fix(labels): demangle the names a PE actually carries

NOTICE

@@ -0,0 +1,64 @@
+SMDA
+Copyright (c) 2018-2020, Daniel Plohmann and Steffen Enders
+
+This product is licensed under the BSD 2-Clause License; see LICENSE.
+
+It includes third-party code, listed below with the notices its license
+requires.
+
+================================================================================
+rust_demangler
+--------------------------------------------------------------------------------
+src/smda/common/labelprovider/rust_demangler/ is derived from the rust_demangler
+package by Team bi0s (https://github.com/teambi0s/rust_demangler), used under the
+MIT License and modified for use here.
+
+MIT License
+
+Copyright (c) 2021 Team bi0s
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+================================================================================
+Ghidra
+--------------------------------------------------------------------------------
+Parts of the same directory reimplement behaviour from Ghidra's Rust demanglers
+(https://github.com/NationalSecurityAgency/ghidra), specifically
+Ghidra/Features/Rust/src/main/java/ghidra/app/plugin/core/analysis/rust/demangler/
+RustDemanglerV0.java and RustDemanglerLegacy.java: the recursion bound in the v0
+demangler and the strict hash handling in the legacy demangler. Ghidra is
+licensed under the Apache License, Version 2.0, available at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Ghidra's own V0 demangler is a port of the rustc-demangle crate
+(https://github.com/rust-lang/rustc-demangle), dual-licensed Apache-2.0 OR MIT.
+
+================================================================================
+Tarjan's algorithm
+--------------------------------------------------------------------------------
+src/smda/common/Tarjan.py is based on the implementation by Bas Westerbaan
+(https://github.com/bwesterb/py-tarjan), refactored into a class for pooled
+computation.
+
+================================================================================
+Lengauer-Tarjan dominator tree
+--------------------------------------------------------------------------------
+src/smda/common/DominatorTree.py is based on the implementation by Armin Rigo
+(https://bitbucket.org/arigo/arigo/src/default/hack/pypy-hack/heapstats/dominator.py).

README.md

@@ -197,6 +197,7 @@ Thanks to Jonathan Crussell for helping me to beef up SMDA enough to make it a d
 Thanks to Willi Ballenthin for improving the handling of ELF files, including properly handling API usage!
 Thanks to Daniel Enders for his contributions to the parsing of the Golang function registry and label information!
 The project uses the implementation of Tarjan's Algorithm by Bas Westerbaan and the implementation of Lengauer-Tarjan's Algorithm for the DominatorTree by Armin Rigo.
+Rust symbol demangling is derived from the rust_demangler package by Team bi0s (MIT), with behaviour reimplemented from Ghidra's Rust demanglers (Apache-2.0); see [NOTICE](NOTICE) for the full list of third-party components.
 Thanks to r0ny123 for his major code quality improvements via ruff and various contributions for several aspects of this project!
 
 Pull requests welcome! :)

src/smda/common/labelprovider/PeSymbolProvider.py

@@ -7,6 +7,7 @@
 
 from .AbstractLabelProvider import AbstractLabelProvider
 from .import_parsers import parse_pe_delay_imports, parse_pe_imports, resolve_pe_base_addr
+from .ItaniumDemangler import demangle_itanium_symbol
 
 lief.logging.disable()
 LOGGER = logging.getLogger(__name__)
@@ -67,7 +68,7 @@ def parseExports(self, lief_binary, base_addr=None):
                 # UnicodeDecodeError: 'utf-32-le' codec can't decode bytes in position 0-3: code point not in range(0x110000)
                 function_name = function.name
             if function_name and all(ord(c) in range(0x20, 0x7F) for c in function_name):
-                function_symbols[active_base + function.address] = function_name
+                function_symbols[active_base + function.address] = demangle_itanium_symbol(function_name)
         return function_symbols
 
     def parseSymbols(self, lief_binary, base_addr=None):
@@ -94,7 +95,7 @@ def parseSymbols(self, lief_binary, base_addr=None):
                 if function_name and all(ord(c) in range(0x20, 0x7F) for c in function_name):
                     function_offset = active_base + sections[section_idx - 1].virtual_address + symbol.value
                     if function_offset not in function_symbols:
-                        function_symbols[function_offset] = function_name
+                        function_symbols[function_offset] = demangle_itanium_symbol(function_name)
         if num_candidates and not function_symbols:
             # the previous failure mode was silent: a whole corpus could be built unnamed
             # without anything complaining, so say so rather than contributing nothing

src/smda/common/labelprovider/RustSymbolProvider.py

@@ -11,7 +11,6 @@
 from .ElfSymbolProvider import is_defined_elf_symbol
 from .import_parsers import resolve_pe_base_addr
 from .rust_demangler import demangle
-from .rust_demangler.utils import remove_bad_spaces
 from .RustSymbolEvidence import RUST_DEMANGLE_ERRORS, is_rust_language_evidence
 
