binfile

package
v0.3.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 14, 2026 License: MIT Imports: 25 Imported by: 0

Documentation

Overview

Package binfile loads an executable (ELF or Mach-O) and exposes the bits the explorer needs through a single, format-neutral model: header info, sections, symbols, address→source mapping, and continuous virtual-address / raw-file byte images for the hex and disassembly views.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func DemangleName 

func DemangleName(name string) string

DemangleName returns the human-readable form of a single mangled C++/Rust symbol (Itanium/Rust only — no Swift, which needs the batch tool), or "" when name isn't a recognised mangling. It lets callers demangle on demand (e.g. the streaming disassembly dump labels functions one at a time) without running the whole-table ComputeDemangled pass.

func DwarfLanguageNames 

func DwarfLanguageNames() []string

DwarfLanguageNames returns the distinct, sorted set of source-language names exex can identify from DWARF. Exposed so the syntax package's coverage test can verify each has a curated highlighter (or an explicit minimal-fallback).

func IsArchive 

func IsArchive(raw []byte) bool

IsArchive reports whether raw begins with the ar magic.

func IsExecSection 

func IsExecSection(s *Section) bool

IsExecSection reports whether a section is executable (eligible for disasm).

Types

type ArchiveMember 

type ArchiveMember struct {
	Name string
	Data []byte
}

ArchiveMember is one object stored in an ar archive: its name and a sub-slice of the archive image (no copy).

func ArchiveMembers 

func ArchiveMembers(raw []byte) ([]ArchiveMember, error)

ArchiveMembers parses an ar archive image into its object members, skipping the archive's own bookkeeping members (symbol table, name table).

func OpenArchive 

func OpenArchive(path string) (members []ArchiveMember, closer func() error, err error)

OpenArchive maps an ar archive at path and returns its object members (slicing into the mapping) plus a closer that releases it; the members must not be used after the closer runs.

type FatArchInfo 

type FatArchInfo struct {
	Name   string // conventional CPU name, e.g. "x86_64", "arm64"
	Type   string // Mach-O file type: "Exec", "Dylib", …
	Bits   int    // 32 or 64
	Offset uint64 // file offset where the slice begins
	Size   uint64 // slice size in bytes
}

FatArchInfo summarises one architecture slice of a universal (fat) Mach-O, for the Info view's per-architecture listing.

type File 

type File struct {
	Path     string
	Format   Format
	Sections []Section
	Segments []Segment // loadable memory regions (ELF program headers / Mach-O segments); empty for PE
	Symbols  []Symbol  // sorted by Name
	Info     *Info

	// Fat (universal) Mach-O: the names of every architecture slice, the one
	// currently loaded, and per-slice details for the Info view. FatArches is
	// empty for thin binaries and non-Mach-O.
	FatArches    []string
	FatArch      string
	FatArchInfos []FatArchInfo
	// contains filtered or unexported fields
}

File is the format-neutral representation of one loaded binary.

func NewRawFile 

func NewRawFile(raw []byte) *File

NewRawFile returns a File backed by raw bytes with no parsed structure — for tests and callers that synthesize a byte image (e.g. to use Strings).

func Open 

func Open(path string, opts ...Option) (*File, error)

Open reads path, detects its container format, and builds the neutral model.

func OpenBytes 

func OpenBytes(name string, raw []byte) (*File, error)

OpenBytes builds the neutral model from an in-memory image (no file mapping), labelled by name. Used for objects that aren't standalone files — e.g. the members of a static-library (ar) archive. The caller owns raw and must keep it alive for the lifetime of the returned File (its sections slice into it).

func (*File) AddrDisassemblable 

func (f *File) AddrDisassemblable(addr uint64) bool

AddrDisassemblable reports whether addr falls inside any section with file content (the disasm-all image) — i.e. it could be shown in disasm-all mode even if it isn't in an executable section (kernel/multiboot sections, data, …).

func (*File) AddrHexWidth 

func (f *File) AddrHexWidth() int

AddrHexWidth is the number of hex digits an address should be printed with. With the compact-addresses preference set, a 64-bit binary whose addresses all fit in 32 bits prints 8 digits instead of 16; the true word size is unaffected (see PointerBytes). It's a plain read of the cached width — the work happens in SetCompactAddr, not on this hot path.

