GoReSym

GoReSym

GoReSym is a Go symbol parser that extracts program metadata (such as CPU architecture, OS, endianness, compiler version, etc), function metadata (start & end addresses, names, sources), filename and line number metadata, and embedded structures and types. This cross platform program is based directly on the open source Go compiler and runtime code.

The upstream Go runtime code is extended to handle:

• stripped binaries
• malformed unpacked binaries, such as from UPX
• binaries that split single data ranges across multiple sections
• the location of the moduledata structure

Usage

Refer to https://www.mandiant.com/resources/blog/golang-internals-symbol-recovery for reverse engineering details and example usage.

You can download pre-built linux, macos, and windows GoReSym binaries from the Releases tab.

To build from source with a recent Go compiler, invoke the Go compiler:

go build

Once built invoke GoReSym like this:

GoReSym.exe -t -d -p /path/to/input.exe

In this example, we ask GoReSym to recover type names (-t), user package names, standard Go package names (-d), and input file paths (-p) embedded within the file /path/to/input.exe. The output looks like this:

…

Here are all the available flags:

• -d ("default", optional) flag will print standard Go packages in addition to user packages.
• -p ("paths", optional) flag will print any file paths embedded in the pclntab.
• -t ("types", optional) flag will print Go type names.
• -strings (optional) flag will extract embedded Go strings from the binary by analyzing the string internment table.
• -m ("manual", optional) flag will dump the RTYPE structure recursively at the given virtual address
• -v ("version", optional) flag will override automated version detection and use the provided version. This is needed for some stripped binaries. Type parsing will fail if the version is not accurate.
• -human (optional) flag will print a flat text listing instead of JSON. Especially useful when printing structure and interface types.
• -about (optional) flag with print out license information

To import this information into IDA Pro you can run the script found in https://github.com/mandiant/GoReSym/blob/master/IDAPython/goresym_rename.py. It will read a json file produced by GoReSym and set symbols/labels in IDA.

Version Support

As the Go compiler and runtime have changed, so have the embedded metadata structures. GoReSym supports the following combinations of Go releases & metadata:

• all combinations of ARM64 Intel x86/x64 MACH-O/ELF/PE big/little endian
• pclntab parsing: >= Go 1.2
• moduledata location: >= Go 1.2
• moduledata type parsing: >= Go 1.5

The moduledata table used to extract types doesn't exist prior to Go 1.5, so this library will never support extracting types from very old Go versions.

This library current handles the pclntab layouts pre 1.2, 1.2, 1.16, 1.18, and 1.20. Note that the pclntab version is always to support byte scanning thepclntab` magic

• Added routines such as DataAfterSection to support signature scan in file format parsers in /debug/
• Added check to debug/gosym/symtab.go's walksymtab to bail early when the optional symtab section is empty
• Exported many members and internal structs (changes are too many to enumerate)
• Removed goobj liner support in objfile/objfile.go's PCLineTable()
• Added extra sanity checks around loadPeTable (and other format variants) to avoid panic when symbols are present but maliciously modified to be invalid (ref: golang/go#47981)
• Modified the signatures of some internal functions to provide lower level access to information such as section addresses and offsets
• Implemented read_memory routines for supported file formats to read file data by virtual address
• Introduced moduledata scan routines to help locate moduledata in support of scanning for types and interfaces (via typelinks)
• Added size guards to readStringTable for invalid symbol tables. Parsing failures are ignored as well.

License

MIT