0xjiayu / go_parser Goto Github PK

D:\gopher\go_parser\go_parser.py: in method 'create_strlit', argument 2 of type 'size_t'
Traceback (most recent call last):
File "C:\Program Files\IDA 7.0\python\ida_idaapi.py", line 553, in IDAPython_ExecScript
execfile(script, g)
File "D:/gopher/go_parser/go_parser.py", line 52, in
main()
File "D:/gopher/go_parser/go_parser.py", line 36, in main
pclntab.parse()
File "D:/gopher/go_parser\pclntbl.py", line 173, in parse
self.parse_funcs()
File "D:/gopher/go_parser\pclntbl.py", line 125, in parse_funcs
func_st.parse()
File "D:/gopher/go_parser\pclntbl.py", line 252, in parse
if idc.MakeStr(name_addr, name_addr + len(raw_name_str) + 1):
File "C:\Program Files\IDA 7.0\python\idc_bc695.py", line 113, in MakeStr
def MakeStr(ea, endea): return create_strlit(ea, 0 if (endea) == ida_idaapi.BADADDR else endea-ea)
File "C:\Program Files\IDA 7.0\python\idc.py", line 695, in create_strlit
return ida_bytes.create_strlit(ea, 0 if endea == BADADDR else endea - ea, get_inf_attr(INF_STRTYPE))
File "C:\Program Files\IDA 7.0\python\ida_bytes.py", line 1618, in create_strlit
return _ida_bytes.create_strlit(*args)
TypeError: in method 'create_strlit', argument 2 of type 'size_t'

I leave it in plugins, But I can't find it

似乎是解析头报错了。。是程序做了什么处理导致的吗
#

go_parser.py: Invalid address of segment [.noptrdata]

两个问题

1. 尽量去支持最新版本的idapython的api，这样才能在以后版本不出问题。
2. python2都已经废弃了，python3才是主流。

我对两个问题都进行了fix，但是可能存在一些小的bug，我可以发pull requests吗？

https://www.hex-rays.com/products/ida/news/7_6/

• parsing of golang-specific metadata to recover function names and boundaries
• support for stack-based parameters and return values even on platfoms that usually use registers (ARM, x64)
• detection of golang-specific string literals

配合ida7.5使用，但是在还原符号时
出现了报错

已经成功还原了部分符号，但没有所有成功还原完；报错如下

C:\Users\john\Desktop\go_parser-master (1)\go_parser-master\go_parser.py: 'NoneType' object has no attribute 'start_ea'
Traceback (most recent call last):
  File "C:/Users/john/Desktop/go_parser-master (1)/go_parser-master\pclntbl.py", line 667, in parse
    self.func_type = FUNC_TYPES[self.func_id]
IndexError: list index out of range

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "E:\Tools\IDA_Pro_v7.5_Portable\python\3\ida_idaapi.py", line 616, in IDAPython_ExecScript
    exec(code, g)
  File "C:/Users/john/Desktop/go_parser-master (1)/go_parser-master/go_parser.py", line 56, in <module>
    main()
  File "C:/Users/john/Desktop/go_parser-master (1)/go_parser-master/go_parser.py", line 39, in main
    pclntab.parse()
  File "C:/Users/john/Desktop/go_parser-master (1)/go_parser-master\pclntbl.py", line 406, in parse
    self.parse_funcs_116()
  File "C:/Users/john/Desktop/go_parser-master (1)/go_parser-master\pclntbl.py", line 281, in parse_funcs_116
    func_st.parse()
  File "C:/Users/john/Desktop/go_parser-master (1)/go_parser-master\pclntbl.py", line 669, in parse
    common._debug(f"Invalid funcID. Curr func entry: {real_func_addr.start_ea:#x}, func st addr: {self.addr:#x}, func id: {self.func_id:#x}")
AttributeError: 'NoneType' object has no attribute 'start_ea'

