cle 9.3.2__tar.gz → 9.3.4__tar.gz

{cle-9.3.2/cle.egg-info → cle-9.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cle
-Version: 9.3.2
+Version: 9.3.4
 Summary: CLE Loads Everything (at least, many binary formats!) and provides a pythonic interface to analyze what they are and what they would look like in memory.
 License-Expression: BSD-2-Clause
 Project-URL: Homepage, https://api.angr.io/projects/cle/en/latest/
@@ -13,13 +13,13 @@ Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: archinfo==9.3.2
+Requires-Dist: archinfo==9.3.4
 Requires-Dist: arpy==1.1.1
 Requires-Dist: cart
 Requires-Dist: minidump>=0.0.10
 Requires-Dist: pefile==2024.8.26
 Requires-Dist: pyelftools>=0.29
-Requires-Dist: pyvex==9.3.2
+Requires-Dist: pyvex==9.3.4
 Requires-Dist: pyxbe~=1.0.3
 Requires-Dist: pyxdia~=0.1; sys_platform != "emscripten"
 Requires-Dist: sortedcontainers>=2.0

{cle-9.3.2 → cle-9.3.4}/cle/__init__.py

@@ -7,7 +7,7 @@ The primary interface to CLE is the Loader class.
 
 from __future__ import annotations
 
-__version__ = "9.3.2"
+__version__ = "9.3.4"
 
 from .address_translator import AT, AddressTranslator
 from .backends import (
@@ -22,10 +22,14 @@ from .backends import (
     Backend,
     Blob,
     Coff,
+    Dex,
     ELFCore,
     ExceptionHandling,
     FunctionHint,
     FunctionHintSource,
+    GoFunction,
+    GoPclntab,
+    GoSymbol,
     Hex,
     Jar,
     MachO,
@@ -40,6 +44,7 @@ from .backends import (
     Soot,
     SRec,
     StaticArchive,
+    STM32Backend,
     Symbol,
     SymbolSubType,
     SymbolType,
@@ -91,10 +96,14 @@ __all__ = [
     "Backend",
     "Blob",
     "Coff",
+    "Dex",
     "ELFCore",
     "ExceptionHandling",
     "FunctionHint",
     "FunctionHintSource",
+    "GoFunction",
+    "GoPclntab",
+    "GoSymbol",
     "Hex",
     "SRec",
     "Jar",
@@ -108,6 +117,7 @@ __all__ = [
     "Segment",
     "Soot",
     "StaticArchive",
+    "STM32Backend",
     "Universal2",
     "register_backend",
     "ExternObject",

{cle-9.3.2 → cle-9.3.4}/cle/backends/__init__.py

@@ -6,8 +6,10 @@ from .cartfile import CARTFile
 from .cgc import CGC, BackedCGC
 from .coff import Coff
 from .elf import ELF, ELFCore, MetaELF
+from .gopclntab import GoFunction, GoPclntab, GoSymbol
 from .ihex import Hex
 from .java.apk import Apk
+from .java.dex import Dex
 from .java.jar import Jar
 from .java.soot import Soot
 from .macho import MachO
@@ -18,6 +20,7 @@ from .region import Region, Section, Segment
 from .regions import Regions
 from .srec import SRec
 from .static_archive import StaticArchive
+from .stm32 import STM32Backend
 from .symbol import Symbol, SymbolSubType, SymbolType
 from .te import TE
 from .uefi_firmware import UefiFirmware
@@ -50,9 +53,11 @@ __all__ = [
     "NamedRegion",
     "Jar",
     "Apk",
+    "Dex",
     "Soot",
     "XBE",
     "StaticArchive",
+    "STM32Backend",
     "Region",
     "Segment",
     "Section",
@@ -60,6 +65,9 @@ __all__ = [
     "Symbol",
     "SymbolType",
     "SymbolSubType",
+    "GoFunction",
+    "GoPclntab",
+    "GoSymbol",
     "UefiFirmware",
     "TE",
     "Universal2",