func (*File) ApplyDemangled 

func (f *File) ApplyDemangled(d []string)

ApplyDemangled stores the result of ComputeDemangled onto the symbols. Run it on the File's owning goroutine.

func (*File) Arch 

func (f *File) Arch() arch.Arch

Arch returns the CPU architecture for this binary.

func (*File) ClearDemangled 

func (f *File) ClearDemangled()

ClearDemangled drops every symbol's demangled form in place, so Display falls back to the raw mangled name. It avoids ApplyDemangled's allocations (no names slice, no name→demangled map), which matters when toggling demangling off on a binary with hundreds of thousands of symbols.

func (*File) Close 

func (f *File) Close() error

Close releases the file mapping. Safe to call more than once; afterwards the raw bytes (and anything slicing into them) must not be used.

func (*File) Compiler 

func (f *File) Compiler() string

Compiler returns the compiler banner ("Apple clang …", "GCC …", "rustc …"), computed lazily on first call and cached. ELF fills Info.Compiler eagerly from .comment during Open (cheap); Mach-O defers the section scan to here so a cold Open doesn't page through __cstring/__const just to populate the Info view.

func (*File) ComputeDemangled 

func (f *File) ComputeDemangled() []string

ComputeDemangled returns the demangled form of every symbol name, indexed like f.Symbols ("" when a name isn't mangled). It only reads names, so it is safe to run on a background goroutine; apply the result with ApplyDemangled on the goroutine that owns the File. Demangling a large symbol table (Rust/C++/Swift binaries carry 100k+ mangled names) dominates load time, and demangle.Filter is pure, so the C++/Rust pass is fanned out across cores.

func (*File) DebugPath 

func (f *File) DebugPath() string

DebugPath returns the explicit external debug-symbols path (--debug), or "".

func (*File) DisasmAll 

func (f *File) DisasmAll() bool

DisasmAll reports whether disasm-all mode is active.

func (*File) Entry 

func (f *File) Entry() uint64

Entry returns the entry-point virtual address.

func (*File) ExecImage 

func (f *File) ExecImage() *Image

ExecImage returns the byte source the disassembler sweeps: normally just the executable sections, but every section with file content when disasm-all mode is enabled (so object files and non-exec sections can still be decoded). Built lazily; both variants are cached.

func (*File) HasDWARF 

func (f *File) HasDWARF() bool

HasDWARF reports whether DWARF info was loaded.

func (*File) HasExecCode 

func (f *File) HasExecCode() bool

HasExecCode reports whether the file has any executable section to disassemble in the normal (exec-only) image — false for most relocatable object files.

func (*File) HasPhysAddrs 

func (f *File) HasPhysAddrs() bool

HasPhysAddrs reports whether any section carries a distinct load/physical address (a higher-half kernel, say) — so a caller can offer to interpret a typed address as physical.

func (*File) HasRelocs 

func (f *File) HasRelocs() bool

HasRelocs reports whether the binary has any relocation entries. When the loader could determine that no relocation data exists, this stays cheap and does not force the lazy relocation build.

func (*File) HeaderInfo 

func (f *File) HeaderInfo() []string

HeaderInfo returns the container header as a list of "Label: value" lines.

func (*File) IncludeInDisasmAll 

func (f *File) IncludeInDisasmAll(s *Section) bool

IncludeInDisasmAll reports whether a section belongs in a disasm-all sweep.

