Class GoRttiMapper
- All Implemented Interfaces:
DataTypeMapperContext
,AutoCloseable
DataTypeMapper
for golang binaries.
When bootstrapping golang binaries, the following steps are used:
- Find the GoBuildInfo struct. This struct is the easiest to locate, even when the binary is stripped. This gives us the go pointerSize (probably same as ghidra pointer size) and the goVersion. This struct does not rely on StructureMapping, allowing its use before a DataTypeMapper is created.
- Create DataTypeMapper
- Find the runtime.firstmoduledata structure.
-
- If there are symbols, just use the symbol or named memory block.
- If stripped:
-
- Find the pclntab. This has a magic signature, a pointerSize, and references to a couple of tables that are also referenced in the moduledata structure.
- Search memory for a pointer to the pclntab struct. This should be the first field of the moduledata structure. The values that are duplicated between the two structures can be compared to ensure validity.
- Different binary formats (Elf vs PE) will determine which memory blocks to search.
-
Nested Class Summary
-
Field Summary
Fields inherited from class ghidra.app.util.bin.format.golang.structmapping.DataTypeMapper
archiveDTM, archiveSearchCPs, mappingInfo, program, programDTM, programSearchCPs
-
Constructor Summary
ConstructorDescriptionGoRttiMapper
(Program program, int ptrSize, Endian endian, GoVer goVersion, ResourceFile archiveGDT) Creates a GoRttiMapper using the specified bootstrap information. -
Method Summary
Modifier and TypeMethodDescriptionvoid
addModule
(GoModuledata module) Adds a module data instance to the contextvoid
cacheRecoveredDataType
(GoType typ, DataType dt) Inserts a mapping between agolang type
and aghidra data type
.createMarkupSession
(TaskMonitor monitor) Creates aMarkupSession
that is controlled by the specifiedTaskMonitor
.protected BinaryReader
Creates a new BinaryReader that reads bytes from the current program's memory image.void
discoverGoTypes
(TaskMonitor monitor) Iterates over all golang rtti types listed in the GoModuledata struct, and recurses into each type to discover any types they reference.void
exportTypesToGDT
(File gdtFile, boolean runtimeFuncSnapshot, TaskMonitor monitor) Export the currently registered struct mapping types to a gdt file, producing a bootstrap GDT archive.findContainingModule
(long offset) Finds theGoModuledata
that contains the specified offset.findContainingModuleByFuncData
(long offset) Finds theGoModuledata
that contains the specified func data offset.static ResourceFile
findGolangBootstrapGDT
(GoVer goVer, int ptrSize, String osName) Searches for a golang bootstrap gdt file that matches the specified Go version/size/OS.findGoType
(String typeName) Finds a go type by its go-type name, from the list ofdiscovered
go types.Return a list of all functionsgetBootstrapFunctionDefintion
(String funcName) Returns aFunctionDefinition
for a built-in golang runtime function.getCachedGoType
(long offset) Returns a previous read and cached GoType, based on its offset.Returns aGhidra data type
that represents thegolang type
, using a cache of already recovered types to eliminate extra work and self recursion.Returns the ghidra data type that represents the built-in golang channel type.CategoryPath location (in the program) where new data types will be created to represent variable length structures.static MemoryBlock
getFirstGoSection
(Program program, String... blockNames) Returns the first module data instancegetFunctionByName
(String funcName) Returns a function based on its namegetFunctionData
(Address funcAddr) Returns metadata about a functionstatic String
getGDTFilename
(GoVer goVer, int pointerSizeInBytes, String osName) Returns the name of the golang bootstrap gdt data type archive, using the specified version, pointer size and OS name.Returns the data type that represents a generic golang slice.<T extends DataType>
TgetGhidraDataType
