Closed virusdefender closed 9 months ago
It's fine to remove the type prefix
You can re-open this, I am not convinced there is entirely correct. I see an unreference flag local in the 1.20 code path. And I see you are parsing out the 'flag' and comparing it to 3, but the rtype flags are already passed to the 'readRtypeName' function as an argument. And I also see adjustments to the name_len fields as mentioned in review, I don't believe this is correct
fix https://github.com/mandiant/GoReSym/issues/37
the sample binary source code is
diff of this branch vs master
Note
-
Reconstructed
field is not valid golang code in many cases, so i add some hack to make it to valid format in common cases.