1

I'm trying to understand how to reverse golang programs with radare2. In order to practice, i create a minimal program in Go:

package main
import "fmt"
func main() {
    fmt.Println("Hello World!")
}

In the resulting assembly code below, i found the main function (main.main) but i can't figure how to display the string passed in argument to Println.

;-- sym.go.main.main:
mov rcx, qword fs:[0xfffffffffffffff8]
cmp rsp, qword [rcx + 0x10]
jbe 0x485097
sub rsp, 0x48
mov qword [var_40h], rbp
lea rbp, [var_40h]
xorps xmm0, xmm0
movups xmmword [var_30h], xmm0
lea rax, [0x004958e0]
mov qword [var_30h], rax
lea rax, obj.main.statictmp_0 ; 0x4c8490
mov qword [var_38h], rax
lea rax, [var_30h]
mov qword [rsp], rax
mov qword [var_8h], 1
mov qword [var_10h], 1
call sym.fmt.Println
mov rbp, qword [var_40h]
add rsp, 0x48
ret
call sym.runtime.morestack_noctxt
jmp sym.main.main

Any tips ? Im new in reverse.

2

For future people: Now days IDA has native support for golang, and free for x64 versions, check out the freeware version.(here) (15/06/2021)

Here is the set of tools that I use in my GO analysis and reverse engineering, I'm sure it will be very useful for you to use it until it is simplified, but you still need a knowledge of IA-32/64, GO-RE KIT, another tip I have to give you is "Keep an eye on the debbug sections", GO developers often forget the debbug section and this can make your life easier when analyzing, here is a list of useful materials cured by me that will help you:

  1. Reversing Linux Malware GO
  2. Reversing GO binaries like a pro
  3. Defcon - Reversing golang
  4. GoUtils
3
  • Thanks for the resources ! But why do i need to use specialized tools ? Is this impossible with just radare2 ?
    – Theecee1
    Feb 25 at 14:55
  • It is not impossible, on the contrary it is excellent to use tools like radare2, we will take into account the difference between languages for example when we compile in C we have some more code represented by the functions in which we already know, for example a printf, already in GO for being a new language some tools do not have this support or if it is still very initial and for beginners using a specific tool will help to better understand the source decompiled, and consequently understand faster and analyze in different and simplified ways.
    – 0x0A
    Feb 25 at 16:46
  • After some time doing the reverse engineering for specific tools as mentioned by me you will have a new vision and consequently you will be able to better differentiate the machine code in tools like radare2 or other excellent tools that help our life.
    – 0x0A
    Feb 25 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.