Golang binaries are a bit hard to analyze but there are some tricks to locate the things and view what is doing the code.
Is possible to list all the go files compiled in the binary even in an striped binaries, in this case we have only one file gohello.go this is a good clue to guess what is doing the program.
On stripped binaries the runtime functions are not resolved so is more difficult to locate the user algorithms:
If we start from the entry point, we will found this mess:
The golang string initialization are encoded and is not displayed on the strings window.
How to locate main? if its not stripped just bp on [package name].main for example bp main.main, (you can locate the package-name searching strings with ".main")
And here is our main.main:
The code is:
So in a stripped binary we cant find the string "hello world" neither the initialization 0x1337 nor the comparator 0x1337, all this is obfuscated.
The initialization sequence is:
The procedure for locating main.main in stripped binaries is:
1. Click on the entry point and locate the runtime.mainPC pointer:
2. click on runtime.main function (LAB_0042B030):
3. locate the main.main call after the zero ifs:
4. click on it and here is the main:
The runtime is not obvious for example the fmt.Scanf() call perform several internal calls until reach the syscall, and in a stripped binary there are no function names.
In order to identify the functions one option is compile another binary with symbols and make function fingerprinting.
In Ghidra we have the script golang_renamer.py which is very useful:
After applying this plugin the main looks like more clear:
This script is an example of function fingerprinting, in this case all the opcodes are included on the crc hashing:
# This script fingerprints the functions
#@author: sha0coder
#@category fingerprinting
print "Fingerprinting..."
import zlib
# loop through program functions
function = getFirstFunction()
while function is not None:
name = str(function.getName())
entry = function.getEntryPoint()
body = function.getBody()
addresses = body.getAddresses(True)
if not addresses.hasNext():
# empty function
continue
ins = getInstructionAt(body.getMinAddress())
opcodes = ''
while ins and ins.getMinAddress() <= body.getMaxAddress():
for b in ins.bytes:
opcodes += chr(b & 0xff)
ins = getInstructionAfter(ins)
crchash = zlib.crc32(opcodes) & 0xffffffff
print name, hex(crchash)
function = getFunctionAfter(function)
Related word
- Hacks And Tools
- Ethical Hacker Tools
- Pentest Tools Free
- Hacker Tools
- Hacker Search Tools
- New Hacker Tools
- Pentest Tools Linux
- Hacking Tools For Mac
- Pentest Tools Android
- Hacker Hardware Tools
- Best Hacking Tools 2019
- Pentest Tools Url Fuzzer
- Nsa Hack Tools
- Pentest Tools Tcp Port Scanner
- Hack Tool Apk No Root
- Pentest Tools Linux
- Pentest Tools Url Fuzzer
- Hacker Tools Free Download
- Hack Apps
- Hacker Tools For Ios
- Hacker Tools Software
- Hacker Tools 2019
- Physical Pentest Tools
- Hack Tools
- Hacking Tools Mac
- Pentest Tools Github
- Hacking Tools And Software
- Hacking Tools For Kali Linux
- Kik Hack Tools
- Nsa Hack Tools Download
- Github Hacking Tools
- Pentest Tools Port Scanner
- Hak5 Tools
- Tools 4 Hack
- World No 1 Hacker Software
- Underground Hacker Sites
- Hacking Tools For Windows Free Download
- How To Make Hacking Tools
- Hacking Tools Download
- Pentest Tools Online
- Pentest Tools Port Scanner
- Android Hack Tools Github
- Hacking Tools Free Download
- Hacker Tools Linux
- Hack Tool Apk
- Hacks And Tools
- Hacker Tools Software
- Pentest Reporting Tools
- Hacking Tools For Windows 7
- Hacker Tools 2019
- Best Hacking Tools 2020
- Pentest Tools For Android
- Hacking App
- Hacker Tools Software
- Pentest Tools Nmap
- Hacking Apps
- Hack Tools Github
- Pentest Tools Nmap
- Underground Hacker Sites
- Pentest Tools Linux
- How To Hack
- Pentest Tools Apk
- Pentest Tools Apk
- Hacker Tools Apk
- Pentest Tools Website Vulnerability
- Pentest Tools Online
- Hacker Tools List
- Hacker Tools Apk
- Pentest Recon Tools
- Hacking Tools
- Bluetooth Hacking Tools Kali
- Hack Tools For Windows
- How To Hack
- Pentest Tools Download
- Pentest Tools Framework
- Pentest Tools Windows
- Hacker Tools For Pc
- Pentest Tools Website Vulnerability
- Pentest Tools Alternative
- Hacking Tools 2019
- Hacking Tools Online
- How To Make Hacking Tools
- Hack Tools For Pc
- Hacker Tools For Pc
- Termux Hacking Tools 2019
- Hack Tools For Games
- Pentest Tools For Mac
- Hack Tools
- Hack Tools For Pc
- Hack Tool Apk
- Pentest Tools
- Hacker Tools 2019
- Hack Tools Pc
- Pentest Box Tools Download
- Pentest Tools Android
- Hacker Tools For Pc
- Hackers Toolbox
- Hacker Tools Hardware
- Pentest Tools Find Subdomains
- Hacker Techniques Tools And Incident Handling
- Physical Pentest Tools
- Hacking Tools Mac
- Hacker Tools List
- Blackhat Hacker Tools
- Tools Used For Hacking
- Hack Tool Apk
- Hacking Tools For Windows 7
- Kik Hack Tools
- Hacking Tools Kit
- Growth Hacker Tools
- Hacker
- Hak5 Tools
- Underground Hacker Sites
- Hacker Tools For Pc
- Hacking Tools For Games
- Hacker Tools Linux
- Hacker Tools Apk Download
- Physical Pentest Tools
- Hack Tools Download
- Pentest Tools Port Scanner
- Nsa Hack Tools
- Hack Tools For Windows
- Easy Hack Tools
- Hack Tools For Windows
- Pentest Tools For Android
- Hack Tools
- Hack Tools Github
- How To Hack
- Hacking Tools Software
- What Is Hacking Tools
- Black Hat Hacker Tools
- Top Pentest Tools
- Hacking Tools Windows
- Hacker Tools Github
- Android Hack Tools Github
- Hack Rom Tools
- Hacking Tools Windows 10
- Best Hacking Tools 2020
- World No 1 Hacker Software
- What Is Hacking Tools
- Pentest Tools Windows
- Growth Hacker Tools
- Hacker Tools For Mac
- Pentest Tools For Android
- Hacking Tools Name
- Hacking Tools For Kali Linux
- Hack Tools For Pc
- Hacker Techniques Tools And Incident Handling
- What Are Hacking Tools
- Pentest Tools Download
- Hack Tools Github
- Blackhat Hacker Tools
- Pentest Tools Bluekeep
- Pentest Tools Kali Linux
- Hacking Tools And Software
- Pentest Tools Android
- Pentest Tools Subdomain
- What Is Hacking Tools
- Pentest Tools Subdomain
- Hacker Tools For Windows
- Hacker Tools For Ios
- Pentest Tools List
- Hacker Tools Linux
- Hack Tools Pc
No comments:
Post a Comment