Volexity Adds Go String and Runtime Type Analysis to Its Golang Tools
Summary
Volexity released GoStringExtractor for IDA Pro and Ghidra and added runtime type information parsing to GoResolver, helping analysts inspect Go binaries, including obfuscated malware samples.
Key points
- GoStringExtractor reports referenced strings and the functions that reference them, with options to define strings in IDA Pro or Ghidra.
- String reports can be filtered by package to help distinguish attacker code from library code.
- The tool cannot recover strings destroyed by obfuscation, such as through Garble's -literals flag.
- GoResolver's new -y option extracts runtime type information and adds type data to its JSON report.
- Updated IDA Pro and Ghidra plugins can import GoResolver's type information into analysis databases.
- Volexity says RTTI parsing supports all operating systems and both 32-bit and 64-bit samples.
Article Details
- Event Type
- Volexity released GoStringExtractor and added runtime type information parsing to GoResolver.
- Impact
- The tools help analysts inspect string data and recover runtime type information in Golang binaries, including obfuscated samples, supporting reverse engineering, binary analysis, and detection engineering.
Vendors
Products
GhidraVolexity’s GoStringExtractor is a plugin utility available for IDA Pro and Ghidra that helps search and analyze string data in a Go binary, provided they have not been destroyed by an obfuscation tool, such as Garble’sIDA ProVolexity’s GoStringExtractor is a plugin utility available for IDA Pro and Ghidra that helps search and analyze string data in a Go binary, provided they have not been destroyed by an obfuscation tool, such as Garble’s
Tools
GarbleFurthermore, a significant portion of samples encountered by Volexity have been obfuscated by Garble or other such tools.GoResolverVolexity’s GoResolver tool was released to help with analysis of these samples, reducing analyst load when working with obfuscated Golang binaries.GoStringExtractorTo ease these challenges Volexity has released a new utility, GoStringExtractor, and added functionality to the existing GoResolver tool.