The disasm image is one monotonic address space, so it must stay coherent:

  • Metadata (symbol/string/debug/note/dynamic/relocation) is never code and lives at address 0; mixing it with real-VA code makes a window spanning the 0 → high-VA jump decode to junk. Always excluded.
  • For a linked file (one with mapped executable code), include only the ALLOCATED sections — the actual loaded image: code plus non-exec loaded data (.multiboot, .rodata, .data). Non-allocated leftovers (.comment, …) sit at address 0 and would poison the space, so they're dropped.
  • For an object file (no mapped exec code; e.g. a Mach-O .o whose __text isn't flagged allocated), include code/data content sections at their sequential 0-based addresses — there's no real VA to conflict with.

func (*File) IsMapped 

func (f *File) IsMapped(addr uint64) bool

IsMapped reports whether addr falls inside any mapped section.

func (*File) IsRelocatable 

func (f *File) IsRelocatable() bool

IsRelocatable reports whether the file is a relocatable object (ELF ET_REL / Mach-O MH_OBJECT) — a cheap flag set at load. Only such files carry relocations against code operands (a linked image's dynamic relocs patch GOT/data, never instructions), so the disasm reloc annotation is gated on this to avoid forcing the (potentially large) reloc build on a linked binary that never needs it.

func (*File) LineColumns 

func (f *File) LineColumns(file string, line int) []int

LineColumns returns the distinct, sorted DWARF columns (>0) recorded for file:line — the positions within the line that code maps to.

func (*File) LineToAddr 

func (f *File) LineToAddr(file string, line int) (uint64, bool)

LineToAddr returns an address that maps to file:line — the lowest address at the exact line when possible, otherwise the lowest address of the nearest mapped line at or after it in the same file.

func (*File) LookupAddr 

func (f *File) LookupAddr(addr uint64) (string, int)

LookupAddr returns the source file:line covering addr, or "", 0.

func (*File) LookupAddrCol 

func (f *File) LookupAddrCol(addr uint64) (file string, line, col int)

LookupAddrCol is LookupAddr plus the DWARF column (0 when unknown).

func (*File) LowerNames 

func (f *File) LowerNames() (names, demangled []string)

LowerNames returns per-symbol lowercased Name and Demangled slices, indexed like f.Symbols (an entry is "" when the symbol has no demangled form). It is built once and reused so case-insensitive filtering doesn't re-lowercase the whole table on every keystroke. Call on the File's owning goroutine; ApplyDemangled invalidates the cache.

func (*File) MappedLines 

func (f *File) MappedLines(file string) map[int]bool

MappedLines returns the set of line numbers in file that have any machine code mapped to them.

func (*File) MaxAddr 

func (f *File) MaxAddr() uint64

MaxAddr returns the highest meaningful virtual address in the file (the end of the highest section/segment, the largest symbol address, and the entry point), scanned once. Used to decide whether compact addresses are safe.

func (*File) NextSymbol 

func (f *File) NextSymbol(addr uint64, pred func(Symbol) bool) (Symbol, bool)

NextSymbol returns the first symbol (by address) strictly after addr that satisfies pred (a nil pred accepts any symbol). symByAddr is sorted by Addr, so it binary-searches to the first candidate and scans only from there.

func (*File) PhysToVirtual 

func (f *File) PhysToVirtual(phys uint64) (uint64, bool)

PhysToVirtual maps a physical/load (LMA) address to its virtual address via the section whose load range contains it; ok is false when none does. Used to jump to a physical address in a binary whose VMA differs from its LMA.

func (*File) PointerBytes 

func (f *File) PointerBytes() int

PointerBytes is the binary's true pointer width in bytes (8 for 64-bit, 4 for 32-bit) — independent of the compact-addresses display preference, so word decoding stays correct even when addresses print narrow.

func (*File) PrevSymbol 

func (f *File) PrevSymbol(addr uint64, pred func(Symbol) bool) (Symbol, bool)

PrevSymbol returns the last symbol (by address) strictly before addr that satisfies pred (a nil pred accepts any symbol). symByAddr is sorted by Addr, so it binary-searches to the last candidate and scans only from there.

func (*File) Raw 

func (f *File) Raw() []byte

Raw returns the entire file contents (source for the raw hex view).

func (*File) RawHeader 

func (f *File) RawHeader() []HeaderField

RawHeader returns the raw container-header fields (ELF e_*, Mach-O mach_header, PE COFF/optional header), or nil if none were collected.

func (*File) Relocations 

func (f *File) Relocations() []Reloc

Relocations returns the binary's relocation entries, building them on first call. The slice may be empty (e.g. a fully-resolved static binary). A linked Mach-O's dyld bind/rebase and chained fixups are decoded (machoDynamicFixups), not just the object-file per-section relocs the standard library exposes.

