mandiant / GoReSym

Go symbol recovery tool
MIT License
498 stars 62 forks source link

parse field tag and interface method name #38

Closed virusdefender closed 9 months ago

virusdefender commented 10 months ago

fix https://github.com/mandiant/GoReSym/issues/37

the sample binary source code is

package main

import "fmt"

type interface1 interface {
    Interface1Method()
    interface1Method1(string, int) (string, error)
}

type ExampleStruct struct {
    StructField string `json:"StructFieldTag"`
}

type ExampleStruct1 struct {
    Data struct {
        StructField1 string `json:"StructFieldTag1"`
    } `json:"DataTag"`
}

func (e *ExampleStruct1) Interface1Method() {
    fmt.Println("Interface1Method")
}

func (e *ExampleStruct1) interface1Method1(string, int) (string, error) {
    fmt.Println("interface1Method1")
    return "", nil
}

func main() {
    fmt.Println(ExampleStruct{}, ExampleStruct1{})
    var i interface1
    i = &ExampleStruct1{}
    i.Interface1Method()
}

diff of this branch vs master

image

image

Note

-Reconstructed field is not valid golang code in many cases, so i add some hack to make it to valid format in common cases.

stevemk14ebr commented 9 months ago

It's fine to remove the type prefix

stevemk14ebr commented 9 months ago

You can re-open this, I am not convinced there is entirely correct. I see an unreference flag local in the 1.20 code path. And I see you are parsing out the 'flag' and comparing it to 3, but the rtype flags are already passed to the 'readRtypeName' function as an argument. And I also see adjustments to the name_len fields as mentioned in review, I don't believe this is correct