Package ghidra.app.util.bin.format.golang.rtti

Class GoRttiMapper

java.lang.Object

ghidra.app.util.bin.format.golang.structmapping.DataTypeMapper

ghidra.app.util.bin.format.golang.rtti.GoRttiMapper

All Implemented Interfaces:

AutoCloseable

public class GoRttiMapper
extends DataTypeMapper

DataTypeMapper for golang binaries.

When bootstrapping golang binaries, the following steps are used:

• Find the GoBuildInfo struct. This struct is the easiest to locate, even when the binary is stripped. This gives us the go pointerSize (probably same as ghidra pointer size) and the goVersion. This struct does not rely on StructureMapping, allowing its use before a DataTypeMapper is created.
• Create DataTypeMapper
• Find the runtime.firstmoduledata structure.
  • If there are symbols, just use the symbol or named memory block.
  • If stripped:
    • Find the pclntab. This has a magic signature, a pointerSize, and references to a couple of tables that are also referenced in the moduledata structure.
    • Search memory for a pointer to the pclntab struct. This should be the first field of the moduledata structure. The values that are duplicated between the two structures can be compared to ensure validity.
    • Different binary formats (Elf vs PE) will determine which memory blocks to search.

Field Summary

Fields inherited from class ghidra.app.util.bin.format.golang.structmapping.DataTypeMapper

archiveDTM, archiveSearchCPs, mappingInfo, markedupStructs, markupTaskMonitor, program, programDTM, programSearchCPs

Constructor Summary

Constructors

Constructor	Description
GoRttiMapper(Program program, int ptrSize, Endian endian, GoVer goVersion, ResourceFile archiveGDT)

Method Summary

Modifier and Type	Method	Description
void	addModule(GoModuledata module)
void	cacheRecoveredDataType(GoType typ, DataType dt)
protected BinaryReader	createProgramReader()
void	discoverGoTypes(TaskMonitor monitor)
void	exportTypesToGDT(File gdtFile, TaskMonitor monitor)	Export the currently registered struct mapping types to a gdt file.
GoModuledata	findContainingModule(long offset)
GoModuledata	findContainingModuleByFuncData(long offset)
static ResourceFile	findGolangBootstrapGDT(GoVer goVer, int ptrSize, String osName)	Searches for a golang bootstrap gdt file that matches the specified Go version/size/OS.
GoType	findGoType(String typeName)
DataType	getCachedRecoveredDataType(GoType typ)
GoType	getChanGoType()
CategoryPath	getDefaultVariableLengthStructCategoryPath()
GoModuledata	getFirstModule()
static String	getGDTFilename(GoVer goVer, int pointerSizeInBytes, String osName)
Structure	getGenericSliceDT()
<T extends DataType> T	getGhidraDataType(String goTypeName, Class<T> clazz)
static String	getGolangOSString(Program program)
GoVer	getGolangVersion()
GoName	getGoName(long offset)
GoType	getGoType(long offset)
GoType	getGoType(Address addr)
DataType	getInt32DT()
GoType	getMapGoType()
static GoRttiMapper	getMapperFor(Program program, MessageLog log)	Returns a new GoRttiMapper for the specified program, or null if the binary is not a supported golang binary.
int	getPtrSize()
DataType	getRecoveredType(GoType typ)
CategoryPath	getRecoveredTypesCp()
DataType	getUint32DT()
DataType	getUintptrDT()
void	recoverDataTypes(TaskMonitor monitor)	Converts all discovered golang rtti type records to Ghidra data types, placing them in the program's DTM in /golang-recovered
GoName	resolveNameOff(long ptrInModule, long off)
Address	resolveTextOff(long ptrInModule, long off)
GoType	resolveTypeOff(long ptrInModule, long off)

Methods inherited from class ghidra.app.util.bin.format.golang.structmapping.DataTypeMapper

addArchiveSearchCategoryPath, addProgramSearchCategoryPath, close, findType, getCodeAddress, getDataAddress, getDataConverter, getDTM, getExistingStructureAddress, getExistingStructureContext, getProgram, getReader, getStructureDataType, getStructureDataTypeName, getStructureMappingInfo, getStructureMappingInfo, getType, getTypeOrDefault, labelAddress, labelStructure, markup, markupAddress, markupAddress, markupAddressIfUndefined, readStructure, readStructure, readStructure, registerStructure, registerStructures, setMarkupTaskMonitor, toString

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Details

GoRttiMapper

public GoRttiMapper(Program program,
 int ptrSize,
 Endian endian,
 GoVer goVersion,
 ResourceFile archiveGDT)
             throws IOException

Throws:

IOException

Method Details

getMapperFor

public static GoRttiMapper getMapperFor(Program program,
 MessageLog log)
                                 throws IOException

Returns a new GoRttiMapper for the specified program, or null if the binary is not a supported golang binary.