func (*File) RelocsInRange 

func (f *File) RelocsInRange(lo, hi uint64) []Reloc

RelocsInRange returns the relocations whose patched address falls in [lo, hi), via a lazily-built address-sorted index — so the disasm/hex views can annotate the instruction or byte a relocation lands on without scanning the whole list.

func (*File) ScanSourceLines 

func (f *File) ScanSourceLines(name string, yield func(string) bool) bool

ScanSourceLines streams one resolved source file without populating the display cache. It is used by cross-file grep, where caching every scanned file would retain an entire source tree after one query.

func (*File) ScanStrings 

func (f *File) ScanStrings(emit func(StringEntry) error) error

ScanStrings walks printable strings in file order and calls emit for each one, without populating the retained Strings cache. Small inputs stream directly; large inputs scan chunks in parallel but emit them in file order using reusable per-worker buffers, so memory is bounded by worker count rather than file size.

func (*File) SectionAt 

func (f *File) SectionAt(addr uint64) *Section

SectionAt returns the mapped section whose VM range covers addr.

func (*File) SetCompactAddr 

func (f *File) SetCompactAddr(on bool)

SetCompactAddr enables or disables the narrowed 64-bit address display and recomputes the cached print width. It is a pure display preference; the disasm/hex/list views all read AddrHexWidth, so one call re-flows every address column consistently. The MaxAddr scan only runs when compaction is requested (the && short-circuits otherwise), so turning it off costs nothing.

func (*File) SetDisasmAll 

func (f *File) SetDisasmAll(on bool)

SetDisasmAll switches ExecImage between executable-only and all-sections-with- content. Disasm callers must rebuild any image-derived state after toggling.

func (*File) SourceExists 

func (f *File) SourceExists(name string) bool

SourceLines returns the source file's lines, searching common locations. SourceExists reports whether the source file name resolves to a readable file on disk, using the same candidate resolution as SourceLines but only stat-ing (cheap) rather than reading. Result is cached.

func (*File) SourceFiles 

func (f *File) SourceFiles() []string

SourceFiles returns the sorted, de-duplicated set of source files referenced by the DWARF line table. It does not retain address rows, so the detailed line table stays lazy until source-aware disassembly needs it.

func (*File) SourceLines 

func (f *File) SourceLines(name string) []string

func (*File) StringBytes 

func (f *File) StringBytes(e StringEntry) []byte

StringBytes returns e's bytes as a zero-copy slice into the file image. Valid only while f is open (its raw bytes are still mapped/retained); for scanning many entries (the filter) this avoids any allocation.

func (*File) StringText 

func (f *File) StringText(e StringEntry) string

StringText returns e's text as a string (a copy). Use it for display of the visible rows and the clipboard; prefer StringBytes when scanning many entries.

func (*File) Strings 

func (f *File) Strings() []StringEntry

Strings scans the whole file for runs of printable ASCII at least minString bytes long. The result is cached. Each entry is mapped back to a virtual address / section when its offset falls inside a section's file bytes.

func (*File) SymbolAt 

func (f *File) SymbolAt(addr uint64) (Symbol, bool)

SymbolAt returns the symbol whose extent covers addr.

func (*File) SymbolRangeIter 

func (f *File) SymbolRangeIter(from uint64, to uint64) SymbolRangeIter

func (*File) SymbolsInRange 

func (f *File) SymbolsInRange(from uint64, to uint64) []Symbol

SymbolsInRange returns address-indexed symbols that overlap [from, to).

func (*File) SyntheticAddrs 

func (f *File) SyntheticAddrs() bool

SyntheticAddrs reports whether section/symbol addresses are a synthetic layout exex assigned because the file is a relocatable object whose sections all load at address 0 (so they'd otherwise collide). The real position of any address is section-relative: addr − SectionAt(addr).Addr within that section.

func (*File) VAImage 

func (f *File) VAImage() *Image

VAImage returns the flattened image of every mapped section, built lazily.

