Reversing Golang Binaries with Ghidra
summary
Ghidra scripts parse Go’s PCLNTAB to recover real function names from stripped binaries, rescuing main.main and turning 1.3 MB blobs with ~1,790 functions back into readable routines (contrast C’s ~16 KB / 19 functions). Scripts detect both PCLNTAB parsing and multiple string representations (static blobs and dynamic string structs) to define thousands of hidden strings, handle x86/ARM instruction patterns, and reconstruct composite types via r-type type extraction, producing usable function and field names for ransomware and csrv miner samples.
AI-written summary · about
chapters (19)
- 0:00Intro
- 2:46Research topic
- 5:30Malware families
- 7:04Static linking
- 7:35Hello World - Unstripped
- 7:51Hello World in Ghidra
- 8:14Stripped Binaries
- 8:38Hello World - Stripped
- 8:51Hello World Stripped in Ghidra
- 9:15Recover function names
- 14:38Hello World Strings in Ghidra
- 16:18String Representation
- 17:39Dynamically allocated string structure
- 21:02Statically allocated string structure
- 22:46String recovery challenges
- 23:40Type extraction
- 28:22Other researcher's work
- 28:58Files used during the presentation
- 29:18References, additional reading
related talks
27mA Deep Dive into Go Malware: Using Metadata to Empower the Analyst
47mReverse Engineering Go Malware: From Manual to AI-Powered Analysis
51mReverse Engineering Binaries
21mDemystify Today's Binary Disassembling and How Modern ABI Makes it Easier
23mAn In-Depth Analysis of Disassembly on Full-Scale x86/x64 Binaries
21mAutomatic Recovery of Fine-grained Compiler Artifacts at the Binary Level
14mNeural Reverse Engineering of Stripped Binaries using Augmented Control Flow Graphs
47mA Look at Jython-Enhanced Reverse Engineering with Ghidra