search

mandiant / GoReSym

Go symbol recovery tool
MIT License
503 stars 62 forks source link

fix Functions StartVA #6

Closed lanthora closed 2 years ago

lanthora commented 2 years ago

https://github.com/golang/go/commit/b38ab0ac5f78ac03a38052018ff629c03e36b864

stevemk14ebr commented 2 years ago

Thank you for identifying this issue! The upstream go patch seems to be intentional, since they say the PC embedded into the line table can't be trusted with their update to a new linker version. Looking at how I resolve the PC, I'm noticing that this patch they've done actually exposes a bug in the logic I created to find the section base. I incorrectly assumed the section base of the pclntab is what PC should be set to - but in reality they clearly want the text section base. A more correct fix for this would be to instead fix this logic here:

the secStart for each file format needs to be updated to use the text section - not the pclntab section. https://github.com/mandiant/GoReSym/blob/9d2d6c56809efa860b19f726ceb023740a4041d9/objfile/elf.go#L120

stevemk14ebr commented 2 years ago

I believe I've resolved this with https://github.com/mandiant/GoReSym/commit/8a8c5006e7162c058ca819cbf08cc0f24deaaa9e . Your help is very appreciated!