [:-1], I get lots more matches in my project.

Was this always a bug? But this would be very weird because, I've been using Rizzo successfully for many months now. How did it work previously then?
Perhaps it was caused recently by Ghidra 9.2.2 or something. A Python change perhaps.

Edit: Submitted a PR. Please let me know if it's correct / why it worked this way.

Based off a very quick test, I'm guessing the [-1] was to account for large addresses, that when converted to hex, end with an 'L'.

Something like this:

>>> hex(0x123456789)
'0x123456789L
>>> hex(0x12345678)
'0x12345678'

I remember only testing with RTOS libraries that had relatively high load addresses. The 'L' should be accounted for, but this is def a bug when the addresses are lower. It may have worked for you in previous projects because your addresses were higher or it just went unnoticed. Thanks for finding it and helping fix it. I'll add a potential fix line to the pull request (I didn't test what I wrote so make sure it works for you.)

Thanks!