Introduction To Reversing Golang Binaries

Golang binaries are a bit hard to analyze but there are some tricks to locate the things and view what is doing the code.

Is possible to list all the go files compiled in the binary even in an striped binaries, in this case we have only one file gohello.go this is a good clue to guess what is doing the program.

On stripped binaries the runtime functions are not resolved so is more difficult to locate the user algorithms:

If we start from the entry point, we will found this mess:

The golang string initialization are encoded and is not displayed on the strings window.

How to locate main?  if its not stripped just bp on [package name].main for example bp main.main, (you can locate the package-name searching strings with ".main")

And here is our main.main:

The code is:

So in a stripped binary we cant find the string "hello world" neither the initialization 0x1337 nor the comparator 0x1337, all this is obfuscated.

The initialization sequence is:

The procedure for locating main.main in stripped binaries is:

1. Click on the entry point and locate the runtime.mainPC pointer:

2. click on runtime.main function (LAB_0042B030):

3. locate the main.main call after the zero ifs:

4. click on it and here is the main:

The runtime is not obvious for example the fmt.Scanf() call perform several internal calls until reach the syscall, and in a stripped binary there are no function names.

In order to identify the functions one option is compile another binary with symbols and make function fingerprinting.

In Ghidra we have the script golang_renamer.py which is very useful:

After applying this plugin the main looks like more clear:

This script is an example of function fingerprinting, in this case all the opcodes are included on the crc hashing:

# This script fingerprints the functions

#@author: sha0coder

#@category fingerprinting

print "Fingerprinting..."

import zlib

# loop through program functions

function = getFirstFunction()

while function is not None:

name = str(function.getName())

entry = function.getEntryPoint()

body = function.getBody()

addresses = body.getAddresses(True)

if not addresses.hasNext():

# empty function

continue

ins = getInstructionAt(body.getMinAddress())

opcodes = ''

while ins and ins.getMinAddress() <= body.getMaxAddress():

for b in ins.bytes:

opcodes += chr(b & 0xff)

ins = getInstructionAfter(ins)

crchash = zlib.crc32(opcodes) & 0xffffffff

print name, hex(crchash)

function = getFunctionAfter(function)

Related news

1. Hack Tools Github
2. Pentest Tools Apk
3. Hacking Tools Windows 10
4. Pentest Tools Website Vulnerability
5. Hacker Tools For Pc
6. Tools 4 Hack
7. Hacks And Tools
8. Pentest Tools Github
9. Hacking Tools Hardware
10. Hacker Tools For Ios
11. Pentest Tools Bluekeep
12. Hacker Tools Free
13. Pentest Tools List
14. Hacker Tools Apk Download
15. Pentest Tools Subdomain
16. Hack Apps
17. New Hack Tools
18. Hacker Tools For Mac
19. Hacker Tools For Windows
20. Bluetooth Hacking Tools Kali
21. Hack Apps
22. What Are Hacking Tools
23. Pentest Tools Framework
24. Hacking Tools For Windows
25. Hack Apps
26. Hacking Tools For Games
27. Free Pentest Tools For Windows
28. Hack Tools For Games
29. Ethical Hacker Tools
30. Pentest Tools
31. Hack Website Online Tool
32. Hacking Tools For Windows Free Download
33. Pentest Tools For Mac
34. Pentest Tools Android
35. Tools For Hacker
36. Hack Tools For Mac
37. Hack Tools For Pc
38. Pentest Tools Subdomain
39. Hacking Tools Online
40. Pentest Tools Linux
41. Hacker Tools
42. Pentest Tools Bluekeep
43. Hacker Hardware Tools
44. Nsa Hack Tools
45. Hack Tools
46. Pentest Tools Download
47. Hacker Tools Linux
48. Hack Tools Download
49. Pentest Tools Subdomain
50. Best Hacking Tools 2019
51. Pentest Tools Apk
52. Hack Tools For Windows
53. Hacker Security Tools