Open oxeye-shawn opened 3 months ago
What arch is the go binary compiled for? Could you show the storage that was assigned to the return value of the main.(*BashRunner).Run()
function?
Also, does changing the type of local_58 to main.BashRunner
help?
Describe the bug While attempting to analyze Ghidra analysis for Golang binaries, a discrepancy was encountered regarding the getDef() function for receiver methods. The following code snippet was analyzed:
After analysis, the decompiled output of Ghidra was examined up to the bashRunner.Run() call:
Issue with Analysis:
Upon using the API call to trace the function call, the obtained Pcode was:
Subsequently, performing getDef() on the unique identifier led to:
Continuing to trace the definition, the next Pcode encountered was:
This up tracing sequence led to a dead end due to the need for a definition for the register 0x20. Furthermore, its descendants did not lead to the desired variable local_58, hindering the analysis process. Consequently, understanding the program flow and security risks related to using local_58 within the function call context became challenging.
Expected behavior When tracing up the definition of the receiver method, the expectation is to arrive at the point of local_58 creation. By examining its descendants, the aim is to reach the line where local_58._08 = cmd.str; is defined.
Environment (please complete the following information):