I’m trying to reverse engineer an aarch64 Golang binary which happens to call a symbol, i.e., function named guess_me which is an import. To stop the binary from throwing errors, I write a Hello World! guess_me function, compile it as a shared library, and pass it to LD_PRELOAD to make the binary use the guess_me function in the .so library file that I provide. My question is how can I use the calling convention of aarch64 to interpret the values of the stack and registers to guess the actual guess_me function inputs. In particular, what do you think about setting a breakpoint right before the function call to inspect the stack and registers? I’m using Delve on Alpine Linux as the binaries interpreter is musl.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.