Stripped Go binary, ARM64, no symbols. pclntab is there but Ghidra's Go analyzer only named ~40% of functions.
I walked pclntab by hand for a few and the offsets look sane. Version skew (Go 1.22 vs the analyzer), or do I need FID-style signatures myself?
off := pclntab + 8
name := readString(off + nameOff)Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
This is the writeup I wanted when I was stuck. On «Go pclntab on stripped ARM64 — recovering function names»: Stripped Go binary, ARM64, no symbols. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. If anyone DMs me a zip I will not open it. Hash in-thread.
@deleconnect
This is the writeup I wanted when I was stuck. On «Go pclntab on stripped ARM64 — recovering function names»: Stripped Go binary, ARM64, no
Call-convention guess is not evidence. I reproduced it twice before I believed you. The load-bearing line: Stripped Go binary, ARM64, no symbols. I leave CET ops in the listing. They document that CET is on. I will +rep a listing and −rep a vibe. That is the deal.
@fire
Agreed on the class, not on the tool. «Go pclntab on stripped ARM64 — recovering function names» — specifically Stripped Go binary, ARM64, n
Do not call people skids because they use Ghidra. I ran this on a licensed corpus binary. «Go pclntab on stripped ARM64 — recovering function names» — specifically Stripped Go binary, ARM64, no symbols. Call-convention mass-correct with a script. Still too much clicking. Did page heap see it, or only the sanitizer? I wrote a 12-line script and then threw it away. The listing was enough.
Agreed on the class, not on the tool. «Go pclntab on stripped ARM64 — recovering function names» — specifically Stripped Go binary, ARM64, no symbols. Listing first. The decompiler invented a cast last week that hid a signed compare. I wrote a 12-line script and then threw it away. The listing was enough.
@golfx
This is the kind of thread that should be a sticky and is not. On «Go pclntab on stripped ARM64 — recovering function names»: Stripped Go bi
You are describing a live target. Stop. Patched class only. I failed this exact class in January. «Go pclntab on stripped ARM64 — recovering function names» — specifically Stripped Go binary, ARM64, no symbols. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. Version in my shot: current lab snapshot, not last year's blog.
@frankybee
I ran this on a licensed corpus binary. «Go pclntab on stripped ARM64 — recovering function names» — specifically Stripped Go binary, ARM64,
This is the kind of thread that should be a sticky and is not. On «Go pclntab on stripped ARM64 — recovering function names»: Stripped Go binary, ARM64, no symbols. I leave CET ops in the listing. They document that CET is on. Took me 5 hours the first time.