go-obfuscation/pkg/pclntab/pclntab_elf.go

//go:build linux

package pclntab

import (
	"debug/elf"
	"fmt"
)

func readPclntabSection(binaryPath string) ([]byte, error) {
	f, err := elf.Open(binaryPath)
	if err != nil {
		return nil, fmt.Errorf("pclntab: failed to open ELF: %w", err)
	}
	defer f.Close()

	sectionNames := []string{
		".gopclntab",
		"runtime.pclntab",
		"runtime.pclntab_v1",
	}

	for _, name := range sectionNames {
		section := f.Section(name)
		if section != nil {
			data, err := section.Data()
			if err != nil {
				return nil, fmt.Errorf("pclntab: failed to read section %s: %w", name, err)
			}
			buf := make([]byte, len(data))
			copy(buf, data)
			return buf, nil
		}
	}

	for _, section := range f.Sections {
		data, err := section.Data()
		if err != nil {
			continue
		}
		if len(data) >= 8 {
			for _, magic := range pclntabMagics {
				if len(data) >= len(magic) && bytesEqual(data[:len(magic)], magic) {
					buf := make([]byte, len(data))
					copy(buf, data)
					return buf, nil
				}
			}
		}
	}

	return nil, nil
}

func WriteCorruptedPclntab(binaryPath string, corrupted []byte, outputPath string) error {
	return fmt.Errorf("pclntab: offline ELF patching not yet implemented; use runtime corruption instead")
}