Hacker News Reader

Comment by mappu | Hacker News Reader

> You can quiet easily differentiate between custom code written for the binary, for example in the Linux malware “Rex” everything because with that name space!

Really? It looks like only `runtime_` gets the prefix, so third-party libraries and code in go/src (e.g. `fmt`) would get mixed in here too, right?

View on HN

Everything get prefixed by the package namespace, so things pulled from github.com/group_name/package ends up looking like `github_com_group_name_package_class_funcname. This why why "rebuilding" the function names was a good way to quickly filter out the "known" code from the malicious functionality.

Is this really how the names are represented internally? if so, how can it tell apart e.g. "github.com/group_name/package" and "github.com/group/name_package"?

Good question, I assume there is some way the compiler/runtime would dedupe these for the coder at compile time. However I don't honestly know enough about the Go internals... Honestly, I wrote more Go code during this blog post than I ever had, even though I had been reversing it for a while...

So you can achieve smaller (/obfuscated) binaries by automatically renaming everything in $GOPATH to short unique strings? That would be a neat project.

Yes, you could in theory rename everything prior to compilation for obfuscation/space saving - similar to how (some) Java protections worked.

Reply on news.ycombinator.com