Go Lang Reverse Engineering Resources/Links

GORE.md

• Dissecting Go Binaries
• Go: Overview of the Compiler
• Go compiler internals: adding a new statement to Go - Part 1
• Go compiler internals: adding a new statement to Go - Part 2
• Reversing GO binaries like a pro
• How a Go Program Compiles down to Machine Code
• Analyzing Golang Executables
• Go Reverse Engineering Tool Kit
• go-internals book
• Reconstructing Program Semantics from Go Binaries
• The Go low-level calling convention on x86-64
• Golang Internals (1 of 6)
• Go Series by Joakim Kennedy

I add some of my resources:

1. https://pkg.go.dev/ -> goroutine functions refer here
2. https://www.sentinelone.com/labs/alphagolang-a-step-by-step-go-malware-reversing-methodology-for-ida-pro/
3. https://cujo.com/reverse-engineering-go-binaries-with-ghidra/
4. https://www.youtube.com/watch?v=wWNbnEp_4ZE - Anatomy of a Gopher: Binary Analysis of Go Binaries w/ Alex Useche - SANS HackFest Summit 2020
5. https://www.youtube.com/watch?v=J2svN8h21oo - Reversing GO Binaries With Ghidra - Albert Zsigovits and Dorka Palotay
6. https://www.youtube.com/watch?v=_cL-OwU9pFQ - Reversing in action: Golang malware used in the SolarWinds attack. Part 1
7. https://medium.com/@nishanmaharjan17/reversing-golang-binaries-part-1-c273b2ca5333
8. https://medium.com/@nishanmaharjan17/reversing-golang-binaries-part-2-26f522264d01
9. https://medium.com/@nishanmaharjan17/reversing-golang-binaries-part-3-how-to-run-a-golang-ransomware-613f5369cbaa
10. https://blog.osiris.cyber.nyu.edu/2019/12/19/go-deepdive/

Just linking to my own gist here in case it's of use to anyone (originally bootstrapped from links here, then expanded on and grown out from there):

• Reverse Engineering Golang (0xdevalias' gist)
  • Some notes, tools, and techniques for reverse engineering Golang binaries.

Gopherjs is a compiler from go to javascript, I have made a little bit of research, maybe is useful for somebody: https://vik0t0r.github.io/posts/Gopherjs-reverse-engineering/

I have made a little bit of research, maybe is useful for somebody: vik0t0r.github.io/posts/Gopherjs-reverse-engineering

@vik0t0r Thanks for sharing the research :) I opened up issues for this in 2 of the (in my opinion) leading modern JavaScript decompiler/unminimiser projects. If you were wanting to explore the AST parsing aspect of this deeper as you noted in your 'Some ideas for the future' section; adding support to one or both of those might be a cool idea:

• pionxzh/wakaru#92

  • support GopherJS bundles

• j4k0xb/webcrack#39

  • support GopherJS bundles

Also added your blog to my gist:

• https://gist.github.com/0xdevalias/4e430914124c3fd2c51cb7ac2801acba/revisions#diff-49564943565c916ec0d9fd7f31f4093860aadbc32dad2eccf9665fd945098c6d