angr with a golang target

Question

Here is a very basic golang program:

package main
import "fmt"

func main() {
    var s1 string
    fmt.Scanln(&s1)

    if s1=="goodpassword" {
        fmt.Println("Good")
    } else {
        fmt.Println("Wrong")
    }
}

I have compiled this program (elf64 linux binary).

I have diasssembled the binary and i have found the addresses of the 2 fmt.Println calls:

...
0x00490d4f     lea rax, obj.main.statictmp_1    ; wrong
...
0x00490d99     lea rax, obj.main.statictmp_0    ; good
...

Now, i have wrote this python program:

import angr
from angr.state_plugins import SimSystemPosix

p = angr.Project('./mybinary')

sm = p.factory.simulation_manager()
sm.explore(find= 0x00490d99, avoid= 0x00490d4f)

print(sm.found[0].posix.dumps(0))

I do not understand why angr does not return "goodpassword" string. I have something wrong but i do not understand what...

Thanks for your help

Answer 1

The Go run time is fairly complicated that symbolic solvers will not run out-of-the-box as-is. You are asking angr to figure out everything on it's own which may be feasible for simple and uncomplicated C programs but not for something like Go binaries.

For example, the fmt.Scanln function will call multiple Go functions before you reach libc.read. Angr has SimProcedures for read but not for fmt.Scanln. To figure out what fmt.Scanln does it has to symbolically execute after which only it may able to discover the dependency between stdin and the program output. Symbolically executing Scanln is by no way a simple task.

Instead, you should break down the problem in parts which you can ask angr to solve. Like if you have identified the buffer where the user input is stored you can mark that as symbolic and instruct angr to find the path to the "good password" branch.

Further resources on Go reversing:

• https://r3xnation.wordpress.com/2018/01/11/reversing-go-binaries-part-1/
• https://2016.zeronights.ru/wp-content/uploads/2016/12/GO_Zaytsev.pdf
• https://rednaga.io/2016/09/21/reversing_go_binaries_like_a_pro/