Skip to content

Add string start addresses to -strings output#100

Merged
stevemk14ebr merged 2 commits into
mandiant:masterfrom
kami922:issue-99-string-addresses
Jul 1, 2026
Merged

Add string start addresses to -strings output#100
stevemk14ebr merged 2 commits into
mandiant:masterfrom
kami922:issue-99-string-addresses

Conversation

@kami922

@kami922 kami922 commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Closes #99

Summary

  • Added StringEntry struct (Str string, Start uint64) to objfile/strings.go — replaces bare string in the output
  • ExtractStrings() now returns []StringEntry instead of []string; the start VA comes directly from c.Pointer which was already computed during blob walking
  • Updated ExtractMetadata.Strings in main.go from []string to []objfile.StringEntry
  • -human output now prints 0x<addr> <string> per entry
  • Added StringEntry message to GoReSym.proto; changed repeated string stringsrepeated StringEntry strings
  • Tests updated to use .Str field and assert Start != 0 for every extracted string

Example output change

Before:

"Strings": ["main", "runtime.goexit"]

After:

"Strings": [{"Str": "main", "Start": 4890624}, {"Str": "runtime.goexit", "Start": 4891136}]

Notes

  • Only Start is included per Steve's guidance — consumers can derive End from Start + len(Str)
  • Deduplication by string value is preserved; all candidates referencing the same string point to the same blob offset so the captured address is always correct
  • No new dependencies introduced

🤖 Generated with Claude Code

@google-cla

google-cla Bot commented Jun 30, 2026

Copy link
Copy Markdown

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

Each entry in the -strings output now includes a Start field with the
virtual address of the string's bytes in the binary, enabling RE tools
like IDA and Binary Ninja to create string literals at exact addresses.
@kami922
kami922 force-pushed the issue-99-string-addresses branch from bbfbe16 to f0025dc Compare June 30, 2026 22:48
@stevemk14ebr

Copy link
Copy Markdown
Collaborator

The implementation looks good here, CI error suggests a test needs updated however

@stevemk14ebr
stevemk14ebr merged commit 157cabb into mandiant:master Jul 1, 2026
9 checks passed
@stevemk14ebr

Copy link
Copy Markdown
Collaborator

thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add string start addresses to -strings output

2 participants