Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[PDB] Base class are not recognized for the derived class, local variables names are not recognized #6463

Open
SmileyAG opened this issue Apr 28, 2024 · 1 comment
Assignees
Labels
Feature: PDB Status: Triage Information is being gathered

Comments

@SmileyAG
Copy link

SmileyAG commented Apr 28, 2024

Describe the bug
This non-detection of the base class for derived affects all functionality: graph of type, disassembler, decompiler, structure editor and etc

I tried importing other x86 projects that were compiled on different versions of MSVC and the result was the same everywhere.
IDA does not have such issues in comparison, so I am sure that the issue clearly ties to the PDB parser from Ghidra

Here is CBasePlayer::Jump function from source code of the project on the basis of which another project was made that is shown in the screenshots and the files of which are attached to this issue: https://github.com/HLSources/Paranoia/blob/c2d8018e3fa9de209ba76c0bbe8491bc09d8d797/code_src/dlls/player.cpp#L1892

In the first screenshot you can clearly see the absolute similarity of the names of local variables and members of class (including members from inherited classes) in the result from IDA decompiler shown in the screenshot in comparison with the provided source code, so this data indeed matches
Meanwhile, Ghidra cannot recognize local variable names or members of base classes in a derived class (CBasePlayer) from a PDB file

In the second screenshot you can see that Ghidra creates empty fields as alignment from the size of the base class
IDA also does alignment, but it recognizes what exactly the base class (CBaseMonster), which gives you an explanation of why and from whom the alignment was made

Here's the CBasePlayer class hierarchy for investigate from the provided binaries in case if needed:

CBaseEntity -> CBaseDelay -> CBaseAnimating -> CBaseToggle -> CBaseMonster -> CBasePlayer

To Reproduce
Steps to reproduce the behavior:

  • Import any binary and its .pdb into Ghidra for analysis, simply enough. Default analysis options were used.

Screenshots
comparison-of-pdb-parsers-in-the-decompiler
comparison-of-pdb-parsers-in-the-structure

Attachments
cry-of-fear-14-server-binary-with-pdb.zip
application.log

Environment (please complete the following information):

  • OS: [Windows 10, 64 bit]
  • Java Version: [jdk-17.0.2]
  • Ghidra Version: [11.0.3]
  • Ghidra Origin: [official GitHub distro]
@ghizard ghizard self-assigned this Apr 29, 2024
@ghizard ghizard added Feature: PDB Status: Triage Information is being gathered labels Apr 29, 2024
@ghizard
Copy link
Contributor

ghizard commented Apr 29, 2024

There are two issues here. First is the PDB base class issue, which was worked on but not turned on due to reliable ways of portraying and saving the information... this is being looked at again at this time, and there might be ways to supply better information that the long-term goal.

The second issue is concerning setting variable names for the Decompiler. This is a tougher issue to deal with and my understanding is that due to the many transformations that occur within the Decompiler, it might be much tougher to solve. Probably needs both Decompiler work as well as a "retry" of using Decompiler capabilities to set the names.

We have internal tickets for both of these issues. Feel free to create a separate ticket for this second issue so we can track it better.

If/when we have something more to offer you, we will reply again. For the base class issue, you might try to set the PdbDeveloperMode launch option to true and then in the PDB Universal Analyzer, change the "Composite Layout Choice" from "Legacy" to "Complex with Simple Fallback." Some of the inherent issue have to do with information of child classes overlaying information of base classes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature: PDB Status: Triage Information is being gathered
Projects
None yet
Development

No branches or pull requests

2 participants