From 6a6c14f12a0cd9fce7f050ffd2eb7b43310e121f Mon Sep 17 00:00:00 2001 From: crimsonskylark <47747084+crimsonskylark@users.noreply.github.com> Date: Mon, 21 Oct 2024 22:02:18 -0300 Subject: [PATCH 1/3] feat: show exception handler function name if available (disabled by default) --- __init__.py | 30 ++++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-) diff --git a/__init__.py b/__init__.py index 5b134cf..787fa44 100644 --- a/__init__.py +++ b/__init__.py @@ -86,6 +86,11 @@ def __init__(self, bv: BinaryView, file: PE): header_layout = QHBoxLayout() + self.show_handler_name = QCheckBox() + handler_name_layout = QHBoxLayout() + handler_name_layout.addWidget(QLabel("Show handler name: ")) + handler_name_layout.addWidget(self.show_handler_name) + self.follow_cb = QCheckBox() follow_layout = QHBoxLayout() follow_layout.addWidget(QLabel("Follow Cursor: ")) @@ -97,6 +102,7 @@ def __init__(self, bv: BinaryView, file: PE): header_layout.addWidget(goto_button) header_layout.addStretch() + header_layout.addLayout(handler_name_layout) header_layout.addLayout(follow_layout) self.begin_addr = AddrLabel(None, bv) @@ -124,6 +130,7 @@ def __init__(self, bv: BinaryView, file: PE): self.unwind_codes = QTextEdit() self.unwind_codes.setReadOnly(True) self.unwind_exception_handler = AddrLabel(None, bv) + self.unwind_handler_name = QLabel("") title = QLabel("Unwind Info") title.setAlignment(QtCore.Qt.AlignCenter) @@ -141,9 +148,12 @@ def __init__(self, bv: BinaryView, file: PE): unwind_exception_handler_layout = QHBoxLayout() unwind_exception_handler_layout.addWidget( - QLabel("Exception Handler: ")) + QLabel("Exception Handler: ")) + unwind_exception_handler_layout.addWidget( + self.unwind_handler_name) unwind_exception_handler_layout.addWidget( self.unwind_exception_handler) + unwind_layout.addLayout(unwind_exception_handler_layout) unwind_prolog_size_layout = QHBoxLayout() @@ -212,6 +222,7 @@ def listItemClicked(self, clickedItem): self.unwind_frame_offset.clear() self.unwind_codes.clear() self.unwind_exception_handler.clear() + self.unwind_handler_name.clear() else: self.begin_addr.setAddr( self.file.OPTIONAL_HEADER.ImageBase + clickedItem.entry.struct.BeginAddress) @@ -222,7 +233,6 @@ def listItemClicked(self, clickedItem): self.unwind_version.setText(str(clickedItem.entry.unwindinfo.Version)) - unwind_flags = [] if clickedItem.entry.unwindinfo.Flags == 0: unwind_flags.append("UNW_FLAG_NHANDLER") @@ -254,9 +264,21 @@ def listItemClicked(self, clickedItem): codes += str(x) + '\n' self.unwind_codes.setText(codes) + self.unwind_handler_name.setHidden(not self.show_handler_name.isChecked()) + self.unwind_exception_handler.setHidden(self.unwind_handler_name.isVisible()) + + self.adjustSize() + if hasattr(clickedItem.entry.unwindinfo, 'ExceptionHandler'): - self.unwind_exception_handler.setAddr( - self.file.OPTIONAL_HEADER.ImageBase + clickedItem.entry.unwindinfo.ExceptionHandler) + handler_addr = self.file.OPTIONAL_HEADER.ImageBase + clickedItem.entry.unwindinfo.ExceptionHandler + + if self.unwind_handler_name.isHidden(): + self.unwind_exception_handler.setAddr( + handler_addr) + else: + symbol = self.bv.get_symbol_at(handler_addr) + if all([symbol, symbol.name, not symbol.name.startswith("sub_")]): + self.unwind_handler_name.setText(f"{symbol.name} @ 