C:\IDA\python\go_parser.py: list index out of range
Traceback (most recent call last):
File "C:\IDA\python\3\ida_idaapi.py", line 580, in IDAPython_ExecScript
exec(code, g)
File "C:/IDA/python/go_parser.py", line 56, in
main()
File "C:/IDA/python/go_parser.py", line 50, in main
type_parser.build_all_types()
File "C:\IDA\python\types_builder.py", line 51, in build_all_types
self._parse_extra_types()
File "C:\IDA\python\types_builder.py", line 84, in _parse_extra_types
self.parse_type(type_addr=target_type_addr)
File "C:\IDA\python\types_builder.py", line 100, in parse_type
rtype.parse()
File "C:\IDA\python\types_builder.py", line 254, in parse
idc.set_cmt(self.addr + 2*ADDR_SZ + 7, f"kind: {self.get_kind()}", 0)
File "C:\IDA\python\types_builder.py", line 305, in get_kind
return self.TYPE_KINDS[self.kind]
IndexError: list index out of range

There seems to be an infinite loop in types_builder.py on line 415 during the call to self.read_varint(1). It seems to be trying to read the VarInt from the incorrect offset.

• 52 的便携版 IDA 7.0
• 打开 Go 二进制文件，直接 Alt+F7 选择 go_parser.py 后报错如下

Z:\windows\IDAScriptFile\go_parser\go_parser.py: in method 'create_strlit', argument 2 of type 'size_t'
Traceback (most recent call last):
  File "C:\Users\testUser\Desktop\IDA_Pro_v7.0_Portable\python\ida_idaapi.py", line 553, in IDAPython_ExecScript
    execfile(script, g)
  File "Z:/windows/IDAScriptFile/go_parser/go_parser.py", line 52, in <module>
    main()
  File "Z:/windows/IDAScriptFile/go_parser/go_parser.py", line 36, in main
    pclntab.parse()
  File "Z:/windows/IDAScriptFile/go_parser\pclntbl.py", line 173, in parse
    self.parse_funcs()
  File "Z:/windows/IDAScriptFile/go_parser\pclntbl.py", line 125, in parse_funcs
    func_st.parse()
  File "Z:/windows/IDAScriptFile/go_parser\pclntbl.py", line 252, in parse
    if idc.MakeStr(name_addr, name_addr + len(raw_name_str) + 1):
  File "C:\Users\testUser\Desktop\IDA_Pro_v7.0_Portable\python\idc_bc695.py", line 113, in MakeStr
    def MakeStr(ea, endea): return create_strlit(ea, 0 if (endea) == ida_idaapi.BADADDR else endea-ea)
  File "C:\Users\testUser\Desktop\IDA_Pro_v7.0_Portable\python\idc.py", line 695, in create_strlit
    return ida_bytes.create_strlit(ea, 0 if endea == BADADDR else endea - ea, get_inf_attr(INF_STRTYPE))
  File "C:\Users\testUser\Desktop\IDA_Pro_v7.0_Portable\python\ida_bytes.py", line 1618, in create_strlit
    return _ida_bytes.create_strlit(*args)
TypeError: in method 'create_strlit', argument 2 of type 'size_t'

测试了恢复在windows和linux上编译的的hello world，结果IDA识别的函数远远少于Functions number的值，在windows上还找不到main😶
通过检查发现是IDA未能识别某些函数，需要手动创建函数
在https://github.com/0xjiayu/go_parser/blob/master/pclntbl.py#L109 下面加上如下代码解决了这个问题😋

if not idc.GetFunctionName(func_addr):
    # common._debug("Defining function at: @ %x" % func_addr)
    idc.MakeCode(func_addr)
    idc.MakeFunction(func_addr)

I am supposed to use the ctypes.c_int() to wrapper the return value.

            pkgpath_off = read_mem(pkgpath_off_addr, forced_addr_sz=4)
            _debug("pkgpath_off : {}".format( hex(pkgpath_off)))
            # if pkgpath_off > 0: # if error return 0xffffffff 
            if c_int(pkgpath_off).value > 0:
                pkgpath_addr = self.moddata.types_addr + pkgpath_off
                pkgpath_name_obj = Name(pkgpath_addr, self.moddata)

[ERROR] - Failed to find valid segment [.noptrdata]
go bin is https://github.com/0Kee-Team/crawlergo/releases/download/v0.4.0/crawlergo_linux_arm64.zip

