Re:Reversing Go Binaries Like a Pro
by differentials on Friday December 16, 2016 @12:33PM
(#13194996)
Everything get prefixed by the package namespace, so things pulled from github.com/group_name/package ends up looking like `github_com_group_name_package_class_funcname. This why why "rebuilding" the function names was a good way to quickly filter out the "known" code from the malicious functionality.
[ Parent
| on HN ]
Is this really how the names are represented internally? if so, how can it tell apart e.g. "github.com/group_name/package" and "github.com/group/name_package"?
Re:Reversing Go Binaries Like a Pro
by differentials on Friday December 16, 2016 @10:25PM
(#13199007)
Good question, I assume there is some way the compiler/runtime would dedupe these for the coder at compile time. However I don't honestly know enough about the Go internals... Honestly, I wrote more Go code during this blog post than I ever had, even though I had been reversing it for a while...
So you can achieve smaller (/obfuscated) binaries by automatically renaming everything in $GOPATH to short unique strings? That would be a neat project.
Re:Reversing Go Binaries Like a Pro
by differentials on Friday December 16, 2016 @10:23PM
(#13199004)
Yes, you could in theory rename everything prior to compilation for obfuscation/space saving - similar to how (some) Java protections worked.