(String goTypeName, Class<T> clazz) Returns the GhidraDataType
that is equivalent to the named golang type.static GoRttiMapper
getGoBinary
(Program program) Creates aGoRttiMapper
representing the specified program.static String
getGolangOSString
(Program program) Returns a golang OS string based on the Ghidra program.Returns the golang versiongetGoName
(long offset) Returns theGoName
instance at the specified offset.static MemoryBlock
getGoSection
(Program program, String sectionName) getGoSection
(String sectionName) static Symbol
getGoSymbol
(Program program, String symbolName) Returns a matching symbol from the specified program, using golang specific logic.getGoSymbol
(String symbolName) getGoType
(long offset) Returns a specializedGoType
for the type that is located at the specified location.Returns a specializedGoType
for the type that is located at the specified location.getGoTypeName
(long offset) Returns the name of a gotype.Returns the data type that represents a golang int32Returns a list of interfaces that the specified type has implemented.Returns the ghidra data type that represents a golang built-in map type.getMethodInfoForFunction
(Address funcAddr) Returns a list of methods (either gotype methods or interface methods) that point to this function.byte
getMinLC()
Returns the minLC (pcquantum) value found in the pcln header structureint
Returns the size of pointers in this binary.getRecoveredType
(GoType typ) Returns aGhidra data type
that represents thegolang type
, using a cache of already recovered types to eliminate extra work and self recursion.getRecoveredTypesCp
(String packagePath) Returns category path that should be used to place recovered golang types.Returns a sharedGoRegisterInfo
instance<T> GoName
getSafeName
(GoRttiMapper.GoNameSupplier supplier, T structInstance, String defaultValue) An exception handling wrapper around a "getName()" call that could throw an IOException.static GoRttiMapper
getSharedGoBinary
(Program program, TaskMonitor monitor) Returns a sharedGoRttiMapper
for the specified program, or null if the binary is not a supported golang binary.getSpecializedMethodSignature
(String methodName, GoType methodType, DataType receiverDT, boolean allowPartial) Returns a function definition for a method that is attached to a golang type.Returns the address range that is valid for string char[] data to be found in.Returns the address range that is valid for string structs to be found in.<T extends DataType>
TReturns the data type that represents a golang uint32Returns the data type that represents a golang uintptrgetUniqueGoTypename
(GoType goType) Returns a unique name for the specified go type.static Address
getZerobaseAddress
(Program prog) Return the address of the golang zerobase symbol, or an artificial substitute.boolean
hasCallingConvention
(String ccName) Returns true if the specified calling convention is defined for the program.static boolean
hasGolangSections
(List<String> sectionNames) void
init
(TaskMonitor monitor) Finishes making this instance ready to be used.void
Initializes golang function / method lookup infovoid
initTypeInfoIfNeeded
(TaskMonitor monitor) Discovers available golang types if not already done.boolean
isFieldPresent
(String presentWhen) Tests if a field should be included when creating bindings between a structure and a class.boolean
isGolangAbi0Func
(Function func) Returns true if the specified function uses the abi0 calling convention.static boolean
isGolangProgram
(Program program) Returns true if the specified Program is marked as "golang".Returns a new param storage allocator instance.void
recoverDataTypes
(TaskMonitor monitor) Converts all discovered golang rtti type records to Ghidra data types, placing them in the program's DTM in /golang-recoveredresolveNameOff
(long ptrInModule, long off) Returns theGoName
corresponding to an offset that is relative to the controlling GoModuledata's typesOffset.resolveTextOff
