0

I have created a very basic golang program which display a message with fmt.Println().

Here is what is see in radare2:

lea rcx, obj.main.statictmp_0 ; 0x4c84b0 ; "y[K"
mov qword [local_48h], rcx
lea rcx, [local_40h]        ; 0x40 ; '@' ; 64
mov qword [rsp], rcx
mov qword [local_8h], 1
mov qword [local_10h], 1
call sym.fmt.Println

I suppose obj.main.statictmp_0 contains my string message.

I have tried:

ps @obj.main.statictmp_0

but it does not display my message. Any idea ?

Thanks

  • Well, GO compiled binaries might behave differently than other binaries. Can you share the binary itself? :) – Megabeets Jan 12 at 14:38
  • go uses counted string with no zerotermination a pointer and size array struct chararray { char * str , int size } chararray[] = { "foo" ,3 ;.........} so 0x4c84b0 in your case is pointer to string since you are on x64 the next qword that is 0x4c84bc will hold the string length – blabb Jan 14 at 17:47
0

use pf S @obj.main.statictmp_0. string length is at address @obj.main.statictmp_0+8 if using 64bit or @obj.main.statictmp_0+4 if using 32bit!

pf S @obj.main.statictmp_0   ; gives you string
pf p @obj.main.statictmp_0+8 ; gives you string length

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.