Reversing Go Binaries Like a Pro

#1

Post by FiloSottile » Fri, Dec 16, 2016, 12:49 AM UTC

Reversing Go Binaries Like a Pro
rednaga.io

Re: Reversing Go Binaries Like a Pro

#2

Post by fbreduc » Fri, Dec 16, 2016, 1:25 AM UTC

if err != nil ?

Re: Reversing Go Binaries Like a Pro

#3

Post by kevinburke » Fri, Dec 16, 2016, 1:28 AM UTC

I'm getting a Chromium security error because this website is presenting a certificate from *.github.com.

Re: Reversing Go Binaries Like a Pro

#4

Post by cconover » Fri, Dec 16, 2016, 1:29 AM UTC

kevinburke wrote: post #3

I'm getting a Chromium security error because this website is presenting a certificate from *.github.com.

Me too.

Re: Reversing Go Binaries Like a Pro

#5

Post by FiloSottile » Fri, Dec 16, 2016, 1:35 AM UTC

kevinburke wrote: post #3

I'm getting a Chromium security error because this website is presenting a certificate from *.github.com.

It's my fault. I use HTTPS Everywhere in full HTTP blocking mode, so when a link isn't HTTPS I just try manually, and accept the error for common Akamai and Github Pages certs, which is still much better than HTTP (for random sites).

But then I ended up submitting that broken link. The interesting thing is that it reached the top (#4 right now) of HN anyway.

Re: Reversing Go Binaries Like a Pro

#6

Post by differentials » Fri, Dec 16, 2016, 1:35 AM UTC

cconover wrote: post #4

kevinburke wrote: post #3

I'm getting a Chromium security error because this website is presenting a certificate from *.github.com.

Me too.

Author here... Link was submitted using https which I had not set up yet. Just switched over to a CF nameserver so it should be working shortly...

Re: Reversing Go Binaries Like a Pro

#7

Post by tedunangst » Fri, Dec 16, 2016, 1:57 AM UTC

FiloSottile wrote: post #5

kevinburke wrote: post #3

I'm getting a Chromium security error because this website is presenting a certificate from *.github.com.

It's my fault. I use HTTPS Everywhere in full HTTP blocking mode, so when a link isn't HTTPS I just try manually, and accept the error for common Akamai and Github Pages certs, which is still much better than HTTP (for random sites). But then I ended up submitting that broken link. The interesting thing is that it reached the top (#4 right now) of HN anyway.

Go? Reversing? Say no more, have an upvote!

Re: Reversing Go Binaries Like a Pro

#8

Post by nadermx » Fri, Dec 16, 2016, 2:10 AM UTC

working link

http://rednaga.io/2016/09/21/reversing_go_binaries_like_a_pr...

Re: Reversing Go Binaries Like a Pro

#9

Post by differentials » Fri, Dec 16, 2016, 3:33 AM UTC

nadermx wrote: post #8

working link http://rednaga.io/2016/09/21/reversing_go_binaries_like_a_pr...

The https link should be working now, switched over to cloudflare. Thanks for the link though!

Re: Reversing Go Binaries Like a Pro

#10

Post by mappu » Fri, Dec 16, 2016, 3:39 AM UTC

> You can quiet easily differentiate between custom code written for the binary, for example in the Linux malware “Rex” everything because with that name space!

Really? It looks like only `runtime_` gets the prefix, so third-party libraries and code in go/src (e.g. `fmt`) would get mixed in here too, right?