GoResolver: Using Control-flow Graph Similarity to Deobfuscate Golang Binaries, Automatically

KEY TAKEAWAYS Go language (Golang) is increasing in popularity with developers of both legitimate and malicious tooling. Volexity frequently encounters malware samples written in Golang that apply obfuscators to hinder analysis. Obfuscated Golang malware samples are significantly harder to statically analyze for reverse engineers. Volexity has developed an open-source tool, GoResolver, to retrieve obfuscated functions names. GoResolver’s control-flow graph similarity techniques offer a significant advantage in recovering symbol information. In the course of its investigations, Volexity frequently encounters malware samples written in Golang. Binaries written in Golang are often challenging to analyze because of the embedded libraries and the sheer size of the resulting binaries. This issue is amplified when samples are obfuscated using tools such as Garble, an open-source Golang obfuscation tool. The popularity of Golang amongst malware developers, and the use of obfuscators to make reverse-engineering harder, raised the need for better tooling to assist in reverse-engineering efforts. […] The post GoResolver: Using Control-flow Graph Similarity to Deobfuscate Golang Binaries, Automatically appeared first on Volexity.