Скачать или смотреть How to Reverse Engineer Go Binaries - GoLang Malware Analysis - Part 2

#golang #johnhammond #malwareanalysis

📜 Video Description:
Reverse Engineering Go Binaries: A Comprehensive Walkthrough
The process of reverse engineering Go (or GoLang) binaries can be a complex task due to their inherent properties. This guide will provide a comprehensive walkthrough on how to simplify this process, employing scripts for both Ida Pro and Ghidra to reverse engineer GoLang strings and symbols.

Introduction to GoLang Binaries
GoLang, a programming language designed by Google in 2007 and made public in 2012, is known for its simplicity and cross-compilation capabilities for Windows, Linux, and MacOS. Go binaries are statically linked by default, which means all necessary libraries are included within the binary itself, ensuring no dependency issues. However, this characteristic also leads to larger binary sizes, making reverse engineering or GoLang malware analysis more challenging.

Understanding Go Binary Size through Comparative Analysis
To highlight the challenge posed by the size of Go binaries, consider a simple "Hello, World!" program written in both C and GoLang. The C version results in a 16-kilobyte binary when compiled, while the GoLang version produces a hefty two-megabyte file. This significant size difference is due to Go binaries including all necessary libraries. This means to analyze a single function, you might have to parse through two megabytes of code. For example, a GoLang binary for a "Hello, World!" program can contain up to 1800 functions, as opposed to just 19 functions in the C equivalent.

Stripping GoLang Binaries
Stripping a Go binary can help mitigate its size by discarding debugging symbols, routine names, and variable names. This technique makes the binary harder to debug and reverse engineer. However, it is commonly used in GoLang malware files to make them smaller and harder to detect and analyze. A stripped Go binary reduces the "Hello, World!" binary size from two megabytes to 1.3 megabytes. While this approach results in a smaller binary, it also limits the information available for reverse engineering.

Identifying GoLang Binaries
GoLang binaries can be identified by inspecting their strings. These strings often contain functions and other elements indicative of GoLang. If these elements are present within a binary's strings, it's reasonable to suspect that the binary could be written in GoLang.

Recovering Information from Stripped Go Binaries
Despite the limitations of stripped binaries, it is possible to recover information through specific scripts, which can aid in the process of Go reverse engineering.

#cybersecurity #infosec