8 ms·
Reversing Go Binaries Like a Pro
- fbreduc 10y agoif err != nil ?
- kevinburke 10y agoI'm getting a Chromium security error because this website is presenting a certificate from *.github.com.
- cconover 10y agoMe too.
- differentials 10y agoAuthor here... Link was submitted using https which I had not set up yet. Just switched over to a CF nameserver so it should be working shortly...
- FiloSottile 10y agoIt's my fault. I use HTTPS Everywhere in full HTTP blocking mode, so when a link isn't HTTPS I just try manually, and accept the error for common Akamai and Github Pages certs, which is still much better than HTTP (for random sites). But then I ended up submitting that broken link. The interesting thing is that it reached the top (#4 right now) of HN anyway.
- tedunangst 10y agoGo? Reversing? Say no more, have an upvote!
- nadermx 10y agoworking link http://rednaga.io/2016/09/21/reversing_go_binaries_like_a_pro/ http://rednaga.io/2016/09/21/reversing_go_binaries_like_a_pr...
- differentials 10y agoThe https link should be working now, switched over to cloudflare. Thanks for the link though!
- alblue 10y agoThere's a typo in the write up - lenght
- mappu 10y ago> You can quiet easily differentiate between custom code written for the binary, for example in the Linux malware “Rex” everything because with that name space! Really? It looks like only `runtime_` gets the prefix, so third-party libraries and code in go/src (e.g. `fmt`) would get mixed in here too, right?
- differentials 10y agoEverything get prefixed by the package namespace, so things pulled from github.com/group_name/package ends up looking like `github_com_group_name_package_class_funcname. This why why "rebuilding" the function names was a good way to quickly filter out the "known" code from the malicious functionality.
- ninov 10y agoIs this really how the names are represented internally? if so, how can it tell apart e.g. "github.com/group_name/package" and "github.com/group/name_package"?
- differentials 10y agoGood question, I assume there is some way the compiler/runtime would dedupe these for the coder at compile time. However I don't honestly know enough about the Go internals... Honestly, I wrote more Go code during this blog post than I ever had, even though I had been reversing it for a while...
- mappu 10y agoSo you can achieve smaller (/obfuscated) binaries by automatically renaming everything in $GOPATH to short unique strings? That would be a neat project.
- differentials 10y agoYes, you could in theory rename everything prior to compilation for obfuscation/space saving - similar to how (some) Java protections worked.
- cbdfghh 10y agoJust curious, is a Go string a C string inside (rune array + nil) or a proper class array? In other words, in a:="b"+"c" IOW, does it implement the Slemiel's painting algorithm or not?
- barsonme 10y agoI'm not sure I 100% understand your question, but in Go a string is a two-word struct. type string struct { data unsafe.Pointer len int } The C version would be typedef struct string { const *char data; int len; } string; Edit: oh, ok. I Googled the "painting algorithm" reference. I swear I had read that before :-)
- Someone 10y agoIf you consider googling it too: http://wiki.c2.com/?ShlemielThePainter http://wiki.c2.com/?ShlemielThePainter
- razakel 10y ago>Just curious, is a Go string a C string inside (rune array + nil) or a proper class array? I can't imagine how you would even implement a string as anything other than a rune array. Even a Pascal string is just the string length followed by characters.
- thwd 10y agoas C does: with a \00 end marker.
- javathrowaway 10y agoYeah, and how do you store NUL chars in those C strings then? The answer is you can't. Because prefix-length strings (Pascal) are far better than null-terminated (C) strings.
- chrisseaton 10y ago
- devoply 10y agoGlad to see the code still looks like crap, beautiful assembly, so using any of that is not going to make sense. Which is good news for distributing a Go binary.