{cle-9.3.2 → cle-9.3.4}/cle/backends/coff.py

@@ -53,6 +53,7 @@ class IMAGE_SCN(IntFlag):
     Section Flags (Characteristics field)
     """
 
+    MEM_DISCARDABLE = 0x02000000
     MEM_EXECUTE = 0x20000000
     MEM_READ = 0x40000000
     MEM_WRITE = 0x80000000
@@ -236,13 +237,19 @@ class CoffParser:
         name_encoded = bytes(self.symbols[symbol_idx].Name)
         name_as_dwords = struct.unpack("<II", name_encoded)
         if name_as_dwords[0] == 0:
-            name_encoded = extract_null_terminated_bytestr(self.strings, offset=name_as_dwords[1])
+            return self.get_string(name_as_dwords[1])
         return name_encoded.rstrip(b"\x00").decode("ascii")
 
+    def get_string(self, offset: int) -> str:
+        """
+        Read the string table entry at `offset`, counted from the start of the table.
+        """
+        return extract_null_terminated_bytestr(self.strings, offset=offset).decode("ascii")
+
     def get_section_name(self, section_idx: int) -> str:
         name = bytes(self.sections[section_idx].Name).rstrip(b"\x00").decode("ascii")
         if name.startswith("/"):
-            return self.get_symbol_name(int(name[1:]))
+            return self.get_string(int(name[1:]))
         return name
 
 
@@ -288,13 +295,16 @@ class CoffRelocation(Relocation):
 
     __slots__ = ()
 
-    PACK_FORMAT = "<i"
+    PACK_FORMAT = "<I"
 
     def relocate(self):
         value = self.value
         if value is None:
             log.debug("Unresolved relocation with no symbol.")
             return False
+        # The field holds a fixed-width bit pattern, so the value is truncated to that width
+        # rather than required to fit in it.
+        value &= (1 << (struct.calcsize(self.PACK_FORMAT) * 8)) - 1
         self.owner.memory.store(self.relative_addr, struct.pack(self.PACK_FORMAT, value))
         return True
 
@@ -310,7 +320,8 @@ class CoffRelocationREL32(CoffRelocation):
     def value(self):
         assert self.resolvedby is not None
         org_bytes = self.owner.memory.load(self.relative_addr, 4)
-        org_value = struct.unpack("<I", org_bytes)[0]
+        # The field is a signed displacement, so its addend is too.
+        org_value = struct.unpack("<i", org_bytes)[0]
         return org_value + self.resolvedby.rebased_addr - (self.rebased_addr + 4)
 
 
@@ -351,8 +362,6 @@ class CoffRelocationADDR32NB(CoffRelocation):
 
     __slots__ = ()
 
-    PACK_FORMAT = "<I"
-
     @property
     def value(self) -> int:
         assert self.resolvedby is not None
@@ -397,8 +406,6 @@ class CoffRelocationSECREL(CoffRelocation):
 
     __slots__ = ()
 
-    PACK_FORMAT = "<I"
-
     @property
     def value(self):
         assert isinstance(self.owner, Coff)

{cle-9.3.2 → cle-9.3.4}/cle/backends/elf/elf.py

@@ -24,6 +24,7 @@ from sortedcontainers import SortedDict
 
 from cle.address_translator import AT
 from cle.backends.backend import ExceptionHandling, FunctionHint, FunctionHintSource, register_backend
+from cle.backends.gopclntab import GoPclntab, register_gopclntab_symbols
 from cle.backends.inlined_function import InlinedFunction
 from cle.errors import CLECompatibilityError, CLEError, CLEInvalidBinaryError
 from cle.patched_stream import PatchedStream
@@ -57,6 +58,12 @@ _NON_ALLOCATED_SECTION_NAMES = {  # Sections that do not occupy memory at runtim
 }
 