(long ptrInModule, long off) Returns theAddress
to an offset that is relative to the controlling GoModuledata's text value.resolveTypeOff
(long ptrInModule, long off) Returns theGoType
corresponding to an offset that is relative to the controlling GoModuledata's typesOffset.Methods inherited from class ghidra.app.util.bin.format.golang.structmapping.DataTypeMapper
addArchiveSearchCategoryPath, addProgramSearchCategoryPath, close, createArtificialStructureContext, findType, getAddressOfStructure, getCodeAddress, getDataAddress, getDataConverter, getDTM, getMaxAddressOfStructure, getProgram, getReader, getStructureContextOfInstance, getStructureDataType, getStructureDataTypeName, getStructureMappingInfo, getStructureMappingInfo, getType, getTypeOrDefault, readStructure, readStructure, readStructure, readStructure, registerStructure, registerStructures, toString
-
Field Details
-
SUPPORTED_MIN_VER
-
SUPPORTED_MAX_VER
-
ARTIFICIAL_RUNTIME_ZEROBASE_SYMBOLNAME
- See Also:
-
-
Constructor Details
-
GoRttiMapper
public GoRttiMapper(Program program, int ptrSize, Endian endian, GoVer goVersion, ResourceFile archiveGDT) throws IOException, BootstrapInfoException Creates a GoRttiMapper using the specified bootstrap information.- Parameters:
program
-Program
containing the go binaryptrSize
- size of pointersendian
-Endian
goVersion
- version of goarchiveGDT
- path to the matching golang bootstrap gdt data type file, or null if not present and types recovered via DWARF should be used instead- Throws:
IOException
- if error linking a structure mapped structure to its matching ghidra structure, which is a programming error or a corrupted bootstrap gdtBootstrapInfoException
- if there is no matching bootstrap gdt for this specific type of golang binary
-
-
Method Details
-
getGoBinary
Creates aGoRttiMapper
representing the specified program.- Parameters:
program
-Program
- Returns:
- new
GoRttiMapper
, or null if basic golang information is not found in the binary - Throws:
BootstrapInfoException
- if it is a golang binary and has an unsupported or unparseable version number or if there was a missing golang bootstrap .gdt fileIOException
- if there was an error in the Ghidra golang rtti reading logic
-
getGDTFilename
Returns the name of the golang bootstrap gdt data type archive, using the specified version, pointer size and OS name.- Parameters:
goVer
-GoVer
pointerSizeInBytes
- pointer size for this binary, or -1 to use wildcard "any"osName
- name of the operating system, or "any"- Returns:
- String, "golang_1.18_64bit_any.gdt"
-
getGolangOSString
Returns a golang OS string based on the Ghidra program.- Parameters:
program
-Program
- Returns:
- String golang OS string such as "linux", "win"
-
findGolangBootstrapGDT
Searches for a golang bootstrap gdt file that matches the specified Go version/size/OS.First looks for a gdt with an exact match, then for a gdt with version/size match and "any" OS, and finally, a gdt that matches the version and "any" size and "any" OS.
- Parameters:
goVer
- version of GoptrSize
- size of pointersosName
- name of OS- Returns:
- ResourceFile of matching bootstrap gdt, or null if nothing matches
-
isGolangProgram
Returns true if the specified Program is marked as "golang".- Parameters:
program
-Program
- Returns:
- boolean true if program is marked as golang
-
hasGolangSections
-
getGoSymbol
Returns a matching symbol from the specified program, using golang specific logic. -
getGoSection
-
getFirstGoSection
-
getZerobaseAddress
Return the address of the golang zerobase symbol, or an artificial substitute.The zerobase symbol is used as the location of parameters that are zero-length.
-
getAllSupportedVersions
-
getType
Description copied from class:DataTypeMapper
Returns a namedDataType
, searching the registeredprogram
andarchive
category paths.DataTypes that were found in the attached archive gdt manager will be copied into the program's data type manager before being returned.
