feat(gotls): support Go binaries built with -ldflags="-s -w"

[wocaolideTwistzz]

Summary

This PR makes gotls work with Go binaries compiled with -ldflags="-s -w" by resolving function addresses and return offsets from Go’s own symbol table when the ELF symbol table is stripped.

Fixes #848.

Background

Currently gotls relies on existing ELF information to locate tls functions.

The standard symbol table and debug info are stripped when Go binaries built with -ldflags="-s -w". The existing logic (findRetOffsets) may fail to locate the needed function and return address. It will be fatal with "symbol not found".

Changes

When parsing non-PIE Go binaries and the origin logic findRetOffsets does not work, it will try to lookup function with goSymTab and maps the funtion entry from virtual address to file offset using the .text section.

This works even when the standard ELF symbol table is stripped, because Go's own symbol table(gosym) is still available.

Testing

• Go version: go version go1.24.6 linux/amd64
• Linux core version: 6.8.0-90-generic
• Test Go binaries

go build -ldflags="-s -w" -o gotls_example

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	resp, err := http.Get("https://www.example.com")
	if err != nil {
		panic(err)
	}

	data, err := io.ReadAll(resp.Body)
	if err != nil {
		panic(err)
	}
	resp.Body.Close()
	fmt.Printf("%s", data)
}

• ecapture tests

sudo ./bin/ecapture gotls --elfpath=/tmp/gotls_example --hex

[dosubot]

Related Documentation

Checked 1 published document(s) in 1 knowledge base(s). No updates required.

^{How did I do? Any feedback?}  

[cfc4n]

LGTM, Thanks.