 
+# MIPS e_flags bits that name the ABI. binutils include/elf/mips.h.
+EF_MIPS_ABI2 = 0x20  # n32
+EF_MIPS_ABI = 0x0000F000
+E_MIPS_ABI_O64 = 0x00002000
+
+
 # map 'e_machine' ELF header values (represented as `short int`s) to human-readable format (string)
 # There are mappings missing currently in `elftools`, so we provide them ourselves
 additional_e_machine_mappings: dict[int, str] = {
@@ -171,6 +178,9 @@ class ELF(MetaELF):
         self.compilation_units: list[CompilationUnit] | None = None
         self.functions_debug_info: dict[int, Subprogram] = {}
 
+        # Go
+        self.gopclntab: GoPclntab | None = None
+
         # misc
         self._entry = self._reader.header.e_entry
         self.is_relocatable = self._reader.header.e_type == "ET_REL"
@@ -238,6 +248,9 @@ class ELF(MetaELF):
                 if os.path.isfile(debug_filename):
                     self.__process_debug_file(debug_filename)
 
+        # Go binaries keep a full function table even when stripped
+        self.gopclntab = register_gopclntab_symbols(self)
+
         # call the methods defined by MetaELF
         self._ppc64_abiv1_entry_fix()
         self._load_plt()
@@ -345,6 +358,16 @@ class ELF(MetaELF):
             elif reader.header.e_flags & 0x400:
                 return archinfo.ArchARMHF("Iend_LE" if reader.little_endian else "Iend_BE")
 
+        if arch_str == "EM_MIPS" and reader.elfclass == 32:
+            # The n32 and O64 ABIs put a 64-bit MIPS instruction stream in an ELFCLASS32
+            # container, and say so in e_flags. Resolved by the class alone they become
+            # 32-bit MIPS and the instruction stream does not decode. The class is still
+            # right about everything else in the file -- Elf32_Rel, Elf32_Sym, 4-byte GOT
+            # slots -- so the word size must stay 32; only the instruction set is 64-bit.
+            e_flags = reader.header.e_flags
+            if e_flags & EF_MIPS_ABI2 or (e_flags & EF_MIPS_ABI) == E_MIPS_ABI_O64:
+                return archinfo.ArchMIPSN32(archinfo.Endness.LE if reader.little_endian else archinfo.Endness.BE)
+
         try:
             return archinfo.arch_from_id(arch_str, "le" if reader.little_endian else "be", reader.elfclass)
         except archinfo.ArchNotFound:
@@ -1289,6 +1312,16 @@ class ELF(MetaELF):
         if isinstance(symtab, sections.NullSection):
             # Oh my god Atmel please stop
             symtab = self._reader.get_section_by_name(".symtab")
+        if symtab is None and section.header.get("sh_type") != "SHT_RELR":
+            # A stripped object can still carry a relocation section whose linked symbol table was stripped away.
+            # Without the table there is nothing that can be registered.
+            # RELR sections are exempt: their entries carry no symbol index.
+            log.warning(
+                "%s: relocation section %s has no symbol table to resolve its entries against; skipping it.",
+                self.binary,
+                section.name,
+            )
+            return
         relocs = []
         for readelf_reloc in section.iter_relocations():
             # Handle packed RELR relocations specially

{cle-9.3.2 → cle-9.3.4}/cle/backends/elf/metaelf.py

@@ -161,7 +161,7 @@ class MetaELF(Backend):
         )
 
         # ATTEMPT 1: some arches will just leave the plt stub addr in the import symbol
-        if self.arch.name in ("ARM", "ARMEL", "ARMHF", "ARMCortexM", "AARCH64", "MIPS32", "MIPS64"):
+        if self.arch.name in ("ARM", "ARMEL", "ARMHF", "ARMCortexM", "AARCH64", "MIPS32", "MIPS64", "MIPSN32"):
             for name, reloc in func_jmprel.items():
                 if not plt_secs or any(plt_sec.contains_addr(reloc.symbol.linked_addr) for plt_sec in plt_secs):
                     self._add_plt_stub(name, reloc.symbol.linked_addr, sanity_check=bool(plt_secs))
@@ -454,7 +454,7 @@ class MetaELF(Backend):
 
