-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix cant found RET offset in gotls mode. fix #502. #512
Conversation
Fix the issue of not being able to fetch the function RET offset in the gotls model when building a Golang binary with pie mode. Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
is please use command : CGO_ENABLED=1 go build -buildmode=pie -o test main.go ps: |
It looks the same as before. I'm going to wait until this PR is complete before I run these tests, in order to understand what's changed in this PR. |
see PR #512 for more info . Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
reviewed.
see PR #512 for more info . Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
Fix the issue of not being able to fetch the function RET offset in the gotls model when building a Golang binary with pie mode.
GO_BUILDMODE="-buildmode=pie"
ref: https://github.com/docker/cli/blob/799bf5268039a92c9af197abd612b0f36cf9efe1/scripts/build/.variables#L75C13-L75C42
Here, a constant
IdaProOffset = 0x120
is used. I found through IDA static symbol analysis that the address ofcrypto/tls.(*Conn).Read
is46EE50
. The address calculated by the program is always0x120
less than this number. By analyzing multiple compiled programs, I found that the difference is always0x120
. Therefore, I defined a constant and added it to the address calculated by the program. However, I don't know the reason, if you know, please let me know.这里,使用了一个常量
IdaProOffset = 0x120
,我是通过IDA静态分析符号发现crypto/tls.(*Conn).Read
的地址是46EE50
,我用程序计算出来的总是比这个数字少了0x120
,通过分析其他多个编译的程序,发现差值总是0x120
,所以,我定义了一个常量,增加到程序计算的地址上。但是我不知道原因,如果你知道,请告诉我。