Thank you all. I was looking at the same goal, having collected stack traces from eBPF helper with IPs.
With debug/elf I've been able to resolve symbols for the use cases I tested, thank you Ian. In example the right symbol is the one that satisfy ip >= sym.Value && ip < (sym.Value+sym.Size) (where sym comes from elfBinary.Symbols()). Il giorno mercoledì 3 aprile 2024 alle 13:25:14 UTC+2 TheDiveO ha scritto: > Thank you Ian! > > Not sure yet if I found something useful related to the real process > addresses/offsets, but at least the "bcc" sources have one > "bcc_elf_get_text_scn_info()" that returns the address and offset of the > ".text" section. > > On Tuesday, April 2, 2024 at 8:01:11 PM UTC+2 Ian Lance Taylor wrote: > >> On Tue, Apr 2, 2024 at 2:35 AM 'TheDiveO' via golang-nuts >> <golan...@googlegroups.com> wrote: >> > >> > On Linux, given an arbitrary binary executable with symbol information >> in the executable, how can I lookup an instruction pointer address to get >> the corresponding symbol name? >> > >> > The binary (and its process) isn't a Go binary, but any arbitrary >> executable. The stack unwinding has already been done, so I'm presented >> with a list of instruction pointer addresses (return addresses) which I >> need to convert to more useful symbol names. >> > >> > I've seen the stdlib's debug/elf package, but I lack the ELF knowledge >> to press the elf package's knobs in the right order. Any examples of how to >> use debug/elf, and is it even the right package to use in this case? >> >> debug/elf is the package to use. You'll want to call the Symbols >> method and look through the Symbols for one whose Value is <= the PC >> you want while Value+Size is > the PC you want. >> >> If you are looking at runtime PC's from a stack trace, be aware that >> on most systems these days programs are position-independent, so there >> will be an offset between the addresses in the binary and the >> addresses from the stack trace. I don't know offhand of a standard >> way to figure out that offset. >> >> Ian >> > -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/1358fa4c-1c1a-426e-a859-37a2070fdaacn%40googlegroups.com.
