Skip to main content

Crate unstrip

Crate unstrip 

Source

Re-exports§

pub use buildinfo::BuildInfo;
pub use buildinfo::Module;
pub use error::Error;
pub use fingerprint::Fingerprint;
pub use gobin::Container;
pub use gobin::GoBinary;
pub use gobin::Section;
pub use gobin::SectionKind;
pub use itabs::Itab;
pub use moduledata::ModuleData;
pub use moduledata::SliceHeader;
pub use pclntab::Function;
pub use pclntab::Pclntab;
pub use probe::probe;
pub use probe::ContainerProbe;
pub use probe::SectionInfo;
pub use types::KindName;
pub use types::Type;

Modules§

buildinfo
callsites
Find every call site that targets a given symbol.
capabilities
“What does this binary do” reporting from the recovered types and itab dispatch tables.
dataview
dataxref
diff
Compare two stripped Go binaries by recovered function set and emit a diff suitable for porting annotations across malware-family rebuilds.
dispatch
Emit RE-tool scripts that surface unstrip’s recovered interface dispatch table when the analyst hovers or clicks on a virtual call site.
error
export
fingerprint
funcsig
Function-signature recovery for stripped Go binaries.
garble
Garble obfuscation detection from recovered function names.
gobin
goroutines
Find every runtime.newproc and runtime.deferproc call site in .text and resolve the function value passed as the first argument.
inline
Inlined-call recovery from Go’s FUNCDATA_InlTree.
itabs
itabsig
Interface fingerprinting by method set, for garbled binaries.
moduledata
output
pclntab
plugin
Install wrapper plugins/scripts into the user’s RE tool plugin directories so unstrip shows up as a menu item, not a script-run.
probe
Container probe: what can be said about a binary even when Go metadata recovery fails. Container, architecture, the section table, per-section and whole-file entropy, trailing overlay, and a packer/obfuscation verdict.
rewrite
Rewrite a stripped Go binary in place, embedding recovered symbol information into a real .symtab + .strtab so every other tool in the chain (nm, objdump, gdb, perf, eBPF, delve) sees the names.
stdlib
Standard-library interface recognition.
strings
Recover printable string literals from a Go binary’s read-only data regions.
types
xrefs
Build a call graph from a stripped Go binary by scanning .text for CALL/BL instructions and resolving each target against the recovered function table.

Type Aliases§

Result