cyberkaida / golang-ghidra

A Ghidra extension for Golang analysis

Hi! I'm cyberkaida (サイバーかいだ), I'm a reverse engineering vtuber 💫✨ !

You can find me at:

• https://www.twitch.tv/cyberkaida
• https://infosec.exchange/@cyberkaida
• https://twitter.com/CyberKaida

golang-ghidra's Issues

Golang PE binaries, symbols in wrong locations

You had an issue with symbols not being in correct locations in a PE binary. (firstmoduledata)

There was an issue that was fixed, but it doesn't seem to be included in a release yet.

The binary had 2 .data sections. This is a bit of a ghidra-ism. The first one is the initialized part of the .data, and the second one was for the uninitialized portion of the section.

When PE debug symbols were being laid down, the wrong section was being picked as the base address for the label symbol, so you would get the label at offset 1234 of the second (uninitialized) .data section instead of at offset 1234 of the first .data section.