Module detection 

Go binary detection via heuristic string matching.

This module provides the lowest-confidence detection layer. When a binary’s format cannot be parsed (corrupted headers, unknown format) and no structural markers are found (no pclntab magic, no build ID), we fall back to scanning for strings that appear in virtually every Go binary.

Why These Strings Survive

The Go runtime references these function names and error messages at runtime for stack traces, panic output, and goroutine management. Even heavily stripped or obfuscated Go binaries retain them in the pclntab’s funcnametab (which is separate from the ELF/PE symbol table).

Confidence Levels

The Confidence enum represents how certain we are that a binary is Go-compiled:

Level	Meaning
None	No Go indicators found
Low	Heuristic string matches only (could be false positive)
Medium	Build info or version string found
High	Structural proof: pclntab magic, section names, or build ID

Structs

ConfidenceReport

Structured detection report produced during crate::GoBinary::parse / crate::GoBinary::try_parse.

Enums

Confidence

Confidence level for Go binary identification.

ConfidenceSignal

One observation made during Go-binary detection.

ParseError

Reason a binary could not be parsed as Go.

VersionSource

Where a Go version string was extracted from.

Functions

heuristic_check

Perform heuristic string-based detection.

heuristic_hits

Count how many heuristic patterns match in data.