 LOGGER = logging.getLogger(__name__)
@@ -169,7 +168,6 @@ def _update_macho(self, lief_binary, binary_info):
                 try:
                     demangled = demangle(raw_name)
                     if demangled:
-                        demangled = remove_bad_spaces(demangled)
                         self._func_symbols[adjusted] = demangled
                 except _DEMANGLE_ERRORS as exc:
                     LOGGER.debug("Failed to demangle Rust symbol %s: %s", raw_name, exc)
@@ -194,20 +192,18 @@ def _update_pe(self, lief_binary, base_addr=None):
                 if self._is_rust_symbol(raw_name):
                     demangled = demangle(raw_name)
                     if demangled:
-                        demangled = remove_bad_spaces(demangled)
                         self._func_symbols[active_base + function.address] = demangled
             except _DEMANGLE_ERRORS as exc:
                 LOGGER.debug("Failed to demangle Rust symbol %s: %s", raw_name, exc)
 
         # working example: 3969e1a88a063155a6f61b0ca1ac33114c1a39151f3c7dd019084abd30553eab
         # Parse PE symbols (COFF) if available and LIEF extracted them
         # (Similar logic to PeSymbolProvider but focusing on Rust)
+        sections = list(lief_binary.sections)
         for symbol in lief_binary.symbols:
             # Check if it is a function symbol and has a section
             if hasattr(symbol.complex_type, "name") and symbol.complex_type.name == "FUNCTION":
-                if symbol.section is None:
-                    # section_idx 0/-1/-2 (undefined-external/absolute/debug): not a locally
-                    # defined function, its value is not a usable in-image offset.
+                if not 1 <= symbol.section_idx <= len(sections):
                     continue
                 raw_name = ""
                 try:
@@ -218,8 +214,9 @@ def _update_pe(self, lief_binary, base_addr=None):
                     if self._is_rust_symbol(raw_name):
                         demangled = demangle(raw_name)
                         if demangled:
-                            demangled = remove_bad_spaces(demangled)
-                            function_offset = active_base + symbol.section.virtual_address + symbol.value
+                            function_offset = (
+                                active_base + sections[symbol.section_idx - 1].virtual_address + symbol.value
+                            )
                             if function_offset not in self._func_symbols:
                                 self._func_symbols[function_offset] = demangled
                 except _DEMANGLE_ERRORS as exc:
@@ -239,23 +236,21 @@ def _parse_lief_symbols(self, symbols):
                     try:
                         demangled = demangle(raw_name)
                         if demangled:
-                            demangled = remove_bad_spaces(demangled)
                             function_symbols[symbol.value] = demangled
                     except _DEMANGLE_ERRORS as exc:
                         LOGGER.debug("Failed to demangle Rust symbol %s: %s", raw_name, exc)
         return function_symbols
 
     def _is_rust_symbol(self, name: str) -> bool:
-        """Check if a symbol name appears to be a Rust mangled symbol.
+        """Check whether a symbol name is a Rust mangled symbol.
 
-        Legacy Rust mangling uses _ZN prefix (compatible with C++ Itanium ABI).
-        Rust v0 mangling uses _R prefix.
-        Some platforms may use __ prefix variants.
-
-        Note: We intentionally exclude bare 'R' and 'ZN' prefixes as they are
-        too broad and could match non-Rust symbols.
+        The prefixes alone are not enough to decide: legacy Rust mangling shares _ZN with
+        the C++ Itanium ABI, and this provider is consulted before the format providers,
+        so claiming a C++ name here replaces a full Itanium signature with the degraded
+        spelling the Rust legacy demangler produces for it. The shared evidence gate parses
+        the name before answering, which is what tells the two apart.
         """
-        return name.startswith(("_ZN", "_R", "__ZN", "__R"))
+        return is_rust_language_evidence(name)
 
     def getSymbol(self, address):
         return self._func_symbols.get(address, "")

src/smda/common/labelprovider/rust_demangler/__init__.py

@@ -1,3 +1,7 @@
+"""Rust symbol demangling, derived from Team bi0s' rust_demangler (MIT) with
+behaviour reimplemented from Ghidra's Rust demanglers. See NOTICE.
+"""
+
 from .main import demangle
 
