Pages

Subscribe:

Thursday, 1 June 2023

Introduction To Reversing Golang Binaries


Golang binaries are a bit hard to analyze but there are some tricks to locate the things and view what is doing the code.






Is possible to list all the go files compiled in the binary even in an striped binaries, in this case we have only one file gohello.go this is a good clue to guess what is doing the program.


On stripped binaries the runtime functions are not resolved so is more difficult to locate the user algorithms:


If we start from the entry point, we will found this mess:

The golang string initialization are encoded and is not displayed on the strings window.


How to locate main?  if its not stripped just bp on [package name].main for example bp main.main, (you can locate the package-name searching strings with ".main")


And here is our main.main:


The code is:

So in a stripped binary we cant find the string "hello world" neither the initialization 0x1337 nor the comparator 0x1337, all this is obfuscated.

The initialization sequence is:


The procedure for locating main.main in stripped binaries is:
1. Click on the entry point and locate the runtime.mainPC pointer:



2. click on runtime.main function (LAB_0042B030):


3. locate the main.main call after the zero ifs:



4. click on it and here is the main:




The runtime is not obvious for example the fmt.Scanf() call perform several internal calls until reach the syscall, and in a stripped binary there are no function names.



In order to identify the functions one option is compile another binary with symbols and make function fingerprinting.

In Ghidra we have the script golang_renamer.py which is very useful:


After applying this plugin the main looks like more clear:




This script is an example of function fingerprinting, in this case all the opcodes are included on the crc hashing:
# This script fingerprints the functions
#@author: sha0coder
#@category fingerprinting

print "Fingerprinting..."

import zlib


# loop through program functions
function = getFirstFunction()
while function is not None:
name = str(function.getName())
entry = function.getEntryPoint()
body = function.getBody()
addresses = body.getAddresses(True)

if not addresses.hasNext():
# empty function
continue

ins = getInstructionAt(body.getMinAddress())
opcodes = ''
while ins and ins.getMinAddress() <= body.getMaxAddress():
for b in ins.bytes:
opcodes += chr(b & 0xff)
ins = getInstructionAfter(ins)
crchash = zlib.crc32(opcodes) & 0xffffffff

print name, hex(crchash)


function = getFunctionAfter(function)





More articles


  1. Hacking Apps
  2. Pentest Automation Tools
  3. Hak5 Tools
  4. Pentest Tools Review
  5. Hak5 Tools
  6. Pentest Tools Android
  7. Hacking Tools Windows
  8. Hack Tools Mac
  9. Pentest Tools Review
  10. Hack Rom Tools
  11. Hack Tools For Mac
  12. Hacking Tools Kit
  13. Hack Website Online Tool
  14. Hacker Tools Free Download
  15. Pentest Tools Alternative
  16. Hack Tools For Windows
  17. Pentest Automation Tools
  18. Hack Tools Pc
  19. Hacker Tools 2019
  20. Usb Pentest Tools
  21. Usb Pentest Tools
  22. World No 1 Hacker Software
  23. Tools 4 Hack
  24. Hacker Tools Software
  25. Tools 4 Hack
  26. Pentest Tools For Windows
  27. How To Hack
  28. Hacking Tools Usb
  29. Github Hacking Tools
  30. Hacking App
  31. Pentest Tools
  32. Hacker Tools Github
  33. Pentest Recon Tools
  34. Pentest Tools Framework
  35. Pentest Tools Download
  36. Ethical Hacker Tools
  37. Pentest Tools For Ubuntu
  38. Hacking Tools Github
  39. Bluetooth Hacking Tools Kali
  40. Hacking Tools For Beginners
  41. Hacker Tools For Windows
  42. Pentest Tools Website
  43. How To Hack
  44. Hacker Security Tools
  45. Hacking Tools Github
  46. Hack Tools For Windows
  47. Hacking App
  48. Pentest Tools Website
  49. Termux Hacking Tools 2019
  50. Pentest Tools Apk
  51. Hack Tools For Ubuntu
  52. Pentest Tools Port Scanner
  53. New Hack Tools
  54. Hackrf Tools
  55. Hacker Tools List
  56. Hacking App
  57. New Hacker Tools
  58. Hack Tool Apk
  59. Pentest Tools Open Source
  60. Hacker Tools For Ios
  61. Game Hacking
  62. Underground Hacker Sites
  63. Hacker Tool Kit
  64. Pentest Tools Tcp Port Scanner
  65. Hacker Tools Free
  66. Hacker Tools 2019
  67. Hack Tools
  68. Hack Tools Online
  69. Hacker
  70. Hacker Tool Kit
  71. Hack Tools For Windows
  72. Hack Tools Github
  73. Hacking Tools Windows 10
  74. Hack Tools 2019
  75. Nsa Hacker Tools
  76. Hacker Security Tools
  77. Pentest Tools Url Fuzzer
  78. Hacker
  79. Hacking Tools Github
  80. Hack Tools
  81. Hacking Tools Windows
  82. Hacking Tools And Software
  83. Hacker Tool Kit
  84. Hacking Tools Free Download
  85. What Is Hacking Tools
  86. Nsa Hack Tools
  87. Hack Tools Pc
  88. Pentest Tools Review
  89. Hack Tool Apk
  90. Hacking Tools 2019
  91. Hacking Tools For Windows 7
  92. Hacking App
  93. Hacker Techniques Tools And Incident Handling
  94. Hacking Tools For Pc
  95. Pentest Tools Website
  96. Tools For Hacker
  97. Hack Tools For Windows
  98. Hacker Tools
  99. Hacker Tools For Mac
  100. Install Pentest Tools Ubuntu
  101. Hacking Tools
  102. World No 1 Hacker Software
  103. Hacker Tools List
  104. Hack Tools For Ubuntu
  105. Pentest Tools Framework
  106. Hacker Techniques Tools And Incident Handling
  107. Hacking Tools And Software
  108. Underground Hacker Sites

No comments:

Post a Comment