Golang binaries are a bit hard to analyze but there are some tricks to locate the things and view what is doing the code.
Is possible to list all the go files compiled in the binary even in an striped binaries, in this case we have only one file gohello.go this is a good clue to guess what is doing the program.
On stripped binaries the runtime functions are not resolved so is more difficult to locate the user algorithms:
If we start from the entry point, we will found this mess:
The golang string initialization are encoded and is not displayed on the strings window.
How to locate main? if its not stripped just bp on [package name].main for example bp main.main, (you can locate the package-name searching strings with ".main")
And here is our main.main:
The code is:
So in a stripped binary we cant find the string "hello world" neither the initialization 0x1337 nor the comparator 0x1337, all this is obfuscated.
The initialization sequence is:
The procedure for locating main.main in stripped binaries is:
1. Click on the entry point and locate the runtime.mainPC pointer:
2. click on runtime.main function (LAB_0042B030):
3. locate the main.main call after the zero ifs:
4. click on it and here is the main:
The runtime is not obvious for example the fmt.Scanf() call perform several internal calls until reach the syscall, and in a stripped binary there are no function names.
In order to identify the functions one option is compile another binary with symbols and make function fingerprinting.
In Ghidra we have the script golang_renamer.py which is very useful:
After applying this plugin the main looks like more clear:
This script is an example of function fingerprinting, in this case all the opcodes are included on the crc hashing:
# This script fingerprints the functions
#@author: sha0coder
#@category fingerprinting
print "Fingerprinting..."
import zlib
# loop through program functions
function = getFirstFunction()
while function is not None:
name = str(function.getName())
entry = function.getEntryPoint()
body = function.getBody()
addresses = body.getAddresses(True)
if not addresses.hasNext():
# empty function
continue
ins = getInstructionAt(body.getMinAddress())
opcodes = ''
while ins and ins.getMinAddress() <= body.getMaxAddress():
for b in ins.bytes:
opcodes += chr(b & 0xff)
ins = getInstructionAfter(ins)
crchash = zlib.crc32(opcodes) & 0xffffffff
print name, hex(crchash)
function = getFunctionAfter(function)
Related links
- Pentest Tools Tcp Port Scanner
- Hacking Tools Kit
- Hack Tools For Windows
- Hacker Tools For Windows
- Tools Used For Hacking
- Pentest Tools Framework
- Nsa Hack Tools
- Pentest Tools Windows
- Pentest Tools Kali Linux
- Best Hacking Tools 2020
- Hack Tools For Windows
- World No 1 Hacker Software
- Android Hack Tools Github
- Pentest Tools List
- Hacker Tools For Mac
- Hack Tools For Games
- Beginner Hacker Tools
- Hacker Tools For Mac
- Usb Pentest Tools
- Hacker
- Hacking Tools Usb
- Wifi Hacker Tools For Windows
- Hacking Tools Hardware
- Hacker Tools Apk Download
- Hacking Tools For Windows 7
- Hacker Tools Apk Download
- Hack Tools 2019
- Hack Tools Github
- Pentest Tools Linux
- Hacking Tools For Kali Linux
- Hacking Tools And Software
- Hacker Tools List
- World No 1 Hacker Software
- Hacking Tools And Software
- Hacking Tools Windows
- Hak5 Tools
- Pentest Tools Kali Linux
- Hack Tools For Windows
- Pentest Tools Free
- Blackhat Hacker Tools
- Install Pentest Tools Ubuntu
- Pentest Tools Nmap
- Black Hat Hacker Tools
- World No 1 Hacker Software
- Pentest Tools Review
- Wifi Hacker Tools For Windows
- Hacking Tools Hardware
- Hacks And Tools
- Hack Tools Pc
- Hacking Tools Kit
- Hacker Tools Windows
- How To Hack
- Pentest Tools Linux
- Growth Hacker Tools
- Pentest Tools List
- Hacking Tools 2019
- Pentest Tools Port Scanner
- How To Install Pentest Tools In Ubuntu
- Hacking Tools For Games
- Ethical Hacker Tools
- Easy Hack Tools
- Pentest Tools Android
- Hacking Tools
- Pentest Tools
- Pentest Tools List
- Hacking Tools Mac
- Hacking Tools Free Download
- Pentest Tools Review
- Hacking Tools Free Download
- Tools Used For Hacking
- Hacking Tools Pc
- Usb Pentest Tools
- Tools 4 Hack
- Wifi Hacker Tools For Windows
- Hack App
- Pentest Tools Github
- Hacking Tools Download
- Hacker Hardware Tools
- Pentest Tools
- Pentest Tools Free
- Hacker Tools For Windows
- Hacking Tools Mac
- Nsa Hacker Tools
- Install Pentest Tools Ubuntu
- Hacking Tools Windows 10
- Pentest Tools For Android
- Pentest Tools For Windows
- Pentest Tools For Ubuntu
- Hack Tools Online
- Hack Tools
- Hacking Tools Usb
- Pentest Tools Bluekeep
- Easy Hack Tools
- Tools For Hacker
- Hack Tools
- Hack Tools Mac
- Hacking Tools Hardware