Vector35 / Vector35/binaryninja-api

Go pclntab Parser for Stripped Binaries

Open
#6,985 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: DebugInfo Effort: Medium File Format: ELF Impact: Medium Language: Go
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

What is the feature you'd like to have?
I would like Binary Ninja to automatically detect, parse, and utilize the pclntab (PC line table) structure in Go binaries, especially when the binary has been stripped of debug symbols. The feature should:

  • Automatically locate the pclntab structure within Go binaries (both stripped and unstripped)
  • Parse the pclntab to extract function names, source file paths, and line number mappings
  • Restore function symbols and naming in the disassembly view
  • Provide source code line number information where available
  • Handle different Go compiler versions and their varying pclntab formats
  • Integrate seamlessly with Binary Ninja's existing Go binary analysis capabilities

Is your feature request related to a problem?
Yes, this addresses a significant challenge when analyzing stripped Go binaries. Without pclntab parsing, analysts must:

  • Manually identify and name functions
  • Lose valuable context about the original source structure
  • Spend significantly more time understanding the binary's functionality
  • Miss connections between related functions that would be obvious with proper naming

Are any alternative solutions acceptable?
External tool integration: The GoReSym plugin can be used manually, but this fails to resolve all symbols and creates an additional manual step.

Additional Information:

  • The pclntab structure varies between Go versions, with significant changes around Go 1.2, 1.16, and 1.18+
  • Tools like IDA parses the pclntab out of the box
  • The pclntab typically begins with a magic number (0xFFFFFFFB or 0xFFFFFFFA) making it relatively straightforward to locate
  • Go binaries also contain a moduledata structure that can provide additional metadata
  • This feature would complement Binary Ninja's existing Go string recovery and type analysis
  • Reference implementations exist in open-source tools like redress and GoReSym

Sample Go binary characteristics that could benefit from this feature:

  • Stripped binaries compiled with go build -ldflags="-s -w"
  • Production Go applications where symbol information is crucial for security analysis
  • Malware written in Go where function identification significantly aids analysis

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing Binary Ninja's existing Go string recovery and type analysis, then compare the reference implementations in redress and GoReSym. Define support for locating and parsing pclntab across the listed Go version ranges, restoring symbols and line information, and handling stripped binaries; completion should include integration with existing Go analysis.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
reverse-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.