Class GoRttiMapper
java.lang.Object
ghidra.app.util.bin.format.golang.structmapping.DataTypeMapper
ghidra.app.util.bin.format.golang.rtti.GoRttiMapper
- All Implemented Interfaces:
AutoCloseable
DataTypeMapper
for golang binaries.
When bootstrapping golang binaries, the following steps are used:
- Find the GoBuildInfo struct. This struct is the easiest to locate, even when the binary is stripped. This gives us the go pointerSize (probably same as ghidra pointer size) and the goVersion. This struct does not rely on StructureMapping, allowing its use before a DataTypeMapper is created.
- Create DataTypeMapper
- Find the runtime.firstmoduledata structure.
- If there are symbols, just use the symbol or named memory block.
- If stripped:
- Find the pclntab. This has a magic signature, a pointerSize, and references to a couple of tables that are also referenced in the moduledata structure.
- Search memory for a pointer to the pclntab struct. This should be the first field of the moduledata structure. The values that are duplicated between the two structures can be compared to ensure validity.
- Different binary formats (Elf vs PE) will determine which memory blocks to search.
-
Field Summary
Fields inherited from class ghidra.app.util.bin.format.golang.structmapping.DataTypeMapper
archiveDTM, archiveSearchCPs, mappingInfo, program, programDTM, programSearchCPs
-
Constructor Summary
ConstructorsConstructorDescriptionGoRttiMapper
(Program program, int ptrSize, Endian endian, GoVer goVersion, ResourceFile archiveGDT) Creates a GoRttiMapper using the specified bootstrap information. -
Method Summary
Modifier and TypeMethodDescriptionvoid
addModule
(GoModuledata module) Adds a module data instance to the contextvoid
cacheRecoveredDataType
(GoType typ, DataType dt) Inserts a mapping between agolang type
and aghidra data type
.protected BinaryReader
Creates a new BinaryReader that reads bytes from the current program's memory image.void
discoverGoTypes
(TaskMonitor monitor) Iterates over all golang rtti types listed in the GoModuledata struct, and recurses into each type to discover any types they reference.void
exportTypesToGDT
(File gdtFile, TaskMonitor monitor) Export the currently registered struct mapping types to a gdt file, producing a bootstrap GDT archive.findContainingModule
(long offset) Finds theGoModuledata
that contains the specified offset.findContainingModuleByFuncData
(long offset) Finds theGoModuledata
that contains the specified func data offset.static ResourceFile
findGolangBootstrapGDT
(GoVer goVer, int ptrSize, String osName) Searches for a golang bootstrap gdt file that matches the specified Go version/size/OS.findGoType
(String typeName) Finds a go type by its go-type name, from the list ofdiscovered
go types.Returns aGhidra data type
that represents thegolang type
, using a cache of already recovered types to eliminate extra work and self recursion.Returns the ghidra data type that represents the built-in golang channel type.CategoryPath location (in the program) where new data types will be created to represent variable length structures.Returns the first module data instancegetFunctionByName
(String funcName) getFunctionData
(Address funcAddr) static String
getGDTFilename
(GoVer goVer, int pointerSizeInBytes, String osName) Returns the name of the golang bootstrap gdt data type archive, using the specified version, pointer size and OS name.Returns the data type that represents a generic golang slice.<T extends DataType>
TgetGhidraDataType
(String goTypeName, Class<T> clazz) Returns the GhidraDataType
that is equivalent to the named golang type.static String
getGolangOSString
(Program program) Returns a golang OS string based on the Ghidra program.Returns the golang versiongetGoName
(long offset) Returns theGoName
instance at the specified offset.getGoType
(long offset) Returns a specializedGoType
for the type that is located at the specified location.Returns a specializedGoType
for the type that is located at the specified location.Returns the data type that represents a golang int32Returns the ghidra data type that represents a golang built-in map type.static GoRttiMapper
getMapperFor
(Program program, MessageLog log) Returns a newGoRttiMapper
for the specified program, or null if the binary is not a supported golang binary.int
Returns the size of pointers in this binary.getRecoveredType
(GoType typ) Returns aGhidra data type
that represents thegolang type
, using a cache of already recovered types to eliminate extra work and self recursion.Returns category path that should be used to place recovered golang types.Returns the data type that represents a golang uint32Returns the data type that represents a golang uintptrvoid
init
(TaskMonitor monitor) boolean
isGolangAbi0Func
(Function func) void
recoverDataTypes
(TaskMonitor monitor) Converts all discovered golang rtti type records to Ghidra data types, placing them in the program's DTM in /golang-recoveredresolveNameOff
(long ptrInModule, long off) Returns theGoName
corresponding to an offset that is relative to the controlling GoModuledata's typesOffset.resolveTextOff
