elfexec

func GetBase ¶

func GetBase(fh *elf.FileHeader, loadSegment *elf.ProgHeader, stextOffset *uint64, start, limit, offset uint64) (uint64, error)

GetBase determines the base address to subtract from virtual address to get symbol table address. For an executable, the base is 0. Otherwise, it's a shared library, and the base is the address where the mapping starts. The kernel is special, and may use the address of the _stext symbol as the mmap start. _stext offset can be obtained with `nm vmlinux | grep _stext`

func GetBuildID ¶

func GetBuildID(binary io.ReaderAt) ([]byte, error)

GetBuildID returns the GNU build-ID for an ELF binary.

If no build-ID was found but the binary was read without error, it returns (nil, nil).