Introduction To Reversing Golang Binaries

Golang binaries are a bit hard to analyze but there are some tricks to locate the things and view what is doing the code.

Is possible to list all the go files compiled in the binary even in an striped binaries, in this case we have only one file gohello.go this is a good clue to guess what is doing the program.

On stripped binaries the runtime functions are not resolved so is more difficult to locate the user algorithms:

If we start from the entry point, we will found this mess:

The golang string initialization are encoded and is not displayed on the strings window.

How to locate main?  if its not stripped just bp on [package name].main for example bp main.main, (you can locate the package-name searching strings with ".main")

And here is our main.main:

The code is:

So in a stripped binary we cant find the string "hello world" neither the initialization 0x1337 nor the comparator 0x1337, all this is obfuscated.

The initialization sequence is:

The procedure for locating main.main in stripped binaries is:

1. Click on the entry point and locate the runtime.mainPC pointer:

2. click on runtime.main function (LAB_0042B030):

3. locate the main.main call after the zero ifs:

4. click on it and here is the main:

The runtime is not obvious for example the fmt.Scanf() call perform several internal calls until reach the syscall, and in a stripped binary there are no function names.

In order to identify the functions one option is compile another binary with symbols and make function fingerprinting.

In Ghidra we have the script golang_renamer.py which is very useful:

After applying this plugin the main looks like more clear:

This script is an example of function fingerprinting, in this case all the opcodes are included on the crc hashing:

# This script fingerprints the functions

#@author: sha0coder

#@category fingerprinting

print "Fingerprinting..."

import zlib

# loop through program functions

function = getFirstFunction()

while function is not None:

name = str(function.getName())

entry = function.getEntryPoint()

body = function.getBody()

addresses = body.getAddresses(True)

if not addresses.hasNext():

# empty function

continue

ins = getInstructionAt(body.getMinAddress())

opcodes = ''

while ins and ins.getMinAddress() <= body.getMaxAddress():

for b in ins.bytes:

opcodes += chr(b & 0xff)

ins = getInstructionAfter(ins)

crchash = zlib.crc32(opcodes) & 0xffffffff

print name, hex(crchash)

function = getFunctionAfter(function)

Continue reading

1. Hacker Tools Apk Download
2. Hacking Tools Hardware
3. Hack Website Online Tool
4. Hacking Tools Usb
5. Hack Apps
6. Hacking Tools Kit
7. Pentest Tools Free
8. Hacks And Tools
9. Hacker Tools List
10. Hack Tools For Mac
11. Hacker Tools For Mac
12. Hacker Techniques Tools And Incident Handling
13. New Hacker Tools
14. Pentest Tools Website Vulnerability
15. Pentest Tools Website
16. Hacking Tools For Games
17. Hacker Tools Free
18. Hacking Tools Download
19. Pentest Tools Alternative
20. Hacking Tools Free Download
21. What Is Hacking Tools
22. Game Hacking
23. Black Hat Hacker Tools
24. Tools Used For Hacking
25. Termux Hacking Tools 2019
26. Hacker Search Tools
27. Hack Tools
28. Hack App
29. Hack Tools For Windows
30. Pentest Tools Nmap
31. Hack Tools
32. Hak5 Tools
33. Hack Tools For Pc
34. Hackrf Tools
35. Nsa Hacker Tools
36. Hacking Tools For Windows 7
37. Hacking Tools Windows 10
38. Hacker Tools 2019
39. Hack And Tools
40. Pentest Tools Subdomain
41. Hack App
42. Pentest Tools Tcp Port Scanner
43. Hacking Tools Download
44. Pentest Tools Alternative
45. Hacker Tool Kit
46. Hacking Tools Download
47. Github Hacking Tools
48. Hacker Search Tools
49. Install Pentest Tools Ubuntu
50. Underground Hacker Sites
51. Hacking Tools Download
52. Hacking Tools Online
53. Hacking Tools Download
54. Pentest Tools Alternative
55. Hacking Tools Usb
56. Pentest Tools Free
57. Nsa Hack Tools
58. Hacker Tools Mac
59. Hacker Tools For Mac
60. Usb Pentest Tools
61. Hacking Tools For Windows Free Download
62. Hack Tools Pc
63. Hacking Tools Windows 10
64. Game Hacking
65. Growth Hacker Tools
66. Hack Rom Tools
67. Hacker Tools Software
68. Hack Tools For Windows
69. Pentest Reporting Tools
70. Pentest Tools For Ubuntu
71. Hacking Tools Online
72. Blackhat Hacker Tools
73. Pentest Tools Kali Linux
74. Top Pentest Tools
75. Kik Hack Tools
76. Pentest Tools Alternative
77. Hacking Tools Online
78. Pentest Tools Find Subdomains
79. Hacker Tools Mac
80. Pentest Tools Bluekeep
81. Hacking Tools 2020
82. Pentest Tools Apk
83. Hack Tools For Pc
84. Hacker Tools Free
85. Hacking Tools
86. Pentest Tools Website
87. Hacker Tools Free
88. Hacking Tools Windows 10
89. Pentest Tools Port Scanner
90. Hacking Tools For Mac
91. Pentest Tools Review
92. Pentest Tools Windows
93. Hacking Tools For Games
94. Pentest Tools Github
95. Ethical Hacker Tools
96. Hack Apps
97. Hacker Tools Apk Download
98. Pentest Tools Github
99. Hack Tools Download
100. Pentest Tools Online
101. Pentest Tools Tcp Port Scanner
102. Hacking Tools Mac
103. Hackrf Tools
104. Hacking App
105. Hacking Tools Windows
106. Hacker Tools Linux
107. Physical Pentest Tools
108. Top Pentest Tools
109. Hacking App
110. Underground Hacker Sites
111. Hacking Tools For Windows
112. Pentest Tools Bluekeep
113. Pentest Tools Website Vulnerability
114. Hacker Tools
115. Hacker Security Tools
116. Easy Hack Tools
117. Hacking Tools Name
118. Hacking Apps
119. Hacking Tools
120. Black Hat Hacker Tools
121. Hacking Tools Github
122. Pentest Tools For Mac
123. Hacking Tools For Beginners
124. Pentest Automation Tools
125. Hack Tools For Games
126. How To Make Hacking Tools
127. Hack Tools For Pc
128. Hack Tool Apk
129. Hack Apps
130. Pentest Recon Tools
131. Pentest Tools Open Source
132. Pentest Tools For Windows
133. Pentest Tools Website Vulnerability
134. How To Hack
135. Pentest Tools Website Vulnerability
136. Pentest Tools Open Source
137. What Is Hacking Tools
138. Hackers Toolbox