mandiant / GoReSym

Go symbol recovery tool
MIT License
503 stars 62 forks source link

go1.18 VA is wrong #3

Closed StarrySai closed 2 years ago

StarrySai commented 2 years ago

Hello,

  1. I use GoReSym generate xx.json
  2. then use goresym_rename.py rename functions in IDA
  3. Found that nothing has changed
  4. finally, Find out that VA in xx.json is wrong
  5. binary file link: https://ufile.io/edydans9

How to correctly modify the VA address?

Thank you so much.

stevemk14ebr commented 2 years ago

What was the issue?

lanthora commented 2 years ago

@stevemk14ebr

https://github.com/golang/go/commit/b38ab0ac5f78ac03a38052018ff629c03e36b864

lanthora commented 2 years ago

@stevemk14ebr

diff --git a/debug/gosym/pclntab.go b/debug/gosym/pclntab.go
index c702d42..b3b3003 100644
--- a/debug/gosym/pclntab.go
+++ b/debug/gosym/pclntab.go
@@ -74,7 +74,7 @@ type LineTable struct {
    Binary      binary.ByteOrder
    Quantum     uint32
    Ptrsize     uint32
-   textStart   uint64 // address of runtime.text symbol (1.18+)
+   textStart   uintptr // address of runtime.text symbol (1.18+)
    funcnametab []byte
    cutab       []byte
    funcdata    []byte
@@ -269,7 +269,7 @@ func (t *LineTable) parsePclnTab() {
    case ver118:
        t.nfunctab = uint32(offset(0))
        t.nfiletab = uint32(offset(1))
-       t.textStart = t.PC // use the start PC instead of reading from the table, which may be unrelocated
+       t.textStart = uintptr(offset(2))
        t.funcnametab = data(3)
        t.cutab = data(4)
        t.filetab = data(5)
@@ -422,7 +422,7 @@ func (f funcTab) Count() int {
 func (f funcTab) pc(i int) uint64 {
    u := f.uint(f.functab[2*i*f.sz:])
    if f.Version >= ver118 {
-       u += f.textStart
+       u += uint64(f.textStart)
    }
    return u
 }
@@ -464,7 +464,7 @@ func (f *funcData) entryPC() uint64 {
    if f.t.Version >= ver118 {
        // TODO: support multiple text sections.
        // See runtime/symtab.go:(*moduledata).textAddr.
-       return uint64(f.t.Binary.Uint32(f.data)) + f.t.textStart
+       return uint64(f.t.Binary.Uint32(f.data)) + uint64(f.t.textStart)
    }
    return f.t.uintptr(f.data)
 }