 __all__ = ["demangle"]

src/smda/common/labelprovider/rust_demangler/rust_legacy.py

@@ -146,7 +146,7 @@ def is_ascii_punctuation(self, c):
         return c in string.punctuation
 
     def is_rust_hash(self, s):
-        # Improved robustness based on Ghidra's rust-demangle.c
+        # Improved robustness based on Ghidra's RustDemanglerLegacy
         # Legacy Rust symbols end with a path segment that encodes a 16 hex digit hash,
         # prefixed with "17h", i.e. '17h[a-f0-9]{16}'.
         if len(s) == 19 and s.startswith("17h"):

src/smda/common/labelprovider/rust_demangler/rust_v0.py

@@ -490,7 +490,7 @@ def skip_const(self):
 
 
 class Printer:
-    # Based on Ghidra's rust-demangle.c, we limit recursion to prevent stack overflows
+    # Following Ghidra's RustDemanglerV0, we limit recursion to prevent stack overflows
     # or excessive resource usage on malformed inputs.
     # Must fire well below CPython's own recursion limit (default 1000), or a
     # self-referential backref chain raises RecursionError before this guard.
@@ -559,7 +559,7 @@ def f1():
             if abi:
                 self.out += 'extern "'
                 self.out += "-".join(abi.split("_"))
-                self.out += '"'
+                self.out += '" '
 
             self.out += "fn("
             self.print_sep_list("print_type", ", ")

tests/testPeSymbolProvider.py

@@ -11,6 +11,7 @@
 
 from smda.common.BinaryInfo import BinaryInfo
 from smda.common.labelprovider.PeSymbolProvider import PeSymbolProvider
+from smda.common.labelprovider.RustSymbolProvider import RustSymbolProvider
 from smda.common.labelprovider.WinApiResolver import WinApiResolver
 from smda.Disassembler import Disassembler
 from smda.SmdaConfig import SmdaConfig
@@ -436,6 +437,60 @@ def test_a_known_mingw_entry_point_is_named(self):
         self.assertIn("mainCRTStartup", names)
         self.assertIn("__tmainCRTStartup", names)
 
+    def test_rust_names_reach_the_report_demangled(self):
+        names = {f.function_name for f in self.report.getFunctions() if f.function_name}
+
+        # RustSymbolProvider resolved PE COFF symbols through Symbol.section, which lief
+        # never populates, so it contributed nothing and these arrived spelled "_RNv..."
+        self.assertEqual([name for name in names if name.startswith(("_R", "__R"))], [])
+        self.assertIn("std::rt::lang_start::<()>::{closure#0}", names)
+
+
+class TestPeCxxSymbolFixture(unittest.TestCase):
+    """A PE whose COFF symbol table carries Itanium C++ names.
+
+    None of the other bundled PEs has any: the Rust fixture's names are all Rust-mangled,
+    and the rest carry no symbol table at all. Built here rather than sampled - a small C++
+    translation unit compiled for x86_64-w64-mingw32 by g++ 16.2.0 at -O1 -g.
+    """
+
+    @classmethod
+    def setUpClass(cls):
+        fixture = os.path.join(os.path.dirname(os.path.abspath(__file__)), "cxx_pe_gnu_xored")
+        raw = Path(fixture).read_bytes()
+        binary = bytes(byte ^ (index % 256) for index, byte in enumerate(raw))
+        binary_info = BinaryInfo(binary)
+        binary_info.file_path = ""
+        binary_info.base_addr = 0x140000000
+        provider = PeSymbolProvider(None)
+        provider.update(binary_info)
+        cls.symbols = provider.getFunctionSymbols()
+
+    def _symbols(self):
+        return self.symbols
+
+    def test_itanium_cxx_names_are_demangled(self):
+        names = set(self._symbols().values())
+
+        self.assertEqual([name for name in names if name.startswith(("_Z", "__Z"))], [])
+        self.assertIn("demo::Widget::Widget()", names)
+        self.assertIn("demo::Widget::~Widget()", names)
+
+    def test_a_rust_name_would_be_left_to_the_rust_provider(self):
+        # the two providers partition the namespace: this one expands Itanium C++, and a
+        # name the Rust evidence gate claims is not its to rewrite
+        provider = RustSymbolProvider(None)
+
+        self.assertFalse(provider._is_rust_symbol("_ZN12FileExplorerC2Ev"))
+        self.assertTrue(provider._is_rust_symbol("_RNvC6_123foo3bar"))
+
+    def test_a_signature_with_arguments_is_expanded(self):
+        measure = [name for name in self._symbols().values() if "measure" in name]
+
+        self.assertEqual(len(measure), 1)
+        self.assertIn("demo::Widget::measure(", measure[0])
+        self.assertIn("double) const", measure[0])
+
 
 if __name__ == "__main__":
     unittest.main()