search

mandiant / GoReSym

Go symbol recovery tool
MIT License
498 stars 62 forks source link

Optimize Text VA Search #13

Closed stevemk14ebr closed 11 months ago

stevemk14ebr commented 1 year ago

We currently use the pclntab magic to find the pclntab, then use that VA to locate the moduledata. Once we have the moduledata, we read the .text base from a member of that table and re-parse all pclntab candidates with this correct VA. This is slow.

To fix:

  1. Verify pclntab scan is stable with incorrect .text sections (should be). We heavily rely on a correct pclntab VA now.
  2. Prune the candidate set so that any pclntab candidate with a SecStart != moduledata.text is removed.
  3. Reparse the candidates left
  4. Pick first valid candidate satisfying all of these. In practice, should only have one left.
stevemk14ebr commented 11 months ago

done :)