Class GoPcHeader
java.lang.Object
ghidra.app.util.bin.format.golang.rtti.GoPcHeader
A low-level structure embedded in golang binaries that contains useful bootstrapping
information.
Introduced in golang 1.16
-
Field Summary
-
Constructor Summary
-
Method Summary
Modifier and TypeMethodDescriptionstatic Structure
static Address
findPcHeaderAddress
(GoRttiMapper programContext, AddressRange range, TaskMonitor monitor) Searches (possibly slowly) for a pclntab/pcHeader structure in the specified memory range, which is typically necessary in stripped PE binaries.Returns address of the cu tab slice, used by the cuOffset field's markup annotation.Returns the address of the filetab slice, used by the filetabOffset field's markup annotationReturns address of the func name slicebyte
getMinLC()
Returns the min lc, used as the GoPcValueEvaluator's pcquantumstatic Address
getPcHeaderAddress
(Program program) Returns theAddress
(if present) of the go pclntab section or symbol.Returns the address of the pcln slice, used by the pclnOffset field's markup annotationReturns the address of the pctab slice, used by the pctabOffset field's markup annotationbyte
Returns the pointer sizeReturns the address of where the text area starts.static boolean
hasPcHeader
(Program program) Returns true if the specified program has an easily found pclntab w/pcHeaderboolean
Returns true if this pcln structure contains a textStart value (only present >= 1.18)static boolean
isPcHeader
(ByteProvider provider) Returns true if there is a pclntab at the current position of the specified ByteProvider.
-
Field Details
-
GO_STRUCTURE_NAME
- See Also:
-
GOPCLNTAB_SECTION_NAME
- See Also:
-
GO_1_2_MAGIC
public static final int GO_1_2_MAGIC- See Also:
-
GO_1_16_MAGIC
public static final int GO_1_16_MAGIC- See Also:
-
GO_1_18_MAGIC
public static final int GO_1_18_MAGIC- See Also:
-
-
Constructor Details
-
GoPcHeader
public GoPcHeader()
-
-
Method Details
-
getPcHeaderAddress
Returns theAddress
(if present) of the go pclntab section or symbol. -
hasPcHeader
Returns true if the specified program has an easily found pclntab w/pcHeader- Parameters:
program
-Program
- Returns:
- boolean true if program has a pclntab, false otherwise
-
findPcHeaderAddress
public static Address findPcHeaderAddress(GoRttiMapper programContext, AddressRange range, TaskMonitor monitor) throws IOException Searches (possibly slowly) for a pclntab/pcHeader structure in the specified memory range, which is typically necessary in stripped PE binaries.- Parameters:
programContext
-GoRttiMapper
range
- memory range to search (typically .rdata or .noptrdata sections)monitor
-TaskMonitor
that will let the user cancel- Returns:
Address
of the found pcHeader structure, or null if not found- Throws:
IOException
- if error reading
-
isPcHeader
Returns true if there is a pclntab at the current position of the specified ByteProvider.- Parameters:
provider
-ByteProvider
- Returns:
- boolean true if the byte provider has the magic signature of a pclntab
- Throws:
IOException
- if error reading
-
createArtificialGoPcHeaderStructure
-
getGoVersion
-
hasTextStart
public boolean hasTextStart()Returns true if this pcln structure contains a textStart value (only present >= 1.18)- Returns:
-
getTextStart
Returns the address of where the text area starts.- Returns:
- address of text starts
-
getFuncnameAddress
Returns address of the func name slice- Returns:
- address of func name slice
-
getCuAddress
Returns address of the cu tab slice, used by the cuOffset field's markup annotation.- Returns:
- address of the cu tab slice
-
getFiletabAddress
Returns the address of the filetab slice, used by the filetabOffset field's markup annotation- Returns:
- address of the filetab slice
-
getPctabAddress
Returns the address of the pctab slice, used by the pctabOffset field's markup annotation- Returns:
- address of the pctab slice
-
getPclnAddress
Returns the address of the pcln slice, used by the pclnOffset field's markup annotation- Returns:
- address of the pcln slice
-
getMinLC
public byte getMinLC()Returns the min lc, used as the GoPcValueEvaluator's pcquantum- Returns:
- minLc
-
getPtrSize
public byte getPtrSize()Returns the pointer size- Returns:
- pointer size
-