Go_Parser : Yet Another Golang Binary Parser For IDAPro

This master branch is written in Python2 for IDAPython, and tested only on IDA7.2/IDA7.0. If you use IDAPython with Python3 and higher version of IDAPro, please use Python3 Branch for Go_Parser.

Inspired by golang_loader_assist and jeb-golang-analyzer, I wrote a more complete Go binaries parsing tool for IDAPro.

Main Features

  • Locate and parse firstmoduledata structure in Go binary file, and make comment for each field;
  • Locate pclntab(PC Line Table) according to the firstmoduledata and parse it. Then find and parse and recover function names and source file paths in the pclntab. Source file paths will be printed in the output window of IDAPro;
  • Parse strings and string pointers, make comment for each string, and make dref for each string pointer;
  • According to firstmoduledata, find each type and parse it, meke comment for each attribute of type, which will be very convenient for malware researcher to analyze a complex type or data structure definition;
  • Parse itab(Interface Table).

Helpful information to RE work for Go binaries:

And there are two useful feature in go_parser:

  • It also work fine for binaries with malformed File Header information, especially malformed Section Headers information;
  • All those features above are valid for binaries built with buildmode=pie.

A config data structure in DDGMiner v5029 (MD5: 95199e8f1ab987cd8179a60834644663) parsing result as below:

And the user-defined source file paths list:

Project Files

  • go_parser.py :Entry file, press [Alt+F7] , select and execute this file;
  • common.py: Common variables and functions definition;
  • pclntbl.py: Parse pclntab(PC Line Table);
  • strings.py: Parse strings 和 string pointers;
  • moduldata.py: Parse firstmoduledata
  • types_builder.py: Parse types
  • itab.py: Parse itab(Interface Table).

Additionally, the str_ptr.py will parse string pointers by specify the start address and end address of string pointers manually.

Note

  1. This branch is written in Python2 for IDAPython, and tested only on IDA7.2/IDA7.0;
  2. The strings parsing module was migrated from golang_loader_assist, and I added the feature of string pointers parsing. It only supports x86(32bit & 64bit) architecture for now.
R K

Recent Posts

Understanding the Model Context Protocol (MCP) and How It Works

Introduction to the Model Context Protocol (MCP) The Model Context Protocol (MCP) is an open…

4 days ago

The file Command – Quickly Identify File Contents in Linux

While file extensions in Linux are optional and often misleading, the file command helps decode what a…

4 days ago

How to Use the touch Command in Linux

The touch command is one of the quickest ways to create new empty files or update timestamps…

4 days ago

How to Search Files and Folders in Linux Using the find Command

Handling large numbers of files is routine for Linux users, and that’s where the find command shines.…

4 days ago

How to Move and Rename Files in Linux with the mv Command

Managing files and directories is foundational for Linux workflows, and the mv (“move”) command makes it easy…

4 days ago

How to Create Directories in Linux with the mkdir Command

Creating directories is one of the earliest skills you'll use on a Linux system. The mkdir (make…

4 days ago