1

I have created a very basic golang program which display a message with fmt.Println().

Here is what is see in radare2:

lea rcx, obj.main.statictmp_0 ; 0x4c84b0 ; "y[K"
mov qword [local_48h], rcx
lea rcx, [local_40h]        ; 0x40 ; '@' ; 64
mov qword [rsp], rcx
mov qword [local_8h], 1
mov qword [local_10h], 1
call sym.fmt.Println

I suppose obj.main.statictmp_0 contains my string message.

I have tried:

ps @obj.main.statictmp_0

but it does not display my message. Any idea ?

Thanks

Improve this question
2
  • Well, GO compiled binaries might behave differently than other binaries. Can you share the binary itself? :)
    – Megabeets
    Jan 12, 2019 at 14:38
  • go uses counted string with no zerotermination a pointer and size array struct chararray { char * str , int size } chararray[] = { "foo" ,3 ;.........} so 0x4c84b0 in your case is pointer to string since you are on x64 the next qword that is 0x4c84bc will hold the string length
    – blabb
    Jan 14, 2019 at 17:47

1 Answer 1

Reset to default
0

use pf S @obj.main.statictmp_0. string length is at address @obj.main.statictmp_0+8 if using 64bit or @obj.main.statictmp_0+4 if using 32bit!

pf S @obj.main.statictmp_0   ; gives you string
pf p @obj.main.statictmp_0+8 ; gives you string length
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.