         Utter bollocks, but this function should fix it.
         """
-        if self.is_ppc64_abiv1:
+        if self.is_ppc64_abiv1 and self._entry != 0:  # entry == 0 means the ELF has no entry point or rtoc
             ep_offset = self._entry
             self._entry = self.memory.unpack_word(AT.from_lva(ep_offset, self).to_rva())
             self._ppc64_abiv1_initial_rtoc = self.memory.unpack_word(AT.from_lva(ep_offset + 8, self).to_rva())

{cle-9.3.2 → cle-9.3.4}/cle/backends/elf/relocation/__init__.py

@@ -22,6 +22,7 @@ ALL_RELOCATIONS = {
     "X86": relocation_table_i386,
     "MIPS32": relocation_table_mips,
     "MIPS64": relocation_table_mips,
+    "MIPSN32": relocation_table_mips,
     "PPC32": relocation_table_ppc,
     "PPC64": relocation_table_ppc64,
     "S390X": relocation_table_s390x,

{cle-9.3.2 → cle-9.3.4}/cle/backends/elf/relocation/arm64.py

@@ -19,6 +19,7 @@ from .generic import (
     GenericTLSDoffsetReloc,
     GenericTLSModIdReloc,
     GenericTLSOffsetReloc,
+    RelocTruncate32Mixin,
 )
 
 log = logging.getLogger(name=__name__)
@@ -66,7 +67,7 @@ class R_AARCH64_TLSDESC(GenericTLSDescriptorReloc):
     RESOLVER_ADDR = 0xFFFF_FFFF_FFFF_FE00
 
 
-class R_AARCH64_PREL32(GenericPCRelativeAddendReloc):
+class R_AARCH64_PREL32(RelocTruncate32Mixin, GenericPCRelativeAddendReloc):
     """
     Relocation Type: 261
     Calculation: (S + A - P)

{cle-9.3.2 → cle-9.3.4}/cle/backends/elf/relocation/ppc64.py

@@ -7,6 +7,8 @@ from __future__ import annotations
 
 import logging
 
+from cle.backends.symbol import SymbolType
+
 from .elfreloc import ELFReloc
 from .generic import (
     GenericAbsoluteAddendReloc,
@@ -26,6 +28,10 @@ log = logging.getLogger(name=__name__)
 class R_PPC64_JMP_SLOT(ELFReloc):
     __slots__ = ()
 
+    @property
+    def extern_symbol_type(self):
+        return SymbolType.TYPE_FUNCTION
+
     def relocate(self):
         if self.owner.is_ppc64_abiv1:
             # R_PPC64_JMP_SLOT

