Does the args command in Delve also show the return value (and not just the function arguments)?

1.3k views Asked by At

During reverse engineering a Golang binary using Delve I was inspecting the full stack in which frame 0 belonged to the Go function strings.genSplit:

(dlv) stack -full
0  0x00000000004a4278 in strings.genSplit
at /usr/lib/go/src/strings/strings.go:266
   s = "my_string" my comment: actual string modified but not the rest of the variables
   sep = ","
   sepSave = 0
   n = 11
   ~r4 = (unreadable empty OP stack)
   a = []string len: 12, cap: 12, [...]
   i = (unreadable could not find loclist entry at 0x9d89c for address 0x4a4278)
   m = (unreadable could not find loclist entry at 0x9da7d for address 0x4a4278)

Now if you look at the documentation for strings.genSplit here, you can see that s, sep, sepSave, and n are the actual (input) arguments while a, i, and m are the local variables of the function. Also

(dlv) goroutine 22 frame 0 locals
a = []string len: 12, cap: 12, [...]
i = (unreadable could not find loclist entry at 0x9d89c for address 0x4a4278)
m = (unreadable could not find loclist entry at 0x9da7d for address 0x4a4278)

and

(dlv) goroutine 22 frame 0 args 
s = "my_string" my comment: actual string modified but not the rest of the variables
sep = ","
sepSave = 0
n = 11
~r4 = (unreadable empty OP stack)

My questions are 1. Is Delve including the return value with the actual function arguments (i.e., inputs)? 2. What do the ~ sign and 4 in ~r4 mean?

1

There are 1 answers

1
NuLo On

trying to answer both your questions in one step.

In go function arguments and results are allocated in the stack on function call, so the return variables are allocated as soon as you call the function.

If you use named return values, delve will show you the variable name, otherwise it will use the internal representation that will start at 0 for the first argument and go on through the return values.

In the case you mention you have 4 arguments that would be r0-r3 and one unnamed return that is r4. The ~ sign denotes an unnamed value and I've only seen it used to also represent ~panic.