sei-eschwartz

@lmichaelis It is not done, but I have a branch where I've been working on this. I've been able to run through the binary and get some results. Please take...

Thanks, I'll look into this. Definitely sounds like it merged way too many methods into zSTRING.

`finalClass(0x7f56ec, 0x7f56ec, 0x920, 0x920, 0x599de0, [0x402cd0, 0x41daf0, 0x460a00, 0x46bc00, 0x46c090, 0x46c190, 0x46c290, 0x46c390, 0x46c4e0, 0x46ded0, 0x46e010, 0x4804b0, 0x4804f0, 0x488fe0, 0x489590, 0x4897d0, 0x49cdb0, 0x4d1740, 0x4e4b30, 0x4f7130, 0x517b30, 0x5783f0, 0x593d30, 0x593ee0, 0x599de0,...

I added a new rule that is very simple. It says that if a method install the same VFTable at two offsets, then the VFTable's object is contained at both...

It seems to help on quite a few of those methods, but not all. 0x74d8c0 is the first example I've seen that the new rule does not apply to.

I think there are two concerns here. * All constructors on a class are named the same. Is this a bug? What does Ghidra do for overloaded functions? * Are...

Thanks. I'll let you know if we need the prolog log, but probably not. Sent from Workspace ONE Boxer On Jul 19, 2020 11:11 AM, Jan Beck wrote: Same exe...

I am looking at this some more. According to OOAnalyzer, 0x8b02e8 is a VFTable, which is then used as a class identifier. @janbbeck Just to clarify, is your complaint that...

Here is why the VFTable is not set correctly: ``` 2020-06-11 10:44:55 WARN (OOAnalyzer) Could not create virtual function table at 0x008b02e8: ghidra.program.model.util.CodeUnitInsertionException: Conflicting data exists at address 008b02ec to...

Ah, we remove any data at the start of the vftable. But don't remove data "inside" the vftable.