ghostrings

Ghostrings Scripts for recovering string definitions in Go binaries with P-Code analysis. Tested with x86, x86-64, ARM, and ARM64. Scripts Golang These can be found in the Golang category in the Script Manager. GoDynamicStrings.java Analyzes P-Code to find string structures created on the stack...

r2gopclntabParser

r2gopclntabParser Note: This feature has been implemented directly to radare2's core as gopc analysis plugin A radare2-based Go gopclntab parser for recovering function symbols from Go binaries, including fully stripped ones. Supports ELF, Mach-O, and PE binaries across Go versions 1.2, 1.16, 1.1...

TheCl0n3r

TheCl0n3r TheCl0n3r will allow you to download and manage your git repositories. Preface About 90% of the penetration testing tools used in my experience can be found primarily on github. The aim of this was to make it easier to download, update and delete these git repositories. If moving to a n...

AlphaGolang

AlphaGolang por Juan Andres Guerrero-Saade JAG-S @ SentinelLabs Descripción: AlphaGolang es una colección de scripts IDAPython para ayudar a los ingenieros inversos de malware a dominar los binarios de Go. La idea es dividir los scripts en pasos concretos, evitando así scripts monolíticos frágile...

gimphash

gimphash gimphash is a proposed method to calculate an imphash equivalent for Go binaries. It's name stands for G o-imp ort-hash. Golang binaries contain their dependencies as part of the executable. These dependencies include both standard library packages and third party dependencies and can be...

Malicious code in prisma-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1aab2820bfb9036995418ba2b36887f8970d7deaa69d8bc4aa24e36266bf18d1 [email protected] is a name-confusion package against the genuine prisma ORM. Its package.json declares "preinstall":...

Memory Forensics Techniques for Automated Detection and Analysis of Go Malware

The Go programming language has become increasingly popular among malware developers due to its ability to produce statically linked, cross-platform executables that challenge traditional analysis techniques. These binaries embed a substantial runtime and compiler-generated metadata and are...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-1381)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1381 advisory. net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processe...

SBOMVerifierGoPoC

🔍 SBOM Verifier for Go !Pythonhttps://img.shields.io/badg...

Fedora: Security Advisory for golang-github-markbates-pkger (FEDORA-2022-ea8f4e232d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: golang-github-markbates-pkger-0.17.1-6.fc36

Pkger is a tool for embedding static files into Go binaries. It will, hopeful ly, be a replacement for github.com/gobuffalo/packr/v2...

[SECURITY] Fedora 35 Update: golang-github-markbates-pkger-0.17.1-5.fc35

Pkger is a tool for embedding static files into Go binaries. It will, hopeful ly, be a replacement for github.com/gobuffalo/packr/v2...

[SECURITY] Fedora 36 Update: golang-github-markbates-pkger-0.17.1-5.fc36

Pkger is a tool for embedding static files into Go binaries. It will, hopeful ly, be a replacement for github.com/gobuffalo/packr/v2...

Extracting type information from Go binaries

During the 2021 edition of the SAS conference, I had the pleasure of delivering a workshop focused on reverse-engineering Go binaries. The goal of the workshop was to share basic knowledge that would allow analysts to immediately start looking into malware written in Go. A YouTube version of the...