42 lines
8.4 KiB
Plaintext
42 lines
8.4 KiB
Plaintext
|
+
|
|||
|
|
ĺĘŢjş ă ób € R t ^ RIt^ RIt^ RIt^ RIt^ RIt^ RIHtHtH t ^ RI
|
|||
|
|
H t R t ]
|
|||
|
|
R8X d ]P ! ] R7 t]P! R]P" RR 7 ]P! R
|
|||
|
|
]P" RR 7 ]P% 4 t] ! ]P( ]P* 4 R# R# ) zëRead-only Go pclntab and direct-call inventory for an explicitly selected PE.
|
|||
|
|
|
|||
|
|
This recovers compiled function names and machine-code call edges, not source
|
|||
|
|
code or proof that a handler succeeds. CmdIDs require separate wire evidence.
|
|||
|
|
N)ÚCsÚ CS_ARCH_X86Ú
|
|||
|
|
CS_MODE_64)Ú
|
|||
|
|
X86_OP_IMMc ó$ a a(a)€ V P 4 p\ P ! R V^<4 ^ , pVR, R8w g W#V^, R8w d \ R4 h\ P ! RW#^, 4 ^ , pV^, p\ P ! RW%4 ^ , R8w d \ R4 h\ P ! RW%^, 4 ^ , o(. o)V\ P ! RW#^, 4 ^ , , p\ V4 Fo pWg^(, , pW(V^, P R 4 P
|
|||
|
|
R
|
|||
|
|
4 p \ P ! R W(^, 4 w r«rÍS)P W›WÍ34 Kq V(V)3R lp. p^ pVP R
|
|||
|
|
V4 ;p^ 8Ľ dĂ \ P ! RVV^, 4 w pppppppp^ Tu;8 d R8 d€ M M|^ Tu;8 d R8 dn M MjVV, V^, ^, , \ V4 8 d? V^ 8X d S(\ R S) 4 4 , pV! V4 VP VVVVV34 V^,
|
|||
|
|
pKŰ \ V4 ^8w d \ R\ V4 24 hV^ , w ppppp. p\ V4 EF p\ P ! RVVV, V^, , 4 w pp \ P ! R VVV, V^, ^, , 4 ^ , p \ P ! RVVV, V , ^, 4 ^ , p VV, V , pW(VP R V4 P
|
|||
|
|
R4 p VP RV R\ VV, 4 R\ VV, S(,
|
|||
|
|
4 RV V,
|
|||
|
|
/4 EK V U u/ uF p \ V R, ^4 V R, bK p p \ \ \" 4 p!RV!n V U a u. uFs o RS R, P' 4 9 gS RS R, 9 g K/ \( ;QJ d V 3R lR7 4 F ' g K RM R M! V 3R lR7 4 4 ' g Kq S NKu p"p V" EFX o \ S R, ^4 p#V! V#4 p
|
|||
|
|
. S R & . p$V!P+ W-V
|
|||
|
|
S R, , V#4 EF p%R p&V%P, R89 dž V%P. ' dŚ V%P. ^ , P0 \2 8X df V%P. ^ , P4 p&V&V 9 dB S R , P R \ V%P6 4 R!V V&, R\ V&4 /4 T$P V%P6 R"
|
|||
|
|
R#V%P, R$V%P8 2V&V 9 d
|
|||
|
|
R%V V&, 2MR&, 4 EK V$S R'& EK[ VP; RRR(7 R)\< P> ! V4 PA 4 R*\ V4 R+\ S(4 R,VR-VR.R/./p'VR0, PC \D PF ! R1V'R2V/^R37 RR47 VR5, PC \D PF ! R1V'R2V"/^R37 RR47 \I \D PF ! / V'CR6\ V"4 /C4 4 R # \ \ P 3 d EL i ; iu up i u up i )9z<I:Né Ns MZs PE zExpected PE imagez<Hi zExpected PE32+z<Qó Úasciiz<IIIIc ó¨ <€ S F= w rr4W S,