- Overrides:
getType
in classDataTypeMapper
- Type Parameters:
T
- DataType or derived type- Parameters:
name
-DataType
nameclazz
- expected DataType class- Returns:
- DataType or null if not found
-
getGolangVersion
Returns the golang version- Returns:
GoVer
-
getRegInfo
Returns a sharedGoRegisterInfo
instance- Returns:
GoRegisterInfo
-
init
Finishes making this instance ready to be used.- Parameters:
monitor
-TaskMonitor
- Throws:
IOException
- if error reading data
-
initMethodInfoIfNeeded
Initializes golang function / method lookup info- Throws:
IOException
- if error reading data
-
getMinLC
Returns the minLC (pcquantum) value found in the pcln header structure- Returns:
- minLC value
- Throws:
IOException
- if value has not been initialized yet
-
getFirstModule
Returns the first module data instance- Returns:
GoModuledata
-
addModule
Adds a module data instance to the context- Parameters:
module
-GoModuledata
to add
-
newStorageAllocator
Returns a new param storage allocator instance.- Returns:
- new
GoParamStorageAllocator
instance
-
isGolangAbi0Func
Returns true if the specified function uses the abi0 calling convention.- Parameters:
func
-Function
to test- Returns:
- boolean true if function uses abi0 calling convention
-
hasCallingConvention
Returns true if the specified calling convention is defined for the program.- Parameters:
ccName
- calling convention name- Returns:
- true if the specified calling convention is defined for the program
-
createMarkupSession
Description copied from class:DataTypeMapper
Creates aMarkupSession
that is controlled by the specifiedTaskMonitor
.- Overrides:
createMarkupSession
in classDataTypeMapper
- Parameters:
monitor
-TaskMonitor
- Returns:
- new
MarkupSession
-
findContainingModule
Finds theGoModuledata
that contains the specified offset.Useful for finding the
GoModuledata
to resolve a relative offset of the text, types or other area.- Parameters:
offset
- absolute offset of a structure that aGoModuledata
contains- Returns:
GoModuledata
instance that contains the structure, or null if not found
-
findContainingModuleByFuncData
Finds theGoModuledata
that contains the specified func data offset.- Parameters:
offset
- absolute offset of a func data structure- Returns:
GoModuledata
instance that contains the specified func data, or null if not found
-
getDefaultVariableLengthStructCategoryPath
Description copied from class:DataTypeMapper
CategoryPath location (in the program) where new data types will be created to represent variable length structures.- Overrides:
getDefaultVariableLengthStructCategoryPath
in classDataTypeMapper
- Returns:
CategoryPath
, default is ROOT
-
getUintptrDT
Returns the data type that represents a golang uintptr- Returns:
- golang uinptr data type
-
getInt32DT
Returns the data type that represents a golang int32- Returns:
- golang int32 data type
-
getUint32DT
Returns the data type that represents a golang uint32- Returns:
- golang uint32 data type
-
getGenericSliceDT
Returns the data type that represents a generic golang slice.- Returns:
- golang generic slice data type
-
getMapGoType
Returns the ghidra data type that represents a golang built-in map type.- Returns:
- golang map data type
-
getChanGoType
Returns the ghidra data type that represents the built-in golang channel type.- Returns:
- golang channel type
-
createProgramReader
Description copied from class:DataTypeMapper
Creates a new BinaryReader that reads bytes from the current program's memory image.Address offsets and index offsets in the BinaryReader should be synonymous.
