mandiant / GoReSym

Go symbol recovery tool
MIT License
498 stars 62 forks source link

Start function type work #41

Open stevemk14ebr opened 9 months ago

stevemk14ebr commented 9 months ago
stevemk14ebr commented 8 months ago

Importing the structures is a challenge. Both techniques of sourcing symbols, moduledata types and source code are lossy, missing some different subsets. Need to implement recursive field checks to import types from source in the correct order. Additionally need to add a technique that replaces unknown pointer types (and family) with void* when underlying type is still missing from any source

stevemk14ebr commented 1 month ago

I'm reconsidering this approach entirely. This is quite hard to import types reliably across versions. It's probably better to create an interactive fuzzy search IDA plugin that uses the data from https://gist.github.com/stevemk14ebr/bc81085dfebfd4f6ea39e1dec4370663 instead