user process instruction pointer symbol lookup

[TheDiveO]

On Linux, given an arbitrary binary executable with symbol information in the executable, how can I lookup an instruction pointer address to get the corresponding symbol name?

The binary (and its process) isn't a Go binary, but any arbitrary executable. The stack unwinding has already been done, so I'm presented with a list of instruction pointer addresses (return addresses) which I need to convert to more useful symbol names.

I've seen the stdlib's debug/elf package, but I lack the ELF knowledge to press the elf package's knobs in the right order. Any examples of how to use debug/elf, and is it even the right package to use in this case?

[Ian Lance Taylor]

debug/elf is the package to use. You'll want to call the Symbols
method and look through the Symbols for one whose Value is <= the PC
you want while Value+Size is > the PC you want.

If you are looking at runtime PC's from a stack trace, be aware that
on most systems these days programs are position-independent, so there
will be an offset between the addresses in the binary and the
addresses from the stack trace. I don't know offhand of a standard
way to figure out that offset.

Ian

[TheDiveO]

Thank you Ian!

Not sure yet if I found something useful related to the real process addresses/offsets, but at least the "bcc" sources have one "bcc_elf_get_text_scn_info()" that returns the address and offset of the ".text" section.

[Massimiliano Giovagnoli]

Thank you all. I was looking at the same goal, having collected stack traces from eBPF helper with IPs.

With debug/elf I've been able to resolve symbols for the use cases I tested, thank you Ian.

In example the right symbol is the one that satisfy ip >= sym.Value  && ip < (sym.Value+sym.Size) (where sym comes from elfBinary.Symbols()).