As cited
Copy frozen at (site build).
research
GoResolver: Using Control-flow Graph Similarity to Deobfuscate Golang Binaries, Automatically
Volexity released GoResolver, an open-source tool that automatically recovers obfuscated function names in Golang binaries by analyzing control-flow graph similarities. The tool addresses the challenge of analyzing Golang malware that has been obfuscated with tools like Garble, which randomizes function and package names to hinder reverse engineering. GoResolver works by comparing control-flow graphs from obfuscated samples against clean template binaries to identify the original function and package names.
Why it matters: Threat analysts and incident responders investigating Golang-based malware will benefit from faster deobfuscation and symbol recovery, reducing time spent on manual reverse engineering and enabling quicker malware identification and attribution.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
research
GoResolver: Using Control-flow Graph Similarity to Deobfuscate Golang Binaries, Automatically
Volexity released GoResolver, an open-source tool that automatically recovers obfuscated function names in Golang binaries by analyzing control-flow graph similarities. The tool addresses the challenge of analyzing Golang malware that has been obfuscated with tools like Garble, which randomizes function and package names to hinder reverse engineering. GoResolver works by comparing control-flow graphs from obfuscated samples against clean template binaries to identify the original function and package names.
Why it matters: Threat analysts and incident responders investigating Golang-based malware will benefit from faster deobfuscation and symbol recovery, reducing time spent on manual reverse engineering and enabling quicker malware identification and attribution.
- Source published
- First seen by Cybersecurity Tracker