Parameters:

program - Program

log -

Returns:

new GoRttiMapper, or null if not a golang binary

Throws:

IOException

getGDTFilename

public static String getGDTFilename(GoVer goVer,
 int pointerSizeInBytes,
 String osName)

getGolangOSString

public static String getGolangOSString(Program program)

findGolangBootstrapGDT

public static ResourceFile findGolangBootstrapGDT(GoVer goVer,
 int ptrSize,
 String osName)

Searches for a golang bootstrap gdt file that matches the specified Go version/size/OS.

First looks for a gdt with an exact match, then for a gdt with version/size match and "any" OS, and finally, a gdt that matches the version and "any" size and "any" OS.

Parameters:

goVer - version of Go

ptrSize - size of pointers

osName - name of OS

Returns:

getGolangVersion

public GoVer getGolangVersion()

getFirstModule

public GoModuledata getFirstModule()

addModule

public void addModule(GoModuledata module)

findContainingModule

public GoModuledata findContainingModule(long offset)

findContainingModuleByFuncData

public GoModuledata findContainingModuleByFuncData(long offset)

getDefaultVariableLengthStructCategoryPath

public CategoryPath getDefaultVariableLengthStructCategoryPath()

Overrides:

getDefaultVariableLengthStructCategoryPath in class DataTypeMapper

getUintptrDT

public DataType getUintptrDT()

getInt32DT

public DataType getInt32DT()

getUint32DT

public DataType getUint32DT()

getGenericSliceDT

public Structure getGenericSliceDT()

getMapGoType

public GoType getMapGoType()

getChanGoType

public GoType getChanGoType()

createProgramReader

protected BinaryReader createProgramReader()

Overrides:

createProgramReader in class DataTypeMapper

getPtrSize

public int getPtrSize()

resolveNameOff

public GoName resolveNameOff(long ptrInModule,
 long off)
                      throws IOException

Throws:

IOException

getGoName

public GoName getGoName(long offset)
                 throws IOException

Throws:

IOException

resolveTypeOff

public GoType resolveTypeOff(long ptrInModule,
 long off)
                      throws IOException

Throws:

IOException

getGoType

public GoType getGoType(long offset)
                 throws IOException

Throws:

IOException

getGoType

public GoType getGoType(Address addr)
                 throws IOException

Throws:

IOException

findGoType

public GoType findGoType(String typeName)

getGhidraDataType

public <T extends DataType> T getGhidraDataType(String goTypeName,
 Class<T> clazz)

resolveTextOff

public Address resolveTextOff(long ptrInModule,
 long off)

exportTypesToGDT

public void exportTypesToGDT(File gdtFile,
 TaskMonitor monitor)
                      throws IOException

Export the currently registered struct mapping types to a gdt file.

The struct data types will either be from the current program's DWARF data, or from an earlier golang.gdt (if this binary doesn't have DWARF)

Parameters:

gdtFile -

Throws:

IOException

getRecoveredTypesCp

public CategoryPath getRecoveredTypesCp()

getRecoveredType

public DataType getRecoveredType(GoType typ)
                          throws IOException

Throws:

IOException

cacheRecoveredDataType

public void cacheRecoveredDataType(GoType typ,
 DataType dt)
                            throws IOException

Throws:

IOException

getCachedRecoveredDataType

public DataType getCachedRecoveredDataType(GoType typ)
                                    throws IOException

Throws:

IOException

recoverDataTypes

public void recoverDataTypes(TaskMonitor monitor)
                      throws IOException,
CancelledException

Converts all discovered golang rtti type records to Ghidra data types, placing them in the program's DTM in /golang-recovered

Throws:

IOException

CancelledException

discoverGoTypes

public void discoverGoTypes(TaskMonitor monitor)
                     throws IOException,
CancelledException

Throws:

IOException

CancelledException