go-delve/delve · error

could not find symbol in executable sections of binary

Error message

could not find symbol in executable sections of binary

What it means

AddressToOffset converts a virtual address into the file offset required by uprobes by finding the executable section (PT_LOAD +X segment) containing the address. If no executable section covers the address, the symbol cannot be placed in a uprobe, so this error is returned.

Source

Thrown at pkg/proc/internal/ebpf/helpers.go:635

	for i := range f.Sections {
		if f.Sections[i].Flags == elf.SHF_ALLOC+elf.SHF_EXECINSTR {
			sectionsToSearchForSymbol = append(sectionsToSearchForSymbol, f.Sections[i])
		}
	}

	var executableSection *elf.Section

	// Find what section the symbol is in by checking the executable section's
	// addr space.
	for m := range sectionsToSearchForSymbol {
		if addr >= sectionsToSearchForSymbol[m].Addr &&
			addr < sectionsToSearchForSymbol[m].Addr+sectionsToSearchForSymbol[m].Size {
			executableSection = sectionsToSearchForSymbol[m]
		}
	}

	if executableSection == nil {
		return 0, errors.New("could not find symbol in executable sections of binary")
	}

	return uint64(addr - executableSection.Addr + executableSection.Offset), nil
}

View on GitHub (pinned to a23773e6c3)

Solutions

1. Verify the traced function belongs to the main executable's text section (check with 'nm'/'objdump -d')
2. Trace a function in the executable that Delve attached the uprobe to, not one in a shared library or JIT code
3. Rebuild the binary with symbols and standard sections (avoid packing/obfuscation)
4. Confirm the correct binary path was used when initializing the eBPF context

// ensure the symbol lives in the executable's text section before tracing:
out, _ := exec.Command("nm", binary).Output()
if !bytes.Contains(out, []byte(" T main.foo")) {
    return errors.New("symbol not in executable text section; cannot uprobe")
}

off, err := ebpf.AddressToOffset(sections, addr)
if err != nil {
    if strings.Contains(err.Error(), "could not find symbol in executable sections") {
        log.Printf("%v: addr may be in a shared lib or JIT code", err)
    }
}

When it happens

Trigger: Calling AddressToOffset with a function address that does not fall within any executable section of the binary — e.g. address resolved in a data section, PLT/GOT stub, dynamically generated code, or a binary whose section table does not match loaded segments.

Common situations: Tracing functions in shared libraries or JIT-generated code whose sections were not included in the section list; tracing a symbol in a stripped/misaligned binary; passing an address from a different binary than the one probed; UPX-packed or otherwise obfuscated executables.

Related errors

• no eBPF program loaded
• eBPF disabled
• could not open elf file to resolve symbol offset: %w
• ErrCouldNotDetermineRelocation
• ErrNoDebugInfoFound

AI-assisted analysis of go-delve/delve@a23773e6c3 (2026-08-31). Data as JSON: /api/errors/a5926a0b18707e25. Report an issue: GitHub.