3 ms·
> You can quiet easily differentiate between custom code written for the binary, for example in the Linux malware “Rex” everything because with that name space!
by mappu 10y ago
> You can quiet easily differentiate between custom code written for the binary, for example in the Linux malware “Rex” everything because with that name space!
Really? It looks like only `runtime_` gets the prefix, so third-party libraries and code in go/src (e.g. `fmt`) would get mixed in here too, right?
- differentials 10y agoEverything get prefixed by the package namespace, so things pulled from github.com/group_name/package ends up looking like `github_com_group_name_package_class_funcname. This why why "rebuilding" the function names was a good way to quickly filter out the "known" code from the malicious functionality.
- ninov 10y agoIs this really how the names are represented internally? if so, how can it tell apart e.g. "github.com/group_name/package" and "github.com/group/name_package"?
- differentials 10y agoGood question, I assume there is some way the compiler/runtime would dedupe these for the coder at compile time. However I don't honestly know enough about the Go internals... Honestly, I wrote more Go code during this blog post than I ever had, even though I had been reversing it for a while...
- mappu 10y agoSo you can achieve smaller (/obfuscated) binaries by automatically renaming everything in $GOPATH to short unique strings? That would be a neat project.
- differentials 10y agoYes, you could in theory rename everything prior to compilation for obfuscation/space saving - similar to how (some) Java protections worked.