Analysis passes over loaded binaries.
Function discovery layers signals from highest to lowest confidence:
- The full symbol table (
.symtab) when present. - The dynamic symbol table (
.dynsym). - Byte-pattern signatures (CRT helpers, libc primitives, …).
.eh_frame(DWARF CFI) — names are addresses, but sizes are authoritative; survives stripping.
Each [Function] in the produced [FunctionMap] records every
source that contributed to it. Names from higher-confidence sources
win over names from lower-confidence sources; sizes are merged
preserving any non-zero value.
After all sources are merged, a final pass fills in sizes for functions that no source supplied a size for (typically signature matches), using the distance to the next discovered function in the same address window.