Introduction To Reversing Golang Binaries
Golang binaries are a bit hard to analyze but there are some tricks to locate the things and view what is doing the code.
Is possible to list all the go files compiled in the binary even in an striped binaries, in this case we have only one file gohello.go this is a good clue to guess what is doing the program.
On stripped binaries the runtime functions are not resolved so is more difficult to locate the user algorithms:
If we start from the entry point, we will found this mess:
The golang string initialization are encoded and is not displayed on the strings window.
How to locate main? if its not stripped just bp on [package name].main for example bp main.main, (you can locate the package-name searching strings with ".main")
And here is our main.main:
The code is:
So in a stripped binary we cant find the string "hello world" neither the initialization 0x1337 nor the comparator 0x1337, all this is obfuscated.
The initialization sequence is:
The procedure for locating main.main in stripped binaries is:
1. Click on the entry point and locate the runtime.mainPC pointer:
2. click on runtime.main function (LAB_0042B030):
3. locate the main.main call after the zero ifs:
4. click on it and here is the main:
The runtime is not obvious for example the fmt.Scanf() call perform several internal calls until reach the syscall, and in a stripped binary there are no function names.
In order to identify the functions one option is compile another binary with symbols and make function fingerprinting.
In Ghidra we have the script golang_renamer.py which is very useful:
After applying this plugin the main looks like more clear:
This script is an example of function fingerprinting, in this case all the opcodes are included on the crc hashing:
# This script fingerprints the functions
#@author: sha0coder
#@category fingerprinting
print "Fingerprinting..."
import zlib
# loop through program functions
function = getFirstFunction()
while function is not None:
name = str(function.getName())
entry = function.getEntryPoint()
body = function.getBody()
addresses = body.getAddresses(True)
if not addresses.hasNext():
# empty function
continue
ins = getInstructionAt(body.getMinAddress())
opcodes = ''
while ins and ins.getMinAddress() <= body.getMaxAddress():
for b in ins.bytes:
opcodes += chr(b & 0xff)
ins = getInstructionAfter(ins)
crchash = zlib.crc32(opcodes) & 0xffffffff
print name, hex(crchash)
function = getFunctionAfter(function)
- Blackhat Hacker Tools
- Android Hack Tools Github
- Hacker Tools Online
- Hacking Tools Online
- Pentest Tools Url Fuzzer
- Nsa Hack Tools Download
- Hack Rom Tools
- Pentest Tools Free
- Bluetooth Hacking Tools Kali
- Hackers Toolbox
- Hacker Tools For Pc
- Best Hacking Tools 2019
- Hacking Tools Windows
- Pentest Tools Bluekeep
- Best Hacking Tools 2019
- Pentest Box Tools Download
- Hacker Tools For Ios
- Hack Tools Pc
- Hacker Tools Free
- Termux Hacking Tools 2019
- Nsa Hack Tools
- Termux Hacking Tools 2019
- Pentest Tools Port Scanner
- Usb Pentest Tools
- Pentest Tools For Mac
- Pentest Tools Port Scanner
- Hacker Hardware Tools
- Pentest Tools Subdomain
- Pentest Tools Framework
- Hacker Tools
- Blackhat Hacker Tools
- Hacking Tools
- Nsa Hack Tools
- Beginner Hacker Tools
- New Hacker Tools
- Nsa Hack Tools Download
- New Hacker Tools
- Growth Hacker Tools
- Hacking Tools Download
- Pentest Tools Subdomain
- Hackers Toolbox
- Hacking Tools Pc
- Pentest Tools Linux
- Hacker Security Tools
- Hacking Tools Software
- Kik Hack Tools
- Hacks And Tools
- Hack Tools For Games
- Hacker Tools Apk
- Hacking Tools Download
- Pentest Tools Windows
- Hacking Tools For Games
- Pentest Tools Alternative
- Best Hacking Tools 2019
- Hack Tool Apk
- Hacker Tools
- Pentest Tools For Windows
- Hacker Tools For Mac
- Hacker Tools
- Best Hacking Tools 2019
- Hacker Tools Software
- How To Make Hacking Tools
- Usb Pentest Tools
- Black Hat Hacker Tools
- Hack Tool Apk
- Hackers Toolbox
- Hacker Tools Windows
- Hack App
- Hacking Apps
- Hacking Tools And Software
- Pentest Tools Free
- Nsa Hack Tools Download
- Physical Pentest Tools
- Hack Tools Pc
- Pentest Tools Apk
- Hack App
- Hack Tools For Mac
- Physical Pentest Tools
- Hack Tools For Ubuntu
- Best Pentesting Tools 2018
- Nsa Hack Tools Download
- Pentest Tools Website
- Hacker Tools Apk Download
- Hackrf Tools
- Blackhat Hacker Tools
- Hak5 Tools
- Pentest Tools Subdomain
- Pentest Tools Website
- Hack Apps
- Hacking Tools For Beginners
- New Hack Tools
- Wifi Hacker Tools For Windows
- Pentest Tools Subdomain
- Pentest Recon Tools
- Hack Tools Github
- Pentest Tools For Windows
- Hacking Tools Mac
- Pentest Box Tools Download
- Hacker Techniques Tools And Incident Handling
- Hackers Toolbox
- Hacker Tools For Ios
- Hacking Tools Free Download
- What Is Hacking Tools
- Pentest Tools Github
- Hacking Tools Windows
- Hacker Tools Online
- Hack Tools Github
- Hack Website Online Tool
- Pentest Tools Tcp Port Scanner
- Ethical Hacker Tools
- Nsa Hack Tools
- Hacking Tools For Mac
- Hack Tools For Pc
- Hacker Tools 2019
- Blackhat Hacker Tools
- Pentest Reporting Tools
- Best Pentesting Tools 2018
- Wifi Hacker Tools For Windows
- Hacker Tools Apk
- Hacker Tools Windows
- Pentest Automation Tools
- Pentest Tools Url Fuzzer
- Hacker Tools
- Install Pentest Tools Ubuntu
- Hack Tools
- Android Hack Tools Github
- Blackhat Hacker Tools
- Pentest Tools Nmap
- Pentest Tools Nmap
- Install Pentest Tools Ubuntu
- Best Pentesting Tools 2018
- Pentest Tools Find Subdomains
- Pentest Tools Apk
- Hacking Tools
- Pentest Tools Android
- Hacking Tools 2019
- Pentest Tools Website Vulnerability
- What Is Hacking Tools
- Hacker Search Tools
- Hackrf Tools
- Pentest Tools Find Subdomains
- Android Hack Tools Github
- Black Hat Hacker Tools
0 Comments:
Post a Comment
<< Home