- Overrides:
createProgramReader
in classDataTypeMapper
- Returns:
- new BinaryReader
-
getPtrSize
public int getPtrSize()Returns the size of pointers in this binary.- Returns:
- pointer size (ex. 4, or 8)
-
getGoType
Returns a specializedGoType
for the type that is located at the specified location.- Parameters:
offset
- absolute position of a go type- Returns:
- specialized
GoType
(example, GoStructType, GoArrayType, etc) - Throws:
IOException
- if error reading
-
getCachedGoType
Returns a previous read and cached GoType, based on its offset.- Parameters:
offset
- offset of the GoType- Returns:
- GoType, or null if not previously read and cached
-
getGoType
Returns a specializedGoType
for the type that is located at the specified location.- Parameters:
addr
- location of a go type- Returns:
- specialized
GoType
(example, GoStructType, GoArrayType, etc) - Throws:
IOException
- if error reading
-
findGoType
Finds a go type by its go-type name, from the list ofdiscovered
go types.- Parameters:
typeName
- name string- Returns:
GoType
, or null if not found
-
getGhidraDataType
Returns the GhidraDataType
that is equivalent to the named golang type.- Type Parameters:
T
- expected DataType- Parameters:
goTypeName
- golang type nameclazz
- class of expected data type- Returns:
DataType
representing the named golang type, or null if not found
-
exportTypesToGDT
public void exportTypesToGDT(File gdtFile, boolean runtimeFuncSnapshot, TaskMonitor monitor) throws IOException, CancelledException Export the currently registered struct mapping types to a gdt file, producing a bootstrap GDT archive.The struct data types will either be from the current program's DWARF data, or from an earlier golang.gdt (if this binary doesn't have DWARF)
- Parameters:
gdtFile
- destinationFile
to write the bootstrap types toruntimeFuncSnapshot
- boolean flag, if true include function definitionsmonitor
-TaskMonitor
- Throws:
IOException
- if errorCancelledException
- if cancelled
-
getRecoveredTypesCp
Returns category path that should be used to place recovered golang types.- Parameters:
packagePath
- optional package path of the type (eg. "utf/utf8", or "runtime")- Returns:
CategoryPath
to use when creating recovered golang types
-
getRecoveredType
Returns aGhidra data type
that represents thegolang type
, using a cache of already recovered types to eliminate extra work and self recursion.- Parameters:
typ
- theGoType
to convert- Returns:
- Ghidra
DataType
- Throws:
IOException
- if error converting type
-
getSpecializedMethodSignature
public FunctionDefinition getSpecializedMethodSignature(String methodName, GoType methodType, DataType receiverDT, boolean allowPartial) throws IOException Returns a function definition for a method that is attached to a golang type.- Parameters:
methodName
- name of methodmethodType
- golang function def typereceiverDT
- data type of the go type that contains the methodallowPartial
- boolean flag, if true allows returning an artificial funcdef when the methodType parameter does not point to a function definition- Returns:
- new
FunctionDefinition
using the function signature specified by the methodType function definition, with the containing goType's type inserted as the first parameter, similar to a c++ "this" parameter - Throws:
IOException
- if error reading type info
-
cacheRecoveredDataType
Inserts a mapping between agolang type
and aghidra data type
.Useful to prepopulate the data type mapping before recursing into contained/referenced types that might be self-referencing.
- Parameters:
typ
-golang type
dt
-Ghidra type
- Throws:
IOException
- if golang type struct is not a valid struct mapped instance
-
getCachedRecoveredDataType
Returns aGhidra data type
that represents thegolang type
, using a cache of already recovered types to eliminate extra work and self recursion.- Parameters:
typ
- theGoType
to convert- Returns:
- Ghidra
DataType
- Throws:
IOException
- if golang type struct is not a valid struct mapped instance
-
recoverDataTypes
Converts all discovered golang rtti type records to Ghidra data types, placing them in the program's DTM in /golang-recovered- Parameters:
monitor
-TaskMonitor
- Throws:
IOException
- error converting a golang type to a Ghidra typeCancelledException
- if the user cancelled the import
-
initTypeInfoIfNeeded
Discovers available golang types if not already done.- Parameters:
monitor
-TaskMonitor
- Throws:
CancelledException
- if cancelledIOException
- if error reading data
-
discoverGoTypes
Iterates over all golang rtti types listed in the GoModuledata struct, and recurses into each type to discover any types they reference.The found types are accumulated in
goTypes
.- Parameters:
monitor
-TaskMonitor
- Throws:
IOException
- if errorCancelledException
- if cancelled
-
getMethodInfoForFunction
Returns a list of methods (either gotype methods or interface methods) that point to this function.- Parameters:
funcAddr
- function address- Returns:
- list of methods
-
getInterfacesImplementedByType
Returns a list of interfaces that the specified type has implemented.- Parameters:
type
- GoType- Returns:
- list of itabs that map a GoType to the interfaces it was found to implement
-
getUniqueGoTypename
Returns a unique name for the specified go type.- Parameters:
goType
-GoType
- Returns:
- unique string name
-
getSafeName
public <T> GoName getSafeName(GoRttiMapper.GoNameSupplier supplier, T structInstance, String defaultValue) An exception handling wrapper around a "getName()" call that could throw an IOException.When there is an error fetching the GoName instance via the specified callback, a limited usage GoName instance will be created and returned that will provide a replacement name that is built using the calling structure's offset as the identifier.
