Package ghidra.app.util.bin.format.golang.rtti

Class GoPcHeader

java.lang.Object
ghidra.app.util.bin.format.golang.rtti.GoPcHeader
public class GoPcHeader extends Object
A low-level structure embedded in golang binaries that contains useful bootstrapping information.

  • Field Details

  • Constructor Details

    • GoPcHeader

      public GoPcHeader()

  • Method Details

    • getPclntabAddress

      public static Address getPclntabAddress(Program program)
      Returns the Address (if present) of the go pclntab section or symbol.
      Parameters:
      program - Program
      Returns:
      Address of go pclntab, or null if not present

    • hasPclntab

      public static boolean hasPclntab(Program program)
      Returns true if the specified program has an easily found pclntab
      Parameters:
      program - Program
      Returns:
      boolean true if program has a pclntab, false otherwise

    • findPclntabAddress

      public static Address findPclntabAddress(GoRttiMapper programContext, AddressRange range, TaskMonitor monitor) throws IOException
      Searches (possibly slowly) for a pclntab structure in the specified memory range, which is typically necessary in stripped PE binaries.
      Parameters:
      programContext - GoRttiMapper
      range - memory range to search (typically .rdata or .noptrdata sections)
      monitor - TaskMonitor that will let the user cancel
      Returns:
      Address of the found pclntab structure, or null if not found
      Throws:
      IOException - if error reading

    • isPclntab

      public static boolean isPclntab(ByteProvider provider) throws IOException
      Returns true if there is a pclntab at the current position of the specified ByteProvider.
      Parameters:
      provider - ByteProvider
      Returns:
      boolean true if the byte provider has the magic signature of a pclntab
      Throws:
      IOException - if error reading

    • getGoVersion

      public GoVer getGoVersion()

    • hasTextStart

      public boolean hasTextStart()
      Returns true if this pcln structure contains a textStart value (only present >= 1.18)
      Returns:

    • getTextStart

      public Address getTextStart()
      Returns the address of where the text area starts.
      Returns:
      address of text starts

    • getFuncnameAddress

      public Address getFuncnameAddress()
      Returns address of the func name slice
      Returns:
      address of func name slice

    • getCuAddress

      public Address getCuAddress()
      Returns address of the cu tab slice, used by the cuOffset field's markup annotation.
      Returns:
      address of the cu tab slice

    • getFiletabAddress

      public Address getFiletabAddress()
      Returns the address of the filetab slice, used by the filetabOffset field's markup annotation
      Returns:
      address of the filetab slice

    • getPctabAddress

      public Address getPctabAddress()
      Returns the address of the pctab slice, used by the pctabOffset field's markup annotation
      Returns:
      address of the pctab slice

    • getPclnAddress

      public Address getPclnAddress()
      Returns the address of the pcln slice, used by the pclnOffset field's markup annotation
      Returns:
      address of the pcln slice

    • getMinLC

      public byte getMinLC()
      Returns the min lc, used as the GoPcValueEvaluator's pcquantum
      Returns:
      minLc

    • getPtrSize

      public byte getPtrSize()
      Returns the pointer size
      Returns:
      pointer size