avast / avast/retdec

Add extraction of information about Go binaries

Open
#689 0 comments 2 reactions 0 assignees View on GitHub
C-cpdetect C-fileformat new-feature
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

Same as we do with .NET and VB, we should also extract information about Go binaries because they seem to contain some useful information.

The very first thing we should try to obtain is `Go build ID` located at the start of code section (at least in PE). Some other information might be available too (https://rednaga.io/2016/09/21/reversing_go_binaries_like_a_pro/). This is more of a research ticket.

Structure of Go binaries might differ when built as PE, ELF or Mach-O so part of this ticket is also doing it for all common native file formats.

Contributor guide

No contributing guide indexed for this repository

Research direction

Begin by researching how Go build IDs are stored at the start of the code section in PE binaries, using the linked reversing article as background. Compare the relevant structures across PE, ELF, and Mach-O formats, then determine what information can be extracted and how completion will be verified for each format.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
reverse-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.