cle-9.3.4/cle/backends/gopclntab.py

@@ -0,0 +1,313 @@
+"""
+Recovery of Go function symbols from the Go runtime's ``pclntab``.
+
+Every binary produced by the Go linker carries this table (``.gopclntab`` on ELF,
+``__gopclntab`` on Mach-O, embedded in ``.rdata`` on PE). It lists the entry point and the
+name of every function in the image, which makes it the only reliable source of function
+starts for stripped Go binaries.
+
+Only the Go 1.18+ layouts (magic ``0xfffffff0`` and ``0xfffffff1``) are supported. The
+header magic and the ``textStart`` field are deliberately not trusted: obfuscated binaries
+clobber them, so the table is instead accepted or rejected on structural grounds.
+"""
+
+from __future__ import annotations
+
+import logging
+import struct
+from typing import TYPE_CHECKING, NamedTuple
+
+from cle.address_translator import AT
+
+from .symbol import Symbol, SymbolType
+
+if TYPE_CHECKING:
+    from collections.abc import Callable
+
+    from .backend import Backend
+
+log = logging.getLogger(name=__name__)
+
+__all__ = ["GoFunction", "GoPclntab", "GoSymbol", "load_gopclntab", "register_gopclntab_symbols"]
+
+# magic -> minimum Go version that emits it
+GO_PCLNTAB_MAGICS = {
+    0xFFFFFFF1: (1, 20),
+    0xFFFFFFF0: (1, 18),
+}
+
+# Section names that hold nothing but a pclntab.
+PCLNTAB_SECTION_NAMES = frozenset({".gopclntab", "__gopclntab", ".go.pclntab", "__go_pclntab"})
+
+# Sections a pclntab may be embedded in, searched by magic as a fallback.
+_EMBEDDING_SECTION_NAMES = frozenset({".rdata", ".rodata", "__rodata", "__const", "__DATA_CONST"})
+
+# Sections whose presence means "this was built by the Go toolchain".
+_GO_MARKER_SECTION_NAMES = frozenset({".gosymtab", ".typelink", ".itablink", ".noptrdata", ".noptrbss"})
+
+_VALID_PTR_SIZES = (4, 8)
+_VALID_MIN_LC = (1, 2, 4)
+_MAX_NAME_LEN = 4096
+
+
+class GoFunction(NamedTuple):
+    """
+    One entry of the pclntab's function table.
+
+    :ivar addr: Entry point of the function, as a linked virtual address.
+    :ivar size: Distance to the next function; includes inter-function padding.
+    :ivar name: Fully qualified Go name, e.g. ``net/http.(*Server).Serve``.
+    """
+
+    addr: int
+    size: int
+    name: str
+
+
+class GoSymbol(Symbol):
+    """
+    A function symbol recovered from a Go pclntab.
+    """
+
+    def __init__(self, owner: Backend, name: str, relative_addr: int, size: int):
+        super().__init__(owner, name, relative_addr, size, SymbolType.TYPE_FUNCTION)
+
+
+class GoPclntab:
+    """
+    A parsed Go pclntab.
+
+    :ivar magic:        The raw magic word. May be garbage: it is not used for validation.
+    :ivar min_lc:       Minimum instruction length of the target architecture.
+    :ivar ptr_size:     Pointer size, in bytes.
+    :ivar text_start:   The base the function entry offsets are relative to, after recovery.
+    :ivar functions:    The function table, sorted by address.
+    """
+
+    __slots__ = ("magic", "min_lc", "ptr_size", "text_start", "functions")
+
+    def __init__(self, magic: int, min_lc: int, ptr_size: int, text_start: int, functions: list[GoFunction]):
+        self.magic = magic
+        self.min_lc = min_lc
+        self.ptr_size = ptr_size
+        self.text_start = text_start
+        self.functions = functions
+
+    def __repr__(self):
+        return f"<GoPclntab: {len(self.functions)} functions, text at {self.text_start:#x}>"
+
+    @property
+    def go_version(self) -> tuple[int, int] | None:
+        return GO_PCLNTAB_MAGICS.get(self.magic)
+
+    @classmethod
+    def parse(
+        cls,
+        data: bytes,
+        endness: str = "<",
+        text_start_fallback: int | None = None,
+        is_text_addr: Callable[[int], bool] | None = None,
+    ) -> GoPclntab | None:
+        """
+        Parse a pclntab out of ``data``, which must start at the table header.
+
+        Returns None if ``data`` does not structurally look like a pclntab.
+
+        :param data:                The bytes of the table.
+        :param endness:             ``<`` or ``>``.