- Type Parameters:
T
- struct mapped instance type- Parameters:
supplier
- Supplier callbackstructInstance
- reference to the caller's struct-mapped instancedefaultValue
- string value to return (wrapped in a GoName) if the GoName is simply missing- Returns:
- GoName, either from the callback, or a limited-functionality instance created to hold a fallback name string
-
getGoTypeName
Returns the name of a gotype.- Parameters:
offset
- offset of the gotype RTTI record- Returns:
- string name, with a fallback if the specified offset was invalid
-
resolveTypeOff
Returns theGoType
corresponding to an offset that is relative to the controlling GoModuledata's typesOffset.- Parameters:
ptrInModule
- the address of the structure that contains the offset that needs to be calculated. The containing-structure's address is important because it indicates which GoModuledata is the 'parent'off
- offset- Returns:
GoType
, or null if offset is special value 0 or -1- Throws:
IOException
- if error
-
resolveTextOff
Returns theAddress
to an offset that is relative to the controlling GoModuledata's text value.- Parameters:
ptrInModule
- the address of the structure that contains the offset that needs to be calculated. The containing-structure's address is important because it indicates which GoModuledata is the 'parent'off
- offset- Returns:
Address
, or null if offset was special value -1
-
resolveNameOff
Returns theGoName
corresponding to an offset that is relative to the controlling GoModuledata's typesOffset.- Parameters:
ptrInModule
- the address of the structure that contains the offset that needs to be calculated. The containing-structure's address is important because it indicates which GoModuledata is the 'parent'off
- offset- Returns:
GoName
, or null if offset was special value 0- Throws:
IOException
- if error reading name or unable to find containing module
-
getGoName
Returns theGoName
instance at the specified offset.- Parameters:
offset
- location to read- Returns:
GoName
instance, or null if offset was special value 0- Throws:
IOException
- if error reading
-
getFunctionData
Returns metadata about a function- Parameters:
funcAddr
- entry point of a function- Returns:
GoFuncData
, or null if function not found in lookup tables
-
getFunctionByName
Returns a function based on its name- Parameters:
funcName
- name of function- Returns:
GoFuncData
, or null if not found
-
getAllFunctions
Return a list of all functions- Returns:
- list of all functions contained in the golang func metadata table
-
getBootstrapFunctionDefintion
Returns aFunctionDefinition
for a built-in golang runtime function.- Parameters:
funcName
- name of function- Returns:
FunctionDefinition
, or null if not found in bootstrap gdt
-
getStringStructRange
Returns the address range that is valid for string structs to be found in.- Returns:
AddressSetView
of range that is valid to find string structs in
-
getStringDataRange
Returns the address range that is valid for string char[] data to be found in.- Returns:
AddressSetView
of range that is valid for string char[] data
-
getTextAddresses
-
getGoSymbol
-
getGoSection
-
isFieldPresent
Description copied from interface:DataTypeMapperContext
Tests if a field should be included when creating bindings between a structure and a class.- Specified by:
isFieldPresent
in interfaceDataTypeMapperContext
- Parameters:
presentWhen
- free-form string that is interpreted by eachDataTypeMapper
- Returns:
- boolean true if field should be bound, false if field should not be bound