type Format 

type Format string

Format identifies the container the binary was loaded from. 

const (
	FormatELF   Format = "ELF"
	FormatMachO Format = "Mach-O"
	FormatPE    Format = "PE"
)

type HeaderField 

type HeaderField struct {
	Name  string
	Value string
}

HeaderField is one raw header entry: a field name and its formatted value.

type Image 

type Image struct {
	Regions []Region
	// contains filtered or unexported fields
}

Image is a logical byte stream stitched together from several sections in virtual-address order, with the gaps between them removed. It lets the hex and disasm views scroll across *all* mapped (or all executable) sections as one stream while still recovering the real virtual address of any byte.

The bytes are NOT copied into one buffer: each region keeps a slice into the original (mmap'd or read) file image, so building an Image is allocation-free and a 100 MB binary doesn't cost a second 50 MB of heap. Callers read bytes through At/Bytes/Window; Bytes is zero-copy when the range stays inside one region (the common case — one section usually dominates) and copies only a bounded range that straddles a region boundary.

Regions are sorted by both Addr and Off (Off is assigned sequentially as regions are appended in address order, so the two orderings coincide).

func NewImage 

func NewImage(data []byte, regions []Region) *Image

NewImage builds an Image from a single contiguous backing slice and its regions: each region's bytes are data[Off:Off+Size]. Used by tests and callers that already hold the bytes contiguously. buildImage uses the per-section slices directly instead.

func (*Image) AddrAt 

func (im *Image) AddrAt(pos int) uint64

AddrAt maps a byte position within Data to its virtual address.

func (*Image) At 

func (im *Image) At(pos int) byte

At returns the byte at logical position pos (0 when out of range).

func (*Image) Bytes 

func (im *Image) Bytes(start, end int) []byte

Bytes returns the logical bytes in [start,end). It is zero-copy when the range lies within a single region (the common case); a range straddling a region boundary is copied into a fresh bounded buffer.

func (*Image) Len 

func (im *Image) Len() int

Len is the total number of bytes in the image.

func (*Image) PosForAddr 

func (im *Image) PosForAddr(addr uint64) (int, bool)

PosForAddr maps a virtual address to its byte position within Data, reporting whether addr falls inside any region.

func (*Image) RegionAt 

func (im *Image) RegionAt(pos int) *Region

RegionAt returns the region containing pos, or nil.

func (*Image) Runs 

func (im *Image) Runs() []Run

Runs returns the image's regions as native byte runs, in offset order.

func (*Image) Window 

func (im *Image) Window(start, size int) Window

Window returns a clamped byte window into the image. Data is zero-copy when the window stays within one region (see Bytes).

func (*Image) WindowContaining 

func (im *Image) WindowContaining(addr uint64, size, before int) (Window, bool)

WindowContaining returns a clamped byte window that contains addr, with up to before bytes of context preceding it.

type Info 

type Info struct {
	Interp       string   // program interpreter / dynamic linker
	DynamicLibs  []string // shared libraries this binary depends on
	RPath        []string // rpath search entries (legacy DT_RPATH)
	RunPath      []string // runpath search entries (DT_RUNPATH / LC_RPATH)
	SoName       string   // own install name / SONAME if this is a library
	BuildID      string   // hex build-id / UUID
	Stripped     bool     // no symbol table present
	StaticLinked bool     // no interpreter / no dynamic libs
	Libc         LibcInfo

	// Overview / triage (format-neutral; filled by computeOverview).
	FileSize uint64 // on-disk size in bytes
	MappedLo uint64 // lowest mapped virtual address
	MappedHi uint64 // end of the highest mapped section
	CodeSize uint64 // sum of executable section sizes

	// Layout details filled by the format loaders.
	WordBits  int    // 32 or 64
	ByteOrder string // "little-endian" / "big-endian"
	Segments  int    // ELF program headers / Mach-O load commands

	// Hardening.
	PIE     Tristate
	NX      Tristate // non-executable stack
	RELRO   string   // "none" | "partial" | "full" (ELF only)
	Canary  bool     // stack-protector present
	Fortify bool     // _FORTIFY_SOURCE (*_chk) present

