[Fix] get textStart from pclnTable

[wlingze]

fixup: #512
details： wlingze#2， #514

[sancppp]

I did a simple test of v0.7.6 and PR#516 in an x64 Ubuntu 22.04 environment.

The test was to execute the command sudo . /bin/ecapture gotls --elfpath=/usr/bin/dockerd --hex while executing docker login in another terminal.

The result shows that eCapture was able to correctly find the crypto/tls.(*Conn).Read symbol entry, but was unable to locate the RET command:

At the same time, docker login returns a connect error:

[cfc4n]

I think the connect error issue probably has nothing to do with the hook position. The hook here is looking for the RET instruction to hook, so it shouldn't affect network communication. There must be another reason, maybe it's just a sporadic network failure.

[cfc4n]

LGTM, thanks.

[sancppp]

I think the connect error issue probably has nothing to do with the hook position. The hook here is looking for the RET instruction to hook, so it shouldn't affect network communication. There must be another reason, maybe it's just a sporadic network failure.

It looks like eCpture is indeed affecting docker's network communication.

Normally docker login should return Error response from daemon: Get "https://registry-1.docker.io/v2/": unauthorized: incorrect username or password, however eCapture intervenes and returns an EOF error, while docker pull also returns an EOF error.

The test is relatively simple. I'm not sure if eCapture hooking other golang projects (buildmode=pie) would cause the same thing.