mandiant / GoReSym

Go symbol recovery tool
MIT License
498 stars 62 forks source link

Error : Failed to parse file: failed to read pclntab: failed to locate pclntab #20

Closed nateambringit closed 1 year ago

nateambringit commented 1 year ago

Hi I trying to execute the prebuilt of GoReSym newest version 2.2 in windows and the feedback is this : image

and it same as when i am building with go-1.20.

image

How to fix this?

williballenthin commented 1 year ago

are you able to share the sample that leads to this error?

nateambringit commented 1 year ago

are you able to share the sample that leads to this error?

Yes, I used a sample malware file to know the build id from GoReSym: https://mega.nz/file/r7RV1ZjC#WvrfdjEzpWq-4a6GS7FsbXr7g92KOHL2kL6XZXeSDMk (Pass: infected) .

stevemk14ebr commented 1 year ago

Hi, your malware sample is packed or obfuscated. The NetSysCLI.exe is not a plain go binary