	// Mach-O specifics.
	CodeSigned bool
	Encrypted  bool
	MinOS      string // e.g. "macOS 13.0"
	SDK        string // e.g. "13.1"

	// Toolchain / provenance.
	Compiler   string // .comment / "Apple clang version …"
	GoVersion  string // from Go build info
	GoModule   string
	GoVCS      string // VCS revision (+ " (dirty)")
	SourceLang string // from DWARF, else inferred from symbols
}

Info holds dynamic-linking and identity bits collected at Open() time. Everything is best-effort: missing data leaves the corresponding field zero. The set of fields is format-neutral; each loader fills what its container can provide (e.g. Mach-O has no .interp, so Interp stays empty there).

type LibcInfo 

type LibcInfo struct {
	Kind    string // "glibc" | "musl" | "uClibc" | "bionic" | "libSystem" | "unknown" | "none"
	Source  string // how we identified it ("interp", "needed", "symbol", "rodata-fingerprint")
	Version string // optional, e.g. "2.35"
}

LibcInfo identifies the C runtime the binary links against.

type Option 

type Option func(*openOptions)

Option customises how Open loads a binary.

func WithArch 

func WithArch(name string) Option

WithArch selects which slice of a universal (fat) Mach-O to load, by name (e.g. "x86_64", "arm64"). Empty (the default) picks the host architecture, or the first slice. Ignored for thin Mach-O and other formats.

func WithDebugPath 

func WithDebugPath(p string) Option

WithDebugPath points the loader at an explicit external debug-symbols file or directory (an ELF .debug companion, or a .dSYM bundle / DWARF file for Mach-O), tried before the conventional auto-discovered locations.

func WithLayoutOnly 

func WithLayoutOnly() Option

WithLayoutOnly loads just the container layout: architecture, entry, sections, segments and raw bytes. It skips symbols, imports, relocations, DWARF and the overview fields, for views that do not need them.

type Region 

type Region struct {
	Addr uint64 // virtual address of the first byte
	Size uint64 // number of bytes (== len(b))
	Off  int    // offset of the first byte within the logical stream
	Name string
	// contains filtered or unexported fields
}

Region records where one section landed inside the flattened image.

type Reloc 

type Reloc struct {
	Offset    uint64 // address (or file offset) the relocation patches
	Type      string // relocation type name, e.g. "R_X86_64_JUMP_SLOT"
	Sym       string // target symbol name, or "" when the entry has none
	Addend    int64  // RELA addend (ELF) or 0
	HasAddend bool   // whether Addend is meaningful (RELA entries)
	Section   string // section the relocation lives in (.rela.plt, __got, .reloc, …)
	Lib       string // resolved owning library for the symbol, when known
}

Reloc is one relocation entry, normalised across container formats.

type Run 

type Run struct {
	Off int
	B   []byte
}

Run is one region's contiguous native bytes (zero-copy, a slice into the file image) with its logical start offset. Whole-image scans iterate Runs so bytes.Index/IndexByte run on the real bytes at full speed, region by region, instead of fixed-size chunks (which hit bytes.Index's small-slice slow path).

type Section 

type Section struct {
	Name      string
	Addr      uint64
	PhysAddr  uint64 // load/physical address (LMA); 0 when same as Addr or unknown
	SynthAddr bool   // Addr is a synthetic layout address (relocatable object); real address is 0
	Size      uint64 // in-memory size
	Offset    uint64 // file offset of the bytes
	FileSize  uint64 // bytes actually present in the file
	TypeName  string // short type label for the table ("PROGBITS", "__text", …)
	Flags     string // short flag string ("AX", "r-x", …)
	Category  SectionCategory
	Alloc     bool // occupies memory at runtime (has a virtual address)
	Exec      bool // executable
	Write     bool // writable
}

Section is one named region of the file, in a format-neutral shape. Addr is the load (virtual) address, 0 when the section is not mapped. Offset/FileSize describe where its bytes live in the file (FileSize == 0 for BSS-style zero-fill sections that occupy no file space).

type SectionCategory 

type SectionCategory uint8

SectionCategory drives section-table row colouring without leaning on format-specific section types. 

