Golang binaries are a bit hard to analyze but there are some tricks to locate the things and view what is doing the code.
Is possible to list all the go files compiled in the binary even in an striped binaries, in this case we have only one file gohello.go this is a good clue to guess what is doing the program.
On stripped binaries the runtime functions are not resolved so is more difficult to locate the user algorithms:
If we start from the entry point, we will found this mess:
The golang string initialization are encoded and is not displayed on the strings window.
How to locate main? if its not stripped just bp on [package name].main for example bp main.main, (you can locate the package-name searching strings with ".main")
And here is our main.main:
The code is:
So in a stripped binary we cant find the string "hello world" neither the initialization 0x1337 nor the comparator 0x1337, all this is obfuscated.
The initialization sequence is:
The procedure for locating main.main in stripped binaries is:
1. Click on the entry point and locate the runtime.mainPC pointer:
2. click on runtime.main function (LAB_0042B030):
3. locate the main.main call after the zero ifs:
4. click on it and here is the main:
The runtime is not obvious for example the fmt.Scanf() call perform several internal calls until reach the syscall, and in a stripped binary there are no function names.
In order to identify the functions one option is compile another binary with symbols and make function fingerprinting.
In Ghidra we have the script golang_renamer.py which is very useful:
After applying this plugin the main looks like more clear:
This script is an example of function fingerprinting, in this case all the opcodes are included on the crc hashing:
# This script fingerprints the functions
#@author: sha0coder
#@category fingerprinting
print "Fingerprinting..."
import zlib
# loop through program functions
function = getFirstFunction()
while function is not None:
name = str(function.getName())
entry = function.getEntryPoint()
body = function.getBody()
addresses = body.getAddresses(True)
if not addresses.hasNext():
# empty function
continue
ins = getInstructionAt(body.getMinAddress())
opcodes = ''
while ins and ins.getMinAddress() <= body.getMaxAddress():
for b in ins.bytes:
opcodes += chr(b & 0xff)
ins = getInstructionAfter(ins)
crchash = zlib.crc32(opcodes) & 0xffffffff
print name, hex(crchash)
function = getFunctionAfter(function)
Related articles
- Pentest Tools Bluekeep
- Hacker Security Tools
- Hacking Tools Free Download
- Top Pentest Tools
- Pentest Automation Tools
- Free Pentest Tools For Windows
- Easy Hack Tools
- How To Install Pentest Tools In Ubuntu
- Hack Tools Online
- Hacker Tools For Mac
- Hack Tools For Mac
- How To Install Pentest Tools In Ubuntu
- Pentest Tools Find Subdomains
- Hack Tools For Mac
- Hacking Tools For Windows 7
- Best Pentesting Tools 2018
- Pentest Tools Framework
- Easy Hack Tools
- Hack Rom Tools
- How To Make Hacking Tools
- Hack Tool Apk
- Pentest Tools For Android
- Tools Used For Hacking
- Hacks And Tools
- Hacker Search Tools
- Hacking Tools Windows 10
- Pentest Tools Free
- Hacker Tools For Windows
- Pentest Box Tools Download
- Hacking Tools For Pc
- Pentest Automation Tools
- Pentest Tools Github
- Pentest Tools Framework
- Hacking Tools 2020
- Beginner Hacker Tools
- How To Make Hacking Tools
- Hack Apps
- Hack Tools
- Bluetooth Hacking Tools Kali
- Wifi Hacker Tools For Windows
- Best Hacking Tools 2020
- Pentest Tools Tcp Port Scanner
- Beginner Hacker Tools
- Hack Tools For Ubuntu
- Ethical Hacker Tools
- Black Hat Hacker Tools
- Pentest Tools For Android
- Pentest Reporting Tools
- Pentest Tools Kali Linux
- Hacking Tools 2019
- Hacking Tools Windows
- Hack Tools Download
- Hack Tools For Mac
- Hacker Tools Free
- Pentest Automation Tools
- Hack Apps
- Hack App
- Bluetooth Hacking Tools Kali
- Hacking Tools 2020
- Hacking Tools Hardware
- Hack Tools For Windows
- Hacking Tools Download
- Free Pentest Tools For Windows
- Hacking Tools Kit
- Hacker Tools Hardware
- Hack Tools For Pc
- Pentest Tools Tcp Port Scanner
- Hack Tools Online
- Hacker Tools Linux
- Android Hack Tools Github
- Pentest Tools Android
- Hacker Tools Github
- Hack Tools Pc
- Pentest Box Tools Download
- Hackers Toolbox
- Hacker Tools Windows
- Pentest Tools Windows
- Hacker Security Tools
- How To Make Hacking Tools
- Hack Tools 2019
- Ethical Hacker Tools
- Hacking Tools For Windows Free Download
- Free Pentest Tools For Windows
- Hack Rom Tools
- Hacking Tools Windows 10
- Hacker Tools Free Download
- Hacker Tools For Windows
- Hacker Tools For Windows
- Hacker Tools Github
- Pentest Tools Website
- Pentest Tools For Mac
- Tools For Hacker
- Pentest Tools Website
- Ethical Hacker Tools
- Pentest Tools Review
- Hacking Tools 2020
- Hacker Tools Apk
- Hacker Tools Software
- Pentest Tools Nmap
- Hacker Techniques Tools And Incident Handling
- Pentest Tools Kali Linux
- New Hack Tools
- Pentest Tools Linux
- Pentest Tools Website Vulnerability
No hay comentarios:
Publicar un comentario
Nota: solo los miembros de este blog pueden publicar comentarios.