Greetings from Scandinasia!

Catherine

Golang binaries are a bit hard to analyze but there are some tricks to locate the things and view what is doing the code.

Is possible to list all the go files compiled in the binary even in an striped binaries, in this case we have only one file gohello.go this is a good clue to guess what is doing the program.

On stripped binaries the runtime functions are not resolved so is more difficult to locate the user algorithms:

If we start from the entry point, we will found this mess:

The golang string initialization are encoded and is not displayed on the strings window.

How to locate main? if its not stripped just bp on [package name].main for example bp main.main, (you can locate the package-name searching strings with ".main")

And here is our main.main:

The code is:

So in a stripped binary we cant find the string "hello world" neither the initialization 0x1337 nor the comparator 0x1337, all this is obfuscated.

The initialization sequence is:

The procedure for locating main.main in stripped binaries is:

1. Click on the entry point and locate the runtime.mainPC pointer:

2. click on runtime.main function (LAB_0042B030):

3. locate the main.main call after the zero ifs:

4. click on it and here is the main:

The runtime is not obvious for example the fmt.Scanf() call perform several internal calls until reach the syscall, and in a stripped binary there are no function names.

In order to identify the functions one option is compile another binary with symbols and make function fingerprinting.

In Ghidra we have the script golang_renamer.py which is very useful:

After applying this plugin the main looks like more clear:

This script is an example of function fingerprinting, in this case all the opcodes are included on the crc hashing:

# This script fingerprints the functions
#@author: sha0coder
#@category fingerprinting

print "Fingerprinting..."

import zlib


# loop through program functions
function = getFirstFunction()
while function is not None:
    name = str(function.getName())
    entry = function.getEntryPoint()
    body = function.getBody()
    addresses = body.getAddresses(True)

    if not addresses.hasNext():
        # empty function
        continue 

    ins = getInstructionAt(body.getMinAddress())
    opcodes = ''
    while ins and ins.getMinAddress() <= body.getMaxAddress():
        for b in ins.bytes:
            opcodes += chr(b & 0xff)
        ins = getInstructionAfter(ins)
    
    
    crchash = zlib.crc32(opcodes) & 0xffffffff

    print name, hex(crchash)


    function = getFunctionAfter(function)

More info

Catherine

Hello Everyone, Today I am Going To Write a very interesting post for You ..hope you all find this valuable.. :
What is The cost to hire a spy who can able to spy your girlfriend 24X7 days..???? it's around hundreds of dollars Or Sometimes Even Thousands of dollars

But you are on Hacking-News & Tutorials so everything mentioned here is absolutely free.
would you be happy if I will show you a Secret Mobile Phone trick by which you can Spy and trace your girlfriend, spouse or anyone's mobile phone 24 X 7 which is absolutely free?The only thing you have to do is send an SMS like SENDCALLLOG To get the call history of your girlfriend's phone.isn't it Sounds Cool...

Read also;- Top 5 best TV Series Based On Hacking and Technology 2018

Without Taking Much Of Your Time…
let's Start The trick…

STEP 1: First of all go to android market from your Girlfriend, spouse, friends or anyone's phone which you want to spy or download the app mentioned below.

STEP 2: Search for an android application named "Touch My life "

STEP 3: download and install that application on that phone.

STEP 4: Trick is Over

Now you can able to spy that phone anytime by just sending SMS to that phone.

Now give back that phone to your girlfriend.
and whenever you want to spy your girlfriend just send SMS from your phone to your Girlfriend phone Which are mentioned in Touch My Life manage to book.

Read also;- How To Make a Simple and powerful keylogger using python

I am mentioning some handy rules below…

1) Write "CALL ME BACK" without Quotes and Send it to your girlfriend's mobile number for an Automatic call back from your girlfriend's phone to your phone.

2)Write "VIBRATENSEC 30" without Quotes and send it to your girlfriend's mobile number to Vibrate your Girlfriend's Phone for 30 seconds.You can also change Values from 30 to anything for the desired Vibrate time.

3)Write "DEFRINGTONE" without Quotes and Send it to your girlfriend's mobile number..this will play the default ringtone on your girlfriend's phone.

4)Write "SEND PHOTO youremail@gmail.com" without Quotes and Send it to your girlfriend's mobile number.it will take the photo of the current location of your girlfriend and send it to the email address specified in the SMS as an attachment.it will also send a confirmation message to your number.

5)Write "SENDCALLLOG youremail@gmail.com" without Quotes and Send it to your girlfriend's mobile number ..it will send all the call details like incoming calls, outgoing calls, missed calls to the email address specified in the SMS.

6)Write "SENDCONTACTLIST youremail@gmail.com" without Quotes and Send it to your girlfriend's mobile number ..it will send all the Contact list to the email address specified in the SMS.

So Guys Above all are only some Handy features of touch my life…You can also view more by going to touch my life application and then its manage rules...

Enjoy..:)
Stay tuned with IemHacker …

Related word

Catherine

"Nemesis is a command-line network packet injection utility for UNIX-like and Windows systems. You might think of it as an EZ-bake packet oven or a manually controlled IP stack. With Nemesis, it is possible to generate and transmit packets from the command line or from within a shell script. Nemesis attacks directed through fragrouter could be a most powerful combination for the system auditor to find security problems that could then be reported to the vendor(s)." read more...

Website: http://www.packetfactory.net/projects/nemesis

Greetings from Scandinasia!

Pages

Tuesday, May 30, 2023

Malware Arsenal Used By Ember Bear (Aka UAC-0056,Saint Bear, UNC2589, Lorec53, TA471, Nodaria, Nascent Ursa, LorecBear, Bleeding Bear, And DEV-0586) In Attacks Targeting Ukraine (Samples)

Monday, May 29, 2023

Introduction To Reversing Golang Binaries

How To Hack And Trace Any Mobile Phone With A Free Software Remotly

Related word

Nemesis: A Packet Injection Utility

More info

Blog Archive

Just Google Me

Where should I travel next?

Travel Dates

About Me

Copenkong Blog from 2009

Followers

Some Tunes