Skip to content

Owned Functions

hedgeberg edited this page May 18, 2022 · 1 revision

In order to minimize the number of footguns that reverse engineers using OOUtils are exposed to, OOUtils differentiates between "Owned" functions and "Ownerless" functions. An "Owned" function is any function within a Ghidra class namespace, which is to say that the function is owned by that class and is therefore safe to make certain assumptions about.

Currently, this concept really only matters for the purpose of auto-vtable population. When a class vtable is created with OOUtils, OOUtils will attempt to determine if the functions referenced in each of the vtable slots can be marked as owned and added to the class namespace. The algorithm for determination is simple: "is there 1, and only 1, data memory reference to the function in question?". If the answer is yes, then we can assume that the only vtable that points to this function is the one currently being analyzed by OOUtils, and the function can be assumed to be owned by the class.

There are some obvious issues with this heuristic. First and foremost, it assumes that all vtables, or at least all pointers in those vtables, have been discovered and converted to pointers by ghidra, and an associated reference has been created. Unfortunately, at this time, I can't think of a way to do this that doesn't involve making at least that assumption.

TODO: -Compose a method in VFuncImpl for determining if the ownership of a given virtual func is now somehow suspect. This can be leveraged when a UI is implemented to warn users about functions that are potentially mis-marked in terms of their ownership.

Clone this wiki locally