Introduction To Reversing Golang Binaries
Golang binaries are a bit hard to analyze but there are some tricks to locate the things and view what is doing the code.
Is possible to list all the go files compiled in the binary even in an striped binaries, in this case we have only one file gohello.go this is a good clue to guess what is doing the program.
On stripped binaries the runtime functions are not resolved so is more difficult to locate the user algorithms:
If we start from the entry point, we will found this mess:
The golang string initialization are encoded and is not displayed on the strings window.
How to locate main? if its not stripped just bp on [package name].main for example bp main.main, (you can locate the package-name searching strings with ".main")
And here is our main.main:
The code is:
So in a stripped binary we cant find the string "hello world" neither the initialization 0x1337 nor the comparator 0x1337, all this is obfuscated.
The initialization sequence is:
The procedure for locating main.main in stripped binaries is:
1. Click on the entry point and locate the runtime.mainPC pointer:
2. click on runtime.main function (LAB_0042B030):
3. locate the main.main call after the zero ifs:
4. click on it and here is the main:
The runtime is not obvious for example the fmt.Scanf() call perform several internal calls until reach the syscall, and in a stripped binary there are no function names.
In order to identify the functions one option is compile another binary with symbols and make function fingerprinting.
In Ghidra we have the script golang_renamer.py which is very useful:
After applying this plugin the main looks like more clear:
This script is an example of function fingerprinting, in this case all the opcodes are included on the crc hashing:
# This script fingerprints the functions
#@author: sha0coder
#@category fingerprinting
print "Fingerprinting..."
import zlib
# loop through program functions
function = getFirstFunction()
while function is not None:
name = str(function.getName())
entry = function.getEntryPoint()
body = function.getBody()
addresses = body.getAddresses(True)
if not addresses.hasNext():
# empty function
continue
ins = getInstructionAt(body.getMinAddress())
opcodes = ''
while ins and ins.getMinAddress() <= body.getMaxAddress():
for b in ins.bytes:
opcodes += chr(b & 0xff)
ins = getInstructionAfter(ins)
crchash = zlib.crc32(opcodes) & 0xffffffff
print name, hex(crchash)
function = getFunctionAfter(function)
- Hacking App
- Hack Tools For Mac
- Tools 4 Hack
- Hacking App
- Hacker Tools Hardware
- Pentest Tools For Ubuntu
- Computer Hacker
- Hack Tools
- Pentest Tools
- Pentest Tools Download
- Hack App
- Hacking Tools Hardware
- Pentest Tools Review
- How To Hack
- Hacker Techniques Tools And Incident Handling
- Pentest Tools Alternative
- Hacking Tools Hardware
- Pentest Tools Website
- Hacking Tools For Mac
- Hacker Tools Free Download
- How To Hack
- Hak5 Tools
- Hacker Tools Free Download
- Hacker Tools Software
- Hacker
- Hacker Tools Windows
- Pentest Recon Tools
- Hacker Tools Mac
- Hack Tool Apk
- Hacking Tools
- New Hack Tools
- Pentest Tools Tcp Port Scanner
- Hacker Tools For Pc
- Hacking Tools Hardware
- Hacker Tools 2019
- Pentest Tools Apk
- Hacking Tools For Mac
- Pentest Tools For Ubuntu
- Nsa Hack Tools
- Hacking Tools Windows
- Hacker Tools Github
- Hacking Tools For Mac
- Hacking Tools Windows 10
- Pentest Tools Free
- Top Pentest Tools
- Pentest Box Tools Download
- Hacker Tools For Ios
- Pentest Tools Framework
- Pentest Tools Url Fuzzer
- What Is Hacking Tools
- Tools For Hacker
- Pentest Tools Review
- Hacking Tools Software
- Best Pentesting Tools 2018
- Hack Tools For Windows
- Pentest Tools Review
- Pentest Tools Review
- Hack Tools For Ubuntu
- Hacking Tools Name
- Hacker Tools Apk Download
- Best Pentesting Tools 2018
- Hacker Tools Mac
- Pentest Tools Url Fuzzer
- Tools For Hacker
- Ethical Hacker Tools
- Hack Tools For Windows
- Pentest Tools List
- Hack Rom Tools
- Hacker Tools Github
- Hacker Tools Free Download
- Hacking App
- Hacker Tools Free
- Pentest Recon Tools
- Nsa Hack Tools
- Pentest Tools
- Hacker Tools 2020
- Pentest Tools Subdomain
- Hacker Search Tools
- Hack Tools For Pc
- Pentest Tools Port Scanner
- Hack Website Online Tool
- Pentest Automation Tools
- Hacking Tools For Pc
- Hacker Tools 2019
- Tools Used For Hacking
- Hacking Tools For Beginners
- Pentest Recon Tools
- Pentest Tools Free
- Physical Pentest Tools
- Hacker
- Hacking Tools Free Download
- Pentest Tools List
- Pentest Box Tools Download
- Hacking Tools For Windows Free Download
- Pentest Tools Website Vulnerability
- Hacking Tools For Windows
- Easy Hack Tools
- Hacker Tools Apk
- Hacker Tools Github
- Best Hacking Tools 2020
- Hack Tools For Ubuntu
- Hacker Tools For Mac
- How To Hack
- Hacking Tools For Windows 7
- Android Hack Tools Github
- Hacker Tools Hardware
- Pentest Automation Tools
- Tools Used For Hacking
- Hacker Tools For Windows
- Pentest Tools Review
- Hacking App
- Pentest Tools Review
- Hacking Tools 2019
- Pentest Tools Kali Linux
- Pentest Tools Website Vulnerability
- Tools 4 Hack
- Hacking Tools For Mac
- Hacking Tools 2019
- Pentest Tools For Mac
- Pentest Tools Free
- Pentest Tools Apk
- New Hack Tools
- Hacker Tools Free Download
- Hacker Tools For Ios
- Hacking Tools Windows
- Hacking Tools Kit
- Usb Pentest Tools
- Pentest Tools Apk
- Pentest Reporting Tools
- Hacking Tools For Pc
- Hak5 Tools
- Pentest Tools Apk
- Best Hacking Tools 2019
- Pentest Tools Linux
- Pentest Tools Subdomain
- Hack Tools For Mac
- Pentest Tools For Ubuntu
- Hack Tools 2019
- Pentest Tools Port Scanner
- Hack Tool Apk No Root
- How To Hack
- Install Pentest Tools Ubuntu
- Hacking Tools Online
- Hackers Toolbox
- How To Make Hacking Tools
- Hacker Techniques Tools And Incident Handling
- Hacking Tools For Windows
- Pentest Tools Review
- Pentest Tools Apk
- Hacking Tools For Kali Linux
- Pentest Tools For Ubuntu
- Hacking Tools For Mac
- Hacker Tools Software
- Pentest Tools Port Scanner
- Hacker Tools List
- Hacker Tools List
- Hack Tools For Windows
- Hacker Tools For Pc
- Hacker Tools 2020
- Hackrf Tools
- Pentest Tools
- Pentest Tools Url Fuzzer
- Hacking Tools For Kali Linux
0 Comments:
Post a Comment
<< Home