Sunday, January 21, 2024

Introduction To Reversing Golang Binaries


Golang binaries are a bit hard to analyze but there are some tricks to locate the things and view what is doing the code.






Is possible to list all the go files compiled in the binary even in an striped binaries, in this case we have only one file gohello.go this is a good clue to guess what is doing the program.


On stripped binaries the runtime functions are not resolved so is more difficult to locate the user algorithms:


If we start from the entry point, we will found this mess:

The golang string initialization are encoded and is not displayed on the strings window.


How to locate main?  if its not stripped just bp on [package name].main for example bp main.main, (you can locate the package-name searching strings with ".main")


And here is our main.main:


The code is:

So in a stripped binary we cant find the string "hello world" neither the initialization 0x1337 nor the comparator 0x1337, all this is obfuscated.

The initialization sequence is:


The procedure for locating main.main in stripped binaries is:
1. Click on the entry point and locate the runtime.mainPC pointer:



2. click on runtime.main function (LAB_0042B030):


3. locate the main.main call after the zero ifs:



4. click on it and here is the main:




The runtime is not obvious for example the fmt.Scanf() call perform several internal calls until reach the syscall, and in a stripped binary there are no function names.



In order to identify the functions one option is compile another binary with symbols and make function fingerprinting.

In Ghidra we have the script golang_renamer.py which is very useful:


After applying this plugin the main looks like more clear:




This script is an example of function fingerprinting, in this case all the opcodes are included on the crc hashing:
# This script fingerprints the functions
#@author: sha0coder
#@category fingerprinting

print "Fingerprinting..."

import zlib


# loop through program functions
function = getFirstFunction()
while function is not None:
name = str(function.getName())
entry = function.getEntryPoint()
body = function.getBody()
addresses = body.getAddresses(True)

if not addresses.hasNext():
# empty function
continue

ins = getInstructionAt(body.getMinAddress())
opcodes = ''
while ins and ins.getMinAddress() <= body.getMaxAddress():
for b in ins.bytes:
opcodes += chr(b & 0xff)
ins = getInstructionAfter(ins)
crchash = zlib.crc32(opcodes) & 0xffffffff

print name, hex(crchash)


function = getFunctionAfter(function)





Related word

  1. Pentest Tools Framework
  2. Pentest Tools Free
  3. Pentest Recon Tools
  4. Tools For Hacker
  5. Game Hacking
  6. Computer Hacker
  7. Hack And Tools
  8. Hacker Tools List
  9. Hacking Tools Download
  10. Black Hat Hacker Tools
  11. Growth Hacker Tools
  12. Pentest Tools Website Vulnerability
  13. Hack Tools 2019
  14. Hacking Tools Kit
  15. Hackers Toolbox
  16. Hack Tools For Windows
  17. Hacker Tools Windows
  18. Pentest Tools For Windows
  19. Hack Tools For Ubuntu
  20. Pentest Tools Download
  21. Pentest Tools Find Subdomains
  22. Pentest Recon Tools
  23. Hack Apps
  24. Hack Tool Apk
  25. Hacker Tools
  26. Black Hat Hacker Tools
  27. Growth Hacker Tools
  28. Hacking Tools Online
  29. Pentest Tools Find Subdomains
  30. Hack Tools For Windows
  31. Pentest Tools For Android
  32. Hacker Tools 2019
  33. Pentest Tools Open Source
  34. How To Hack
  35. Hacker Tools Apk
  36. Pentest Tools Apk
  37. Pentest Tools Download
  38. Hack Tools For Windows
  39. Pentest Tools Url Fuzzer
  40. Hacking Tools For Kali Linux
  41. How To Hack
  42. Tools For Hacker
  43. Pentest Tools Android
  44. Hacking Tools And Software
  45. Hacking Tools For Windows
  46. Hacker Tools Software
  47. Hacking Tools Free Download
  48. Hacks And Tools
  49. Hacking Tools 2019
  50. Game Hacking
  51. Hack Tools For Ubuntu
  52. Hack Tools Pc
  53. Hacker Tools Free Download
  54. Hacking Tools For Windows 7
  55. Hak5 Tools
  56. Nsa Hack Tools Download
  57. Hacker Techniques Tools And Incident Handling
  58. Hack Tools For Games
  59. Pentest Tools Review
  60. Hacking Tools For Windows
  61. Pentest Tools Kali Linux
  62. Blackhat Hacker Tools
  63. Blackhat Hacker Tools
  64. Blackhat Hacker Tools
  65. Pentest Box Tools Download
  66. Pentest Tools Nmap
  67. Hacker Tools For Windows
  68. Hacker Tools List
  69. Hacking Tools For Games
  70. Hacking Tools Software
  71. Hacker Tools For Ios
  72. Tools For Hacker
  73. Pentest Tools Github
  74. Hack Tools Github
  75. Nsa Hack Tools Download
  76. Pentest Tools
  77. Best Hacking Tools 2019
  78. Best Pentesting Tools 2018
  79. Pentest Tools Port Scanner
  80. Hack Tools
  81. Wifi Hacker Tools For Windows
  82. Hacker Tools For Ios
  83. Hacker Tools Windows
  84. How To Install Pentest Tools In Ubuntu
  85. Pentest Reporting Tools
  86. Pentest Tools Subdomain
  87. Termux Hacking Tools 2019
  88. Hack Tools For Pc
  89. Hacking Tools Github
  90. Hacker Techniques Tools And Incident Handling
  91. Pentest Tools Online
  92. What Are Hacking Tools
  93. Pentest Tools Subdomain

No comments:

Post a Comment