(long ptrInModule, long off) Returns theAddress
to an offset that is relative to the controlling GoModuledata's text value.resolveTypeOff
(long ptrInModule, long off) Returns theGoType
corresponding to an offset that is relative to the controlling GoModuledata's typesOffset.Methods inherited from class ghidra.app.util.bin.format.golang.structmapping.DataTypeMapper
addArchiveSearchCategoryPath, addProgramSearchCategoryPath, close, createMarkupSession, findType, getAddressOfStructure, getCodeAddress, getDataAddress, getDataConverter, getDTM, getProgram, getReader, getStructureContextOfInstance, getStructureDataType, getStructureDataTypeName, getStructureMappingInfo, getStructureMappingInfo, getType, getTypeOrDefault, readStructure, readStructure, readStructure, registerStructure, registerStructures, toString
-
Constructor Details
-
GoRttiMapper
public GoRttiMapper(Program program, int ptrSize, Endian endian, GoVer goVersion, ResourceFile archiveGDT) throws IOException, IllegalArgumentException Creates a GoRttiMapper using the specified bootstrap information.- Parameters:
program
-Program
containing the go binaryptrSize
- size of pointersendian
-Endian
goVersion
- version of goarchiveGDT
- path to the matching golang bootstrap gdt data type file, or null if not present and types recovered via DWARF should be used instead- Throws:
IOException
- if error linking a structure mapped structure to its matching ghidra structure, which is a programming error or a corrupted bootstrap gdtIllegalArgumentException
- if there is no matching bootstrap gdt for this specific type of golang binary
-
-
Method Details
-
getMapperFor
Returns a newGoRttiMapper
for the specified program, or null if the binary is not a supported golang binary.- Parameters:
program
-Program
log
-MessageLog
- Returns:
- new
GoRttiMapper
, or null if not a golang binary - Throws:
IOException
- if bootstrap gdt is corrupted or some other struct mapping logic error
-
getGDTFilename
Returns the name of the golang bootstrap gdt data type archive, using the specified version, pointer size and OS name.- Parameters:
goVer
-GoVer
pointerSizeInBytes
- pointer size for this binary, or -1 to use wildcard "any"osName
- name of the operating system, or "any"- Returns:
- String, "golang_1.18_64bit_any.gdt"
-
getGolangOSString
Returns a golang OS string based on the Ghidra program.- Parameters:
program
-Program
- Returns:
- String golang OS string such as "linux", "win"
-
findGolangBootstrapGDT
Searches for a golang bootstrap gdt file that matches the specified Go version/size/OS.First looks for a gdt with an exact match, then for a gdt with version/size match and "any" OS, and finally, a gdt that matches the version and "any" size and "any" OS.
- Parameters:
goVer
- version of GoptrSize
- size of pointersosName
- name of OS- Returns:
- ResourceFile of matching bootstrap gdt, or null if nothing matches
-
getGolangVersion
Returns the golang version- Returns:
GoVer
-
getRegInfo
-
init
- Throws:
IOException
-
getFirstModule
Returns the first module data instance- Returns:
GoModuledata
-
addModule
Adds a module data instance to the context- Parameters:
module
-GoModuledata
to add
-
getStorageAllocator
-
isGolangAbi0Func
-
getAbi0CallingConvention
-
getAbiInternalCallingConvention
-
getDuffzeroCallingConvention
-
getDuffcopyCallingConvention
-
findContainingModule
Finds theGoModuledata
that contains the specified offset.Useful for finding the
GoModuledata
to resolve a relative offset of the text, types or other area.- Parameters:
offset
- absolute offset of a structure that aGoModuledata
contains- Returns:
GoModuledata
instance that contains the structure, or null if not found
-
findContainingModuleByFuncData
Finds theGoModuledata
that contains the specified func data offset.- Parameters:
offset
- absolute offset of a func data structure- Returns:
GoModuledata
instance that contains the specified func data, or null if not found
-
getDefaultVariableLengthStructCategoryPath
Description copied from class:DataTypeMapper
CategoryPath location (in the program) where new data types will be created to represent variable length structures.- Overrides:
getDefaultVariableLengthStructCategoryPath
in classDataTypeMapper
- Returns:
CategoryPath
, default is ROOT
-
getUintptrDT
Returns the data type that represents a golang uintptr- Returns:
- golang uinptr data type
-
getInt32DT
Returns the data type that represents a golang int32- Returns:
- golang int32 data type
-
getUint32DT
Returns the data type that represents a golang uint32- Returns:
- golang uint32 data type
-
getGenericSliceDT
Returns the data type that represents a generic golang slice.- Returns:
- golang generic slice data type
-
getMapGoType
Returns the ghidra data type that represents a golang built-in map type.- Returns:
- golang map data type
-
getChanGoType
Returns the ghidra data type that represents the built-in golang channel type.- Returns:
- golang channel type
-
createProgramReader
Description copied from class:DataTypeMapper
Creates a new BinaryReader that reads bytes from the current program's memory image.Address offsets and index offsets in the BinaryReader should be synonymous.