+        :param text_start_fallback: Address to use when the header's ``textStart`` is unusable.
+        :param is_text_addr:        Predicate deciding whether ``textStart`` points at code.
+        """
+        header = _parse_header(data, endness)
+        if header is None:
+            return None
+        magic, min_lc, ptr_size, nfunc, text_start, funcname_off, pcln_off = header
+
+        if text_start == 0 or (is_text_addr is not None and not is_text_addr(text_start)):
+            if text_start_fallback is None:
+                log.warning("gopclntab: textStart %#x is not code and there is no fallback", text_start)
+                return None
+            log.debug("gopclntab: textStart %#x is not code, using %#x instead", text_start, text_start_fallback)
+            text_start = text_start_fallback
+
+        # nfunc pairs of (entryoff, funcoff), then one final entryoff marking the end of the last function
+        entries = struct.unpack_from(f"{endness}{2 * nfunc + 1}I", data, pcln_off)
+        entry_offs = entries[0::2]
+        func_offs = entries[1::2]
+        if any(a >= b for a, b in zip(entry_offs, entry_offs[1:])):
+            log.debug("gopclntab: function entry offsets are not monotonically increasing")
+            return None
+
+        functions = []
+        for i, func_off in enumerate(func_offs):
+            # the _func struct is entryOff uint32 followed by nameOff int32
+            name_ptr = pcln_off + func_off + 4
+            if name_ptr + 4 > len(data):
+                log.debug("gopclntab: _func %d lies outside the table", i)
+                return None
+            name_off = funcname_off + struct.unpack_from(endness + "i", data, name_ptr)[0]
+            if not funcname_off <= name_off < len(data):
+                log.debug("gopclntab: name of function %d lies outside the table", i)
+                return None
+            end = data.find(b"\0", name_off, name_off + _MAX_NAME_LEN)
+            if end == -1:
+                log.debug("gopclntab: name of function %d is unterminated", i)
+                return None
+            name = data[name_off:end].decode("utf-8", "replace")
+            functions.append(GoFunction(text_start + entry_offs[i], entry_offs[i + 1] - entry_offs[i], name))
+
+        return cls(magic, min_lc, ptr_size, text_start, functions)
+
+
+def _parse_header(data: bytes, endness: str) -> tuple[int, int, int, int, int, int, int] | None:
+    """
+    Validate and decode a pclntab header. Returns
+    ``(magic, min_lc, ptr_size, nfunc, text_start, funcname_off, pcln_off)`` or None.
+
+    The magic is decoded but never checked, so that binaries with a clobbered one still load.
+    """
+    if len(data) < 16:
+        return None
+    magic, _pad, min_lc, ptr_size = struct.unpack_from(endness + "IHBB", data, 0)
+    if ptr_size not in _VALID_PTR_SIZES or min_lc not in _VALID_MIN_LC or _pad != 0:
+        return None
+
+    header_size = 8 + 8 * ptr_size
+    if len(data) < header_size:
+        return None
+    word = endness + ("Q" if ptr_size == 8 else "I")
+    nfunc, nfiles, text_start, funcname_off, cu_off, filetab_off, pctab_off, pcln_off = (
+        struct.unpack_from(word, data, 8 + i * ptr_size)[0] for i in range(8)
+    )
+
+    size = len(data)
+    # the five sub-tables follow the header in a fixed order and all live inside the table
+    offsets = (funcname_off, cu_off, filetab_off, pctab_off, pcln_off)
+    if offsets[0] < header_size or offsets[-1] >= size:
+        return None
+    if any(a > b for a, b in zip(offsets, offsets[1:])):
+        return None
+    # a function costs 8 bytes of functab plus a _func struct, a file name at least 2 bytes
+    if nfunc <= 0 or pcln_off + (2 * nfunc + 1) * 4 > size:
+        return None
+    if nfiles * 2 > size:
+        return None
+
+    return magic, min_lc, ptr_size, nfunc, text_start, funcname_off, pcln_off
+
+
+#
+# Backend integration
+#
+
+
+def _read_section(backend: Backend, section) -> bytes | None:
+    try:
+        if section.memsize == 0 or section.only_contains_uninitialized_data:
+            return None
+        return backend.memory.load(AT.from_lva(section.vaddr, backend).to_rva(), section.memsize)
+    except Exception:  # pylint: disable=broad-except
+        return None
+
+
+def _executable_sections(backend: Backend):
+    return [sec for sec in backend.sections if sec.is_executable and sec.memsize > 0]
+
+
+def _text_start_fallback(execs) -> int | None:
+    """
+    The vaddr of the section holding the executable code, used when ``textStart`` is unusable.
+    """
+    if not execs:
+        return None
+    for sec in execs:
+        if sec.name in (".text", "__text"):
+            return sec.vaddr
+    return min(sec.vaddr for sec in execs)
+
+
+def _looks_like_go(backend: Backend) -> bool:
+    return any(sec.name in _GO_MARKER_SECTION_NAMES or sec.name.startswith(".go.") for sec in backend.sections)
+
+
+def _find_pclntab_data(backend: Backend, endness: str):
+    """
+    Yield candidate ``bytes`` objects, each starting at a possible pclntab header.
+    """
+    embedding = []
+    for section in backend.sections:
+        if section.name in PCLNTAB_SECTION_NAMES:
+            data = _read_section(backend, section)
+            if data is not None:
+                yield data
+        elif section.name in _EMBEDDING_SECTION_NAMES and not section.is_executable:
+            embedding.append(section)
+
+    # PE and Mach-O bury the table in a generic read-only section; find it by magic. Only worth
+    # doing when something else already says this is a Go binary.
+    if not embedding or not _looks_like_go(backend):
+        return
+    magics = [struct.pack(endness + "I", magic) for magic in GO_PCLNTAB_MAGICS]
+    for section in embedding:
+        data = _read_section(backend, section)
+        if data is None:
+            continue
+        for magic in magics:
+            pos = data.find(magic)
+            while pos != -1:
+                yield data[pos:]
+                pos = data.find(magic, pos + 4)
+
+
+def load_gopclntab(backend: Backend) -> GoPclntab | None:
+    """
+    Find and parse the Go pclntab of an already-loaded object. Returns None if there is none.
+    """
+    if not backend.sections:
+        return None
+    endness = ">" if backend.arch is not None and backend.arch.memory_endness == "Iend_BE" else "<"
+
+    execs: list = []
+
+    def is_text_addr(addr: int) -> bool:
+        return any(sec.contains_addr(addr) for sec in execs)
+
+    fallback = None
+    for i, data in enumerate(_find_pclntab_data(backend, endness)):
+        if i == 0:
+            execs = _executable_sections(backend)
+            fallback = _text_start_fallback(execs)
+        tab = GoPclntab.parse(data, endness, text_start_fallback=fallback, is_text_addr=is_text_addr)
+        if tab is not None:
+            return tab
+    return None
+
+
+def register_gopclntab_symbols(backend: Backend) -> GoPclntab | None:
+    """
+    Parse the object's Go pclntab, if it has one, and add a function symbol for every Go
+    function that is not already covered by a symbol table.
+    """
+    try:
+        tab = load_gopclntab(backend)
+    except (struct.error, ValueError):
+        log.warning("Failed to parse the Go pclntab of %s", backend.binary_basename, exc_info=True)
+        return None
+    if tab is None:
+        return None
+
+    covered = {sym.relative_addr for sym in backend.symbols if sym.size and sym.is_function}
+    by_name = getattr(backend, "_symbols_by_name", None)
+    added = 0
+    for func in tab.functions:
+        relative_addr = AT.from_lva(func.addr, backend).to_rva()
+        if relative_addr in covered:
+            continue
+        symbol = GoSymbol(backend, func.name, relative_addr, func.size)
+        backend.symbols.add(symbol)
+        if by_name is not None and func.name and func.name not in by_name:
+            by_name[func.name] = symbol
+        added += 1
+
+    log.info("Recovered %d Go functions from the pclntab of %s (%d new)", len(tab.functions), backend, added)
+    return tab