39 lines
1.3 KiB
Markdown
39 lines
1.3 KiB
Markdown
# API Reference: Analyzing Golang Malware Internals
|
|
|
|
## Overview
|
|
|
|
`scripts/analyst.py` confirms a Go build (build ID / `go1.x` / `runtime.main`), detects pclntab
|
|
magic markers, and recovers Go function names and package import paths from printable strings,
|
|
mapping notable packages to capabilities. It reads bytes statically and executes nothing. This is
|
|
a heuristic scan, not a full pclntab structure parser.
|
|
|
|
## Dependencies
|
|
|
|
| Package | Version | Purpose |
|
|
|---------|---------|---------|
|
|
| (stdlib) | — | regex, JSON, file IO |
|
|
|
|
## Core functions
|
|
|
|
### `info(path)`
|
|
Returns Go detection, versions, pclntab magics present, recovered functions, package paths, and
|
|
capabilities.
|
|
|
|
## Heuristics
|
|
|
|
- Go detection: `Go build ID`, `go1.x`, `runtime.main`.
|
|
- pclntab magics: `\xfb\xff\xff\xff`, `\xfa…`, `\xf0…`, `\xf1…` (across Go versions).
|
|
- Functions: `main.*`, `runtime.*`, `net.*`, `crypto.*`, `os/exec.*`, `syscall.*`.
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
python scripts/analyst.py info sample.bin
|
|
```
|
|
|
|
## Sources
|
|
|
|
- Go runtime pclntab format (runtime/symtab.go) — https://go.dev/src/runtime/symtab.go
|
|
- Go build info (debug/buildinfo) — https://pkg.go.dev/debug/buildinfo
|
|
- Go RE techniques (pclntab name recovery, garble obfuscation) from public Go-malware research
|