|
|||
|
|
u;8: d W#, 8 g K# M K' W@, S,
|
|||
|
|
V,
|
|||
|
|
u # \ R V R
|
|||
|
|
24 h)z Unmapped VA ú#x)Ú
|
|||
|
|
ValueError)ÚvaÚ_ÚrvaÚsizeÚrawÚ
|
|||
|
|
image_baseÚsectionss & €€Útools/dump_go_workflow.pyÚoffsetÚdump.<locals>.offset! sN ř€ Ű!)Ń �A�DŘ�•mÖ. cĄh×.Ň.Ř•v�jŐ(¨Ő,Ň,ń "*ô �<¨¨2 wĐ/Ó0Đ0ó s ń˙˙˙ z<8Qi@B c 3 ó> " € T F w r q1R 8X g K Vx € K R# 5i)z.textN© )Ú.0Únamer r s & r Ú <genexpr>Údump.<locals>.<genexpr>- s é € Đ*_Á8±<°4¸A¸aĐW^ÉŻ3Ş3Ă8ůs ‚ “
|
|||
|
|
z*Expected one valid Go1.20+ pclntab, found z<IIz<iÚutf8r r
|
|||
|
|
r r TÚ gridfightz
|
|||
|
|
firefly-goc 3 óV <" € T F qSR , P 4 9 x € K R# 5i)r N)Úlower)r ÚxÚfs & €r r r A s? řé € đ knń Lmđ GHĐpqĐrxŐpy×pŃpó qBö lBó Lmůs �&)FÚcallsNÚatÚtargetr z: Ú z ; Ú Úassembly)ÚparentsÚexist_okÚsha256Úbytesr Úpclntab_offsetÚfunction_countÚ limitationszcCompiled symbols and direct-call edges only; no source reconstruction or runtime success assertion.zfunctions.jsonÚ
|
|||
|
|
provenanceÚ functions)Úindent)Úencodingzgridfight-workflow.jsonÚselected_functions)ÚregisterÚrouteÚdispatch)ÚcallÚjmp)%Ú
|
|||
|
|
read_bytesÚstructÚ unpack_fromr ÚrangeÚrstripÚdecodeÚappendÚfindÚlenÚnextÚerrorÚindexÚhexÚintr r r Údetailr! ÚanyÚdisasmÚmnemonicÚoperandsÚtyper ÚimmÚaddressÚop_strÚmkdirÚhashlibr, Ú hexdigestÚ
|
|||
|
|
write_textÚjsonÚdumpsÚprint)*ÚpathÚoutputÚdataÚpeÚcountÚoptionalÚ
|
|||
|
|
section_tableÚiÚposr Úvsizer r r r Ú
|
|||
|
|
candidatesÚstartÚnfuncÚnfilesÚtextÚnamesÚcuÚfilesÚpctabÚpclnÚheaderÚfuncsÚentryÚinfoÚendÚnameoffr# ÚbyvaÚcsÚselectedr
|
|||
|
|
ÚasmÚinsr& r1 r r s* && ` @@r Údumprx sR ú€ Ř Ź?‰?Ó €DÜ × Ň �D $¨Ó -¨aŐ 0€BŘ �B…x�5Ô�D B qĄD�M¨YÔ 6ÜĐ,Ó-Đ-Ü × Ň �t T¨a4Ó 0°Ő 3€EŘ�"Ťu€HÜ
|
|||
|
|
×Ň�$ Ó/°Ő2°eÔ;ÜĐ)Ó*Đ*Ü×#Ň# D¨$¸µ Ó<¸QŐ?€JŘ€HŘ śV× /Ň /°°d¸r˝EÓ BŔ1Ő EŐE€MÜ
|
|||
|
|
�5Ž\�Ř�bťDŐ �Ř��Ať�×%Ń% eÓ,×3Ń3°GÓ<�Ü &× 2Ň 2°7¸DŔaĹ%Ó HŃ ��DŘŹ‰� DĐ.Ö/ń ö
|
|||
|
|
1đ
|
|||
|
|
€JŘ
|
|||
|
|
€EŘ—I‘IĐ =¸uÓEĐ E�5Č!Ô
|