goretk / redress

Redress - A tool for analyzing stripped Go binaries
GNU Affero General Public License v3.0
907 stars 58 forks source link

Add text section correction factor #29

Closed TcM1911 closed 1 year ago

TcM1911 commented 1 year ago

Some compilers add code at the beginning of the text section. The go runtime and its internal structures are not aware of this because their start of the text section is different from the values in the PE header. This commit adds code that compares the value in the PE header to the value stored in the module data structure. If the values are different a correction factor is calculated. This correction factor is applied to the function addresses when the r2 command for defining function is executed.

In most cases, this factor will be 0, resulting in no change.