- Overrides:
createProgramReader
in classDataTypeMapper
- Returns:
- new BinaryReader
-
getPtrSize
public int getPtrSize()Returns the size of pointers in this binary.- Returns:
- pointer size (ex. 4, or 8)
-
getGoType
Returns a specializedGoType
for the type that is located at the specified location.- Parameters:
offset
- absolute position of a go type- Returns:
- specialized
GoType
(example, GoStructType, GoArrayType, etc) - Throws:
IOException
- if error reading
-
getGoType
Returns a specializedGoType
for the type that is located at the specified location.- Parameters:
addr
- location of a go type- Returns:
- specialized
GoType
(example, GoStructType, GoArrayType, etc) - Throws:
IOException
- if error reading
-
getLastGoType
-
findGoType
Finds a go type by its go-type name, from the list ofdiscovered
go types.- Parameters:
typeName
- name string- Returns:
GoType
, or null if not found
-
getGhidraDataType
Returns the GhidraDataType
that is equivalent to the named golang type.- Type Parameters:
T
- expected DataType- Parameters:
goTypeName
- golang type nameclazz
- class of expected data type- Returns:
DataType
representing the named golang type, or null if not found
-
exportTypesToGDT
Export the currently registered struct mapping types to a gdt file, producing a bootstrap GDT archive.The struct data types will either be from the current program's DWARF data, or from an earlier golang.gdt (if this binary doesn't have DWARF)
- Parameters:
gdtFile
- destinationFile
to write the bootstrap types tomonitor
-TaskMonitor
- Throws:
IOException
- if error
-
getRecoveredTypesCp
Returns category path that should be used to place recovered golang types.- Returns:
CategoryPath
to use when creating recovered golang types
-
getRecoveredType
Returns aGhidra data type
that represents thegolang type
, using a cache of already recovered types to eliminate extra work and self recursion.- Parameters:
typ
- theGoType
to convert- Returns:
- Ghidra
DataType
- Throws:
IOException
- if error converting type
-
cacheRecoveredDataType
Inserts a mapping between agolang type
and aghidra data type
.Useful to prepopulate the data type mapping before recursing into contained/referenced types that might be self-referencing.
- Parameters:
typ
-golang type
dt
-Ghidra type
- Throws:
IOException
- if golang type struct is not a valid struct mapped instance
-
getCachedRecoveredDataType
Returns aGhidra data type
that represents thegolang type
, using a cache of already recovered types to eliminate extra work and self recursion.- Parameters:
typ
- theGoType
to convert- Returns:
- Ghidra
DataType
- Throws:
IOException
- if golang type struct is not a valid struct mapped instance
-
recoverDataTypes
Converts all discovered golang rtti type records to Ghidra data types, placing them in the program's DTM in /golang-recovered- Parameters:
monitor
-TaskMonitor
- Throws:
IOException
- error converting a golang type to a Ghidra typeCancelledException
- if the user cancelled the import
-
discoverGoTypes
Iterates over all golang rtti types listed in the GoModuledata struct, and recurses into each type to discover any types they reference.The found types are accumulated in
goTypes
.- Parameters:
monitor
-TaskMonitor
- Throws:
IOException
- if errorCancelledException
- if cancelled
-
resolveTypeOff
Returns theGoType
corresponding to an offset that is relative to the controlling GoModuledata's typesOffset.- Parameters:
ptrInModule
- the address of the structure that contains the offset that needs to be calculated. The containing-structure's address is important because it indicates which GoModuledata is the 'parent'off
- offset- Returns:
GoType
, or null if offset is special value 0 or -1- Throws:
IOException
- if error
-
resolveTextOff
Returns theAddress
to an offset that is relative to the controlling GoModuledata's text value.- Parameters:
ptrInModule
- the address of the structure that contains the offset that needs to be calculated. The containing-structure's address is important because it indicates which GoModuledata is the 'parent'off
- offset- Returns:
Address
, or null if offset was special value -1
-
resolveNameOff
Returns theGoName
corresponding to an offset that is relative to the controlling GoModuledata's typesOffset.- Parameters:
ptrInModule
- the address of the structure that contains the offset that needs to be calculated. The containing-structure's address is important because it indicates which GoModuledata is the 'parent'off
- offset- Returns:
GoName
, or null if offset was special value 0- Throws:
IOException
- if error reading name or unable to find containing module
-
getGoName
Returns theGoName
instance at the specified offset.- Parameters:
offset
- location to read- Returns:
GoName
instance, or null if offset was special value 0- Throws:
IOException
- if error reading
-
getFunctionData
- Throws:
IOException
-
getFunctionByName
-
getAllFunctions
- Throws:
IOException
-