0x{handler_addr:x}") else: self.unwind_exception_handler.clear() From c53ed8c8c0fcef0de3ac888e0e99830ebc643a0a Mon Sep 17 00:00:00 2001 From: crimsonskylark <47747084+crimsonskylark@users.noreply.github.com> Date: Tue, 22 Oct 2024 09:09:41 -0300 Subject: [PATCH 2/3] fix: properly clean up label when no exception handler is available --- __init__.py | 1 + 1 file changed, 1 insertion(+) diff --git a/__init__.py b/__init__.py index 787fa44..5d1d326 100644 --- a/__init__.py +++ b/__init__.py @@ -280,6 +280,7 @@ def listItemClicked(self, clickedItem): if all([symbol, symbol.name, not symbol.name.startswith("sub_")]): self.unwind_handler_name.setText(f"{symbol.name} @ 0x{handler_addr:x}") else: + self.unwind_handler_name.clear() self.unwind_exception_handler.clear() @staticmethod From a0e4f7e851c682fa31c5c687cecd84b8c76b723b Mon Sep 17 00:00:00 2001 From: crimsonskylark <47747084+crimsonskylark@users.noreply.github.com> Date: Tue, 22 Oct 2024 14:21:11 -0300 Subject: [PATCH 3/3] ensure consistent behaviour with the default by using the same label type --- __init__.py | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/__init__.py b/__init__.py index 5d1d326..006d547 100644 --- a/__init__.py +++ b/__init__.py @@ -6,7 +6,6 @@ from PySide6.QtWidgets import QHBoxLayout, QVBoxLayout, QLabel, QWidget, QListWidget, QListWidgetItem, QTextEdit, QCheckBox, QPushButton from PySide6.QtGui import QMouseEvent - class SEHListItem(QListWidgetItem): def __init__(self, base: int, entry: ExceptionsDirEntryData): self.entry = entry @@ -130,7 +129,7 @@ def __init__(self, bv: BinaryView, file: PE): self.unwind_codes = QTextEdit() self.unwind_codes.setReadOnly(True) self.unwind_exception_handler = AddrLabel(None, bv) - self.unwind_handler_name = QLabel("") + self.unwind_handler_name = AddrLabel(None, bv) title = QLabel("Unwind Info") title.setAlignment(QtCore.Qt.AlignCenter) @@ -214,6 +213,7 @@ def listItemClicked(self, clickedItem): self.begin_addr.setAddr(None) self.end_addr.setAddr(None) self.unwind_addr.setAddr(None) + self.unwind_handler_name.setAddr(None) self.unwind_version.clear() self.unwind_flags.clear() self.unwind_prolog_size.clear() @@ -222,7 +222,6 @@ def listItemClicked(self, clickedItem): self.unwind_frame_offset.clear() self.unwind_codes.clear() self.unwind_exception_handler.clear() - self.unwind_handler_name.clear() else: self.begin_addr.setAddr( self.file.OPTIONAL_HEADER.ImageBase + clickedItem.entry.struct.BeginAddress) @@ -271,14 +270,16 @@ def listItemClicked(self, clickedItem): if hasattr(clickedItem.entry.unwindinfo, 'ExceptionHandler'): handler_addr = self.file.OPTIONAL_HEADER.ImageBase + clickedItem.entry.unwindinfo.ExceptionHandler - - if self.unwind_handler_name.isHidden(): + symbol = self.bv.get_symbol_at(handler_addr) + + if self.unwind_handler_name.isHidden() or symbol.name.startswith("sub_"): self.unwind_exception_handler.setAddr( handler_addr) else: - symbol = self.bv.get_symbol_at(handler_addr) - if all([symbol, symbol.name, not symbol.name.startswith("sub_")]): - self.unwind_handler_name.setText(f"{symbol.name} @ 0x{handler_addr:x}") + if all([symbol, symbol.name]): + self.unwind_handler_name.setOptText( + f"{symbol.name} @ ") + self.unwind_handler_name.setAddr(handler_addr) else: self.unwind_handler_name.clear() self.unwind_exception_handler.clear()