const (
	CatOther   SectionCategory = iota
	CatText                    // executable code
	CatData                    // writable data
	CatBSS                     // zero-initialised data
	CatRodata                  // read-only allocated data
	CatTLS                     // thread-local storage
	CatDebug                   // DWARF / debug info
	CatNote                    // notes / build metadata
	CatSymtab                  // symbol & string tables
	CatDynamic                 // dynamic-linking metadata
	CatReloc                   // relocations
)

type Segment 

type Segment struct {
	Name     string // type label: "LOAD", "DYNAMIC", "__TEXT", …
	Addr     uint64 // virtual address (0 when not mapped)
	PhysAddr uint64 // physical/load address (ELF p_paddr); 0 when same as Addr or unknown
	Size     uint64 // in-memory size
	Offset   uint64 // file offset of the bytes
	FileSize uint64 // bytes present in the file
	Align    uint64 // alignment (0 when unknown)
	R, W, X  bool   // permissions
}

Segment is a loadable region of the program's memory image — an ELF program header (PT_LOAD, …) or a Mach-O segment (__TEXT, …). Sections live inside segments; this is the coarser memory-map level. Not all formats have segments (PE has none), so Segments may be empty.

func (Segment) Perms 

func (s Segment) Perms() string

Perms renders the segment's permission bits as an "rwx" string.

type StringEntry 

type StringEntry struct {
	Offset  uint64 // file offset of the first byte
	Addr    uint64 // mapped virtual address, when HasAddr
	Len     uint32 // length of the run in bytes
	HasAddr bool
	Section string // owning section name, when known
}

StringEntry is one printable run found in the file. The bytes themselves are not copied: Offset+Len point into the file image (f.raw), and StringText / StringBytes recover the text on demand. This keeps the strings list cheap even on binaries with millions of strings (a Text copy would duplicate tens of MB of the file on the heap).

type SymBind 

type SymBind uint8

SymBind is a format-neutral symbol binding/scope. 

const (
	BindLocal SymBind = iota
	BindGlobal
	BindWeak
)

type SymKind 

type SymKind uint8

SymKind is a format-neutral symbol category. Both ELF symbol types and the looser Mach-O symbol table are mapped onto these so the UI can colour and route a symbol without knowing where it came from. 

const (
	SymOther   SymKind = iota
	SymFunc            // executable code
	SymObject          // data object
	SymSection         // names a whole section
	SymFile            // source filename
	SymTLS             // thread-local storage
	SymCommon          // uninitialised common block
)

type Symbol 

type Symbol struct {
	Name      string
	Demangled string
	Addr      uint64
	Size      uint64
	Kind      SymKind
	Bind      SymBind
	Section   string
	Library   string // for imports: the shared library this symbol is bound to
	// RealOff is the symbol's real position within its section (st_value) when the
	// file uses a synthetic address layout (a relocatable object); Addr is then the
	// synthetic address exex assigned. Both equal Addr otherwise.
	RealOff uint64
}

Symbol is a format-neutral symbol. Name is the raw (possibly mangled) name as stored in the file; Demangled holds the human-readable form when the name was a recognised C++/Rust mangling, else "".

func (Symbol) Display 

func (s Symbol) Display() string

Display returns the demangled name when available, else the raw name.

type SymbolRangeIter 

type SymbolRangeIter struct {
	// contains filtered or unexported fields
}

SymbolRangeIter walks address-indexed symbols that overlap a half-open address range without allocating a result slice.

func (*SymbolRangeIter) Next 

func (it *SymbolRangeIter) Next() (Symbol, bool)

type Tristate 

type Tristate uint8

Tristate is a yes/no/unknown flag for hardening features we can't always determine. 

const (
	TriUnknown Tristate = iota
	TriYes
	TriNo
)

func (Tristate) String 

func (t Tristate) String() string

String returns "yes", "no", or "unknown" for display.

type Window 

type Window struct {
	Addr  uint64
	Data  []byte
	Start int
	End   int
}

Window is a bounded slice of an Image. Start/End are byte positions within Image.Data; End is exclusive.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.