Advertisement
Golang binaries are a bit hard to analyze but there are some tricks to locate the things and view what is doing the code.
Is possible to list all the go files compiled in the binary even in an striped binaries, in this case we have only one file gohello.go this is a good clue to guess what is doing the program.
On stripped binaries the runtime functions are not resolved so is more difficult to locate the user algorithms:
If we start from the entry point, we will found this mess:
The golang string initialization are encoded and is not displayed on the strings window.
How to locate main? if its not stripped just bp on [package name].main for example bp main.main, (you can locate the package-name searching strings with ".main")
And here is our main.main:
The code is:
So in a stripped binary we cant find the string "hello world" neither the initialization 0x1337 nor the comparator 0x1337, all this is obfuscated.
The initialization sequence is:
The procedure for locating main.main in stripped binaries is:
1. Click on the entry point and locate the runtime.mainPC pointer:
2. click on runtime.main function (LAB_0042B030):
3. locate the main.main call after the zero ifs:
4. click on it and here is the main:
The runtime is not obvious for example the fmt.Scanf() call perform several internal calls until reach the syscall, and in a stripped binary there are no function names.
In order to identify the functions one option is compile another binary with symbols and make function fingerprinting.
In Ghidra we have the script golang_renamer.py which is very useful:
After applying this plugin the main looks like more clear:
This script is an example of function fingerprinting, in this case all the opcodes are included on the crc hashing:
# This script fingerprints the functions
#@author: sha0coder
#@category fingerprinting
print "Fingerprinting..."
import zlib
# loop through program functions
function = getFirstFunction()
while function is not None:
name = str(function.getName())
entry = function.getEntryPoint()
body = function.getBody()
addresses = body.getAddresses(True)
if not addresses.hasNext():
# empty function
continue
ins = getInstructionAt(body.getMinAddress())
opcodes = ''
while ins and ins.getMinAddress() <= body.getMaxAddress():
for b in ins.bytes:
opcodes += chr(b & 0xff)
ins = getInstructionAfter(ins)
crchash = zlib.crc32(opcodes) & 0xffffffff
print name, hex(crchash)
function = getFunctionAfter(function)
Read more
- Pentest Tools Android
- Hacker Tools For Windows
- Game Hacking
- Hack Tool Apk
- Hacking Tools Online
- Hack Tools 2019
- Hacking Tools 2019
- Hacking Tools For Kali Linux
- Hacker Tools Online
- Hack Tools Github
- Hacker Tools Windows
- Hacker Tools Linux
- Hack Tools
- Termux Hacking Tools 2019
- Blackhat Hacker Tools
- Nsa Hacker Tools
- Pentest Tools Bluekeep
- Kik Hack Tools
- Hacking Tools Software
- Hack Tools For Mac
- Hack Tools 2019
- Hacking Tools Hardware
- Hack Apps
- How To Make Hacking Tools
- Hacking Tools Kit
- Hacker Tools For Pc
- Hacker Tools
- Pentest Tools Linux
- Hack Tools Mac
- Hacking Tools For Beginners
- Hack App
- Pentest Tools Kali Linux
- Hackrf Tools
- Tools 4 Hack
- Pentest Tools Port Scanner
- Hacking Tools Pc
- Hacking Tools Mac
- Hacker Tool Kit
- Pentest Tools Website
- Hack Tools
- Nsa Hacker Tools
- Hacking Tools Hardware
- Hacking Tools For Windows
- Pentest Tools Open Source
- Hack Tools Online
- Hack Tool Apk No Root
- Pentest Tools Open Source
- Pentest Tools Linux
- Nsa Hack Tools Download
- Hacker Techniques Tools And Incident Handling
- Hacking Tools For Windows
- Hack Apps
- Black Hat Hacker Tools
- Kik Hack Tools
- Hacker Tool Kit
- How To Hack
- Hacker Tools For Pc
- Pentest Box Tools Download
- Hacking Tools Kit
- Tools For Hacker
- Hacker Tools Software
- Bluetooth Hacking Tools Kali
- Growth Hacker Tools
- Hak5 Tools
- Hacking Tools Windows 10
- Hacker Tools Github
- Hack Tools Mac
- Hacker Tools Software
- Hacker Tools
- Pentest Tools For Ubuntu
- Ethical Hacker Tools
- Pentest Tools
- Pentest Tools Url Fuzzer
- Hacker Tools Windows
- Free Pentest Tools For Windows
- Pentest Tools Website
- Ethical Hacker Tools
- Hack Tools 2019
- Hacking Tools For Mac
- Hak5 Tools
- Pentest Tools For Android
- Pentest Tools For Mac
- Hacking Tools Windows
- Hacker Security Tools
- Pentest Tools Apk
- Pentest Tools Bluekeep
- Pentest Tools For Android
- Pentest Tools Framework
- Hacker Tools 2020
- Ethical Hacker Tools
- Pentest Tools List
- Blackhat Hacker Tools
- Pentest Tools For Ubuntu
- Pentest Reporting Tools
- Hack Tools Online
- Hacker Tools For Mac
- Hacking Tools For Beginners
- Pentest Tools For Android
- Hacker Tools Mac
- Hacking Tools For Windows
- Kik Hack Tools
- Android Hack Tools Github
- Hak5 Tools
- New Hack Tools
- Hacker Search Tools