Introduction To Reversing Golang Binaries

Golang binaries are a bit hard to analyze but there are some tricks to locate the things and view what is doing the code.

Is possible to list all the go files compiled in the binary even in an striped binaries, in this case we have only one file gohello.go this is a good clue to guess what is doing the program.

On stripped binaries the runtime functions are not resolved so is more difficult to locate the user algorithms:

If we start from the entry point, we will found this mess:

The golang string initialization are encoded and is not displayed on the strings window.

How to locate main?  if its not stripped just bp on [package name].main for example bp main.main, (you can locate the package-name searching strings with ".main")

And here is our main.main:

The code is:

So in a stripped binary we cant find the string "hello world" neither the initialization 0x1337 nor the comparator 0x1337, all this is obfuscated.

The initialization sequence is:

The procedure for locating main.main in stripped binaries is:

1. Click on the entry point and locate the runtime.mainPC pointer:

2. click on runtime.main function (LAB_0042B030):

3. locate the main.main call after the zero ifs:

4. click on it and here is the main:

The runtime is not obvious for example the fmt.Scanf() call perform several internal calls until reach the syscall, and in a stripped binary there are no function names.

In order to identify the functions one option is compile another binary with symbols and make function fingerprinting.

In Ghidra we have the script golang_renamer.py which is very useful:

After applying this plugin the main looks like more clear:

This script is an example of function fingerprinting, in this case all the opcodes are included on the crc hashing:

# This script fingerprints the functions

#@author: sha0coder

#@category fingerprinting

print "Fingerprinting..."

import zlib

# loop through program functions

function = getFirstFunction()

while function is not None:

name = str(function.getName())

entry = function.getEntryPoint()

body = function.getBody()

addresses = body.getAddresses(True)

if not addresses.hasNext():

# empty function

continue

ins = getInstructionAt(body.getMinAddress())

opcodes = ''

while ins and ins.getMinAddress() <= body.getMaxAddress():

for b in ins.bytes:

opcodes += chr(b & 0xff)

ins = getInstructionAfter(ins)

crchash = zlib.crc32(opcodes) & 0xffffffff

print name, hex(crchash)

function = getFunctionAfter(function)

Related posts

1. Hacking Tools Github
2. Hackers Toolbox
3. Hacking Tools Name
4. Hacker Hardware Tools
5. Pentest Tools Review
6. Nsa Hack Tools Download
7. Hack And Tools
8. Hack Tools For Windows
9. Hacking Tools And Software
10. Nsa Hack Tools
11. Pentest Tools Free
12. Hacker Tools 2020
13. Hack Apps
14. What Is Hacking Tools
15. Growth Hacker Tools
16. Pentest Tools
17. New Hacker Tools
18. Pentest Tools Apk
19. Game Hacking
20. Hack Tools For Games
21. Hacker Tools 2020
22. Hacking Tools For Pc
23. Pentest Tools List
24. Hack Tools For Pc
25. Hack Tools For Games
26. Tools Used For Hacking
27. Hack Rom Tools
28. Pentest Tools Port Scanner
29. Install Pentest Tools Ubuntu
30. Hacking Tools For Windows
31. Android Hack Tools Github
32. Pentest Recon Tools
33. Hacker Tools 2019
34. Hacking Tools Mac
35. Hacker Tools Linux
36. Install Pentest Tools Ubuntu
37. Hacking Tools Github
38. Hacker Tool Kit
39. Pentest Tools Website
40. World No 1 Hacker Software
41. Hacks And Tools
42. Hacking Tools Hardware
43. Pentest Tools Bluekeep
44. Pentest Recon Tools
45. Pentest Tools Apk
46. Hack Website Online Tool
47. Pentest Tools Framework
48. Github Hacking Tools
49. Pentest Tools Nmap
50. Hack App
51. Hack Tool Apk No Root
52. Growth Hacker Tools
53. Install Pentest Tools Ubuntu
54. Hacker Hardware Tools
55. Hacker Tools 2020
56. Pentest Tools Website
57. Hacking Tools Software
58. Nsa Hacker Tools
59. Hacker Tools For Ios
60. Hak5 Tools