debug/gosym.PCToLine breaks on cgo enabled binaries

[Grant Seltzer Richman]

I've been using the `Table.PCToLine` method to resolve program counters (extracted via bpf) into functions with their file names and line numbers.

It appears that this breaks when i'm testing it on a binary that has cgo enabled. It does not fix it by compiling the binary statically.

Another issue I have with this API is that creating the Table requires passing the `.gosymtab` which of course is empty. Cgo binaries don't even have it so I just pass an empty slice. 

Does anyone have alternatives to this package or possible explanations to why these issues exist?

Thanks so much,

Grant

[Grant Seltzer Richman]

I should clarify that by "breaks" I mean that it resolves to the incorrect function. I've disassembled the binary to check that i'm passing the correct PC, but the method resolves to unrelated functions.

[Ian Lance Taylor]

When using cgo the final executable is generated by the C linker. If
that process uses -fpie, as is the default on some systems, PCToLine
may not work.

Have you tried using runtime.FuncForPC?

Ian

[Grant Seltzer Richman]

Yea that makes sense, my theory is that the C linker is adding symbols to the text section before runtime.text as theorized here: https://github.com/golang/go/issues/65232#issuecomment-1908498616
 

Have you tried using runtime.FuncForPC?

I can't do so because i'm running the analysis from a separate process. The bpf program is attached to the traced process and that collects the program counters to send to the analysis process. The analysis process has the binary open of the traced process.

I've decided to use DWARF instead which is working well and is even convenient for resolving inlined functions.
 

Ian