Skip to content

[Fix] GoTLS function offset #2

Closed
wlingze wants to merge 2 commits into
masterfrom
fix/gotls_function_offset
Closed

[Fix] GoTLS function offset #2
wlingze wants to merge 2 commits into
masterfrom
fix/gotls_function_offset

Conversation

@wlingze
Copy link
Copy Markdown
Owner

@wlingze wlingze commented Apr 2, 2024

No description provided.

@wlingze
Copy link
Copy Markdown
Owner Author

wlingze commented Apr 3, 2024

I have created some test cases for the docker arm64 binary file, See #2 for details.
When i use IdaPro, readelf or simplely retrieve all symbols from *elf.File, it works and I obtain the correct address.
When I use *gosym.Table, the address is incorrect. address = 0x00635cb0
Also, when *gosym.Table is built, the data contains errors.

you can set a condition breakpoint in /usr/lib/go/src/debug/gosym/pclntab.go at line 308 with i==6626, where the *gosym.Func is built.

And I used go-parser with IdaPro, which shows that gopclntab contains incorrect data.

in this address: data(0x238980) + .textbase(0x3fd1e0) = 0x00635cb0
image

There's another thing:
I've previously built some simple binary files for testing, see #1, and they run well after removing the IdaProOffset.

So debug/gosym get wrong address, because binary file gopclntable data wrong or need other calculate.

debug/gosym get wrong, but go-parser get correct data.

in go-parser use this text-start:
image
in debug/gosym use this text-start:
image

@wlingze
Copy link
Copy Markdown
Owner Author

wlingze commented Apr 3, 2024

why this f.textStart error?

this f.textStart data from here:
/usr/lib/go/src/debug/gosym/pclntab.go:258
image
and this t.PC come from NewLineTable, in code ~/ecapture/user/config/config_gotls.go:333.

in other side, go-parser get this textStart data from pclntbl table.

rootcause:

debug/gosym use PC passed by call NewLineTable for textStart.
But this textStart should get from pclntable.

The relevant code changed by go pr 366695

solution:

  1. use symbols from *elf.File like nopie case, you can get correct address. (Checked)
  2. use symbols get runtime.text address, pass to NewLineTable, like go pr 366695 (NoChecked)

@wlingze wlingze force-pushed the fix/gotls_function_offset branch from f28fec1 to 1216376 Compare April 3, 2024 12:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant