mandiant / GoReSym

Go symbol recovery tool
MIT License
560 stars 64 forks source link

Scan Failure when moduledata not found #50

Closed stevemk14ebr closed 7 months ago

stevemk14ebr commented 7 months ago

For file 0e24a1268212a790bc3993750f194ac1e0996a6770b32b498341f06abac45d81 ELF moduledata location fails. The pclntab is found successfully but the moduledata is not. When we go to scan to find the moduledata the pclntab VA bytes of 80 7f AA 00 are searched for. At 0x9caf0 an erroneous match is found and we choose this as our best moduledata candidate - breaking everything. Instead we should have found 0xCF9C80 which is the correct occurence of the VA bytes.

patching in ignorelist = append(ignorelist, 0x9caf0) at line 282 in obfile.go fixes this temporarily as a hot patch

Update the moduledata ignorelist logic to account for this situation better