Neurosurgery Blog

Golang binaries are a bit hard to analyze but there are some tricks to locate the things and view what is doing the code.

Is possible to list all the go files compiled in the binary even in an striped binaries, in this case we have only one file gohello.go this is a good clue to guess what is doing the program.

On stripped binaries the runtime functions are not resolved so is more difficult to locate the user algorithms:

If we start from the entry point, we will found this mess:

The golang string initialization are encoded and is not displayed on the strings window.

How to locate main? if its not stripped just bp on [package name].main for example bp main.main, (you can locate the package-name searching strings with ".main")

And here is our main.main:

The code is:

So in a stripped binary we cant find the string "hello world" neither the initialization 0x1337 nor the comparator 0x1337, all this is obfuscated.

The initialization sequence is:

The procedure for locating main.main in stripped binaries is:

1. Click on the entry point and locate the runtime.mainPC pointer:

2. click on runtime.main function (LAB_0042B030):

3. locate the main.main call after the zero ifs:

4. click on it and here is the main:

The runtime is not obvious for example the fmt.Scanf() call perform several internal calls until reach the syscall, and in a stripped binary there are no function names.

In order to identify the functions one option is compile another binary with symbols and make function fingerprinting.

In Ghidra we have the script golang_renamer.py which is very useful:

After applying this plugin the main looks like more clear:

This script is an example of function fingerprinting, in this case all the opcodes are included on the crc hashing:

# This script fingerprints the functions
#@author: sha0coder
#@category fingerprinting

print "Fingerprinting..."

import zlib


# loop through program functions
function = getFirstFunction()
while function is not None:
    name = str(function.getName())
    entry = function.getEntryPoint()
    body = function.getBody()
    addresses = body.getAddresses(True)

    if not addresses.hasNext():
        # empty function
        continue 

    ins = getInstructionAt(body.getMinAddress())
    opcodes = ''
    while ins and ins.getMinAddress() <= body.getMaxAddress():
        for b in ins.bytes:
            opcodes += chr(b & 0xff)
        ins = getInstructionAfter(ins)
    
    
    crchash = zlib.crc32(opcodes) & 0xffffffff

    print name, hex(crchash)


    function = getFunctionAfter(function)

More information

Do you like to buy stuff? Do you enjoy shopping? Do you like to find shiny things that delight you and your friends? Are you sad because you have a limited budget and would like to buy thousands of dollars of things? How about millions of dollars? Would you like to surround yourself with a wonder emporium of your own making? Would you like to aspire to making $50,000 a year, while juggling a million dollars of revenue while chasing the Next Big Thing? Boy do I have a job for you!

It seems lost on a lot of people in the hobby game trade that the primary job of a store owner is buying. Sure, they understand we buy, but they have a vague idea of how much we buy, the immense scale. Even the smallest store owner is responsible for a six figure purchasing budget in a year. Larger stores? Seven. That's right, store owners are walking around, spending hundreds of thousands of dollars a year, ten, twenty, a hundred thousand dollars a month, on cardboard and plastic. Even small store owners are likely hitting six figures in a year.

Our buying jobs are ridiculous. Sometimes we buy on sliding discount sales, moving targets. We are expected to place pre orders and back orders using obtuse tools, like static spreadsheets. A million dollars of sales a year in games, with orders tracked on a spreadsheet. We use them, distributors use them, publishers use them. Every week my primary distributor sends me a 900 line spreadsheet of what I have on order, sorted by the order the sales rep put it on the spreadsheet. Astonishing.

How may of the seven Pokemon releases arriving two months from now would you like to pre order? I shall take 5X. Well, I can get you 2X of SKU 1, 4X of SKU2, 1X of SKU3, etc., etc. And we chase this product across the multiverse through a handful of distributors, with a margin of error for the distributor that always ships late, and the distributor who sometimes loses the order (doesn't happen to me, but happens often enough to others).

We shall get some safety stock from the poor margin, but reliable distributor. We will pay several different prices that will hopefully cost average to success. We chase product through distributors, direct with publishers, and somewhat indirectly and ridiculously inefficiently on Kickstarter. This IS the job of owning a store. Everything else is details.

A lot of small stores have one distributor and take whatever X is. They often have no product, while I'm trying to manage crazy overstock. We are often, like in the case of Wizards of the Coast, forbidden from selling to these stores. They could fill out a form and order from another distributor, but they don't for some reason. Maybe it's scary. Maybe they don't have the budget, so what's the point?

Buying is the most important thing in retail. You could be an entirely incompetent sales person. You could have the personality of a brick. You could shove your product into vending machines and watch behind one way glass. You could have (gasp) no game space, no marketing of any sorts. If you were an expert buyer you would clean up.

Buying isn't just ordering, it's a dance of research, finance, purchasing, selling, inventory management, and liquidation. The experts, those really good at this, are expert buyers AND expert sellers. As sellers they know their customers, research product, attend trade shows, and demo the heck out of what works. They manage money like a boss. But if you had to choose buying or selling? They would tell you it's mostly in the buying.

Once the balls are in the air, the inventory bought, todays sales pay for last months invoices, in a Rube Goldberg, perpetual motion machine. Stores without terms, most new ones nowadays, skimp on small releases to save up for the big release. They have been taught leverage is dangerous and to avoid it, rather than credit being a great opportunity.

An expert buyer would be flush with cash, have no excess inventory and no liquidation needs. An expert buyer wouldn't be able to spend the money fast enough. An expert buyer is like Gandalf the wizard: Inventory is never late, nor is it early (Bilbo Baggins). Inventory arrives precisely when you mean it to.

The better Gandalf you are, the more efficient your store, the more money you'll make. It's a painfully tedious job. It's a job that has barely changed in the 18 years I've done it, other than massively growing ten fold. It's a job that could be automated significantly better with technology. It's a job that would have been impossible at my current scale, 18 years ago, without the minuscule technological advances. I love the job. You can't have it. If you were a purchasing Gandalf, I could never afford you.

Neurosurgery Blog

Thursday, May 25, 2023

4940 hash passwords

Introduction To Reversing Golang Binaries

More information

Purchasing Wizard Wanted