Ghidra plugin Bug about pharos HOT 7 CLOSED

It took me a bit of looking at this to spot the problem. Here's a prettified snippet:

      {
         "vfptr" : "12",
         "entries" : "",
         "ea" : "41dcdc"
      }

Entries should be an empty array instead of an empty string.

from pharos.

Which executable was this?

from pharos.

https://groups.google.com/forum/#!topic/boost-list/waAFNVV-RhE :(

from pharos.

That bug is not that surprising. I know that sei-jgennari had been fighting with exactly this bug before release. There must be a spot he missed or a regression or something like that. We'll investigate more as soon as we can.

from pharos.

The executable was compiled from oo.cpp in /pharos/src. The program does not crash directly， but return a null vftList even if the "Vftables" fields has a right "entries" items in config file. So why not just ignore the empty “entries” field when generate config file because I think None "entries" is useless. for example:

/pharos/libpharos/oojson_exporter.cpp:
259 methods_associated.insert(vfunc->get_address());
260 json_vft_entries.push_back(std::make_pair("",json_vf)); // add the new vf
261 voff++;
262 }
263
264 ++ if(!json_vft_entries.empty())
265 ++ json_vft.put_child("entries",json_vft_entries);
266
267 json_vftables.push_back(std::make_pair("", json_vft));
268
269 GDEBUG << "Vftable added" << LEND;

from pharos.

Can you see if this was fixed? @sei-jgennari committed some changes that were intended to fix this.

from pharos.

Yes, It works.

from pharos.