C:\Desktop\go_parser-master\go_parser-master\go_parser.py: in method 'create_strlit', argument 2 of type 'size_t'
Traceback (most recent call last):
File "C:\AnalysisTools\IDA_Pro_v7.0\python\ida_idaapi.py", line 553, in IDAPython_ExecScript
execfile(script, g)
File "C:/Desktop/go_parser-master/go_parser-master/go_parser.py", line 52, in
main()
File "C:/Desktop/go_parser-master/go_parser-master/go_parser.py", line 36, in main
pclntab.parse()
File "C:/Desktop/go_parser-master/go_parser-master\pclntbl.py", line 173, in parse
self.parse_funcs()
File "C:/Desktop/go_parser-master/go_parser-master\pclntbl.py", line 125, in parse_funcs
func_st.parse()
File "C:/Desktop/go_parser-master/go_parser-master\pclntbl.py", line 252, in parse
if idc.MakeStr(name_addr, name_addr + len(raw_name_str) + 1):
File "C:\AnalysisTools\IDA_Pro_v7.0\python\idc_bc695.py", line 113, in MakeStr
def MakeStr(ea, endea): return create_strlit(ea, 0 if (endea) == ida_idaapi.BADADDR else endea-ea)
File "C:\AnalysisTools\IDA_Pro_v7.0\python\idc.py", line 695, in create_strlit
return ida_bytes.create_strlit(ea, 0 if endea == BADADDR else endea - ea, get_inf_attr(INF_STRTYPE))
File "C:\AnalysisTools\IDA_Pro_v7.0\python\ida_bytes.py", line 1618, in create_strlit
return _ida_bytes.create_strlit(*args)
TypeError: in method 'create_strlit', argument 2 of type 'size_t'

结构好像不一样了

I use detect it easy scan the program,display Go(1.10.x-1.17.x)[EXEC AMD64-64],when I use go_parser restore,hava error break

G:\IDAPlugins\go_parser\go_parser.py: Failed to find firstmoduledata address!
Traceback (most recent call last):
File "E:\Tools\IDA_Pro_7.7\python\3\ida_idaapi.py", line 580, in IDAPython_ExecScript
exec(code, g)
File "G:/IDAPlugins/go_parser/go_parser.py", line 56, in
main()
File "G:/IDAPlugins/go_parser/go_parser.py", line 29, in main
firstmoddata_addr, magic_number = moduledata.find_first_moduledata_addr()
File "G:\IDAPlugins/go_parser\moduledata.py", line 177, in find_first_moduledata_addr
raise Exception("Failed to find firstmoduledata address!")
Exception: Failed to find firstmoduledata address!

C:\Users\iie-iisd\Desktop\go_parser-master\go_parser.py: invalid syntax (C:/Users/iie-iisd/Desktop/go_parser-master/go_parser.py, line 43)
Traceback (most recent call last):
File "D:\Software\IDA 7.0\IDA 7.0\python\ida_idaapi.py", line 553, in IDAPython_ExecScript
execfile(script, g)
File "C:/Users/iie-iisd/Desktop/go_parser-master/go_parser.py", line 43
common._info(f"pclntbl addr: {firstmoddata.pclntbl_addr:#x}\n")
^
SyntaxError: invalid syntax

C:\Users\xx\Desktop\go_parser-1.0.0-py3\go_parser.py: No module named 'IPython'
Traceback (most recent call last):
File "C:\Users\xx\Desktop\IDA_Pro_v7.5_Portable\python\3\ida_idaapi.py", line 616, in IDAPython_ExecScript
exec(code, g)
File "C:/Users/xx/Desktop/go_parser-1.0.0-py3/go_parser.py", line 24, in
idaapi.require("types_builder")
File "C:\Users\xx\Desktop\IDA_Pro_v7.5_Portable\python\3\ida_idaapi.py", line 161, in require
m = importlib.import_module(modulename, package)
File "importlib_init_.py", line 127, in import_module
File "", line 1014, in _gcd_import
File "", line 991, in _find_and_load
File "", line 975, in _find_and_load_unlocked
File "", line 671, in _load_unlocked
File "", line 783, in exec_module
File "", line 219, in _call_with_frames_removed
File "C:/Users/sky/Desktop/go_parser-1.0.0-py3\types_builder.py", line 12, in
import IPython
ModuleNotFoundError: No module named 'IPython'

I use the go_parser on IDA 7.6 but there an issuse on it. The following is the error report:
File "D:/xxxxxxxx/IDA Pro 7.6/plugins/parse_func.py", line 12, in
start = idc.get_func_attr(here(),FUNCATTR_START)
NameError: name 'here' is not defined

is there some modul i did not install or something other reasen?

by the way, I use local python (version 3.10.8 ).