Direct quote from Golang's website: "GDB does not understand Go programs well. The stack management, threading, and runtime contain aspects that differ enough from the execution model GDB expects that they can confuse the debugger and cause incorrect results even when the program is compiled with gccgo. As a consequence, although GDB can be useful in some situations (e.g., debugging Cgo code, or debugging the runtime itself), it is not a reliable debugger for Go programs, particularly heavily concurrent ones. Moreover, it is not a priority for the Go project to address these issues, which are difficult."

I'm also aware of projects such as IDAGolangHelper or other scripts to aid already established reverse engineering tools such as Ghidra in interpreting Golang binaries. Nevertheless, I would like to know assuming one prefers a self-containing debugging tool that is already successful in understanding the eccentric Go runtime, what will your choice(s) be? Also, I would appreciate any comments on Radare2's ability in handling Go binaries.

EDIT 1 (Clarification of Question): Assuming working on a x86_64 host it seems to me that QEMU's system mode is an essential part of the environment considering the fact that ptrace is not implemented in the QEMU's user mode. The other factor is obviously the libc implementation. For a dynamically-linked binary with the ld-musl-aarch64.so.1 interpreter this adds a Linux distribution with musl as the native libc implementation unless one wishes to build musl on a distribution already having glibc installed. So I guess my question would be what other functionalities (or tools) will you add to QEMU and Alpine?

  • Intriguing question. I'm wondering if gVisor could be of help, because when dealing with a statically linked binary you end up talking to the kernel via the syscall interface. But potentially you end up in a catch 22 due to gVisor being written in Go itself. – 0xC0000022L Dec 7 '20 at 19:05
  • @0xC0000022L I just added some clarification – Newbie Dec 7 '20 at 19:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.