Introduction To Reversing Golang Binaries

Golang binaries are a bit hard to analyze but there are some tricks to locate the things and view what is doing the code.

Is possible to list all the go files compiled in the binary even in an striped binaries, in this case we have only one file gohello.go this is a good clue to guess what is doing the program.

On stripped binaries the runtime functions are not resolved so is more difficult to locate the user algorithms:

If we start from the entry point, we will found this mess:

The golang string initialization are encoded and is not displayed on the strings window.

How to locate main?  if its not stripped just bp on [package name].main for example bp main.main, (you can locate the package-name searching strings with ".main")

And here is our main.main:

The code is:

So in a stripped binary we cant find the string "hello world" neither the initialization 0x1337 nor the comparator 0x1337, all this is obfuscated.

The initialization sequence is:

The procedure for locating main.main in stripped binaries is:

1. Click on the entry point and locate the runtime.mainPC pointer:

2. click on runtime.main function (LAB_0042B030):

3. locate the main.main call after the zero ifs:

4. click on it and here is the main:

The runtime is not obvious for example the fmt.Scanf() call perform several internal calls until reach the syscall, and in a stripped binary there are no function names.

In order to identify the functions one option is compile another binary with symbols and make function fingerprinting.

In Ghidra we have the script golang_renamer.py which is very useful:

After applying this plugin the main looks like more clear:

This script is an example of function fingerprinting, in this case all the opcodes are included on the crc hashing:

# This script fingerprints the functions

#@author: sha0coder

#@category fingerprinting

print "Fingerprinting..."

import zlib

# loop through program functions

function = getFirstFunction()

while function is not None:

name = str(function.getName())

entry = function.getEntryPoint()

body = function.getBody()

addresses = body.getAddresses(True)

if not addresses.hasNext():

# empty function

continue

ins = getInstructionAt(body.getMinAddress())

opcodes = ''

while ins and ins.getMinAddress() <= body.getMaxAddress():

for b in ins.bytes:

opcodes += chr(b & 0xff)

ins = getInstructionAfter(ins)

crchash = zlib.crc32(opcodes) & 0xffffffff

print name, hex(crchash)

function = getFunctionAfter(function)

Related posts

1. Hacker Security Tools
2. Hacker Tools For Ios
3. Hack Tools Download
4. Hacking Tools Pc
5. Ethical Hacker Tools
6. Black Hat Hacker Tools
7. Pentest Reporting Tools
8. Hacking Tools Mac
9. Pentest Tools Windows
10. Pentest Reporting Tools
11. Free Pentest Tools For Windows
12. What Are Hacking Tools
13. Hacker Tool Kit
14. Nsa Hack Tools
15. Hack Tools
16. Hack Tools Online
17. Hacking Tools Free Download
18. Hacking Tools And Software
19. Best Hacking Tools 2019
20. Hacking Tools Usb
21. Hack Rom Tools
22. Hacker Tools Apk
23. Pentest Tools For Ubuntu
24. Hack Apps
25. Hack Tool Apk No Root
26. Hacker Tools Apk Download
27. Ethical Hacker Tools
28. New Hack Tools
29. Hacking Tools
30. Growth Hacker Tools
31. Hacking Tools For Pc
32. Hacking Tools Hardware
33. Hacking Tools Pc
34. Pentest Tools Linux
35. Pentest Tools Review
36. Pentest Tools Free
37. Hacking Tools Pc
38. Hacking Tools Mac
39. Growth Hacker Tools
40. Hack Tools For Mac
41. Hacker Tools Windows
42. Nsa Hack Tools
43. Hacking Tools Software
44. Hacking Apps
45. Hack Website Online Tool
46. Beginner Hacker Tools
47. Hack Apps
48. Pentest Tools Kali Linux
49. New Hack Tools
50. Blackhat Hacker Tools
51. Pentest Tools Free
52. Computer Hacker
53. Hacker Tools
54. Hacker Security Tools
55. What Are Hacking Tools
56. Usb Pentest Tools
57. Termux Hacking Tools 2019
58. New Hacker Tools