Security researchers consistently encounter malicious binaries written in Golang that deliberately employ obfuscation tools like Garble to hinder analysis. The tool represents a significant advancement in the ongoing arms race between malware developers and security researchers, providing a powerful countermeasure against obfuscation techniques that have previously complicated analysis efforts. By generating clean template Golang samples and comparing them against obfuscated binaries, GoResolver can effectively match randomized symbols to their original form. As malware authors increasingly turn to Golang for its cross-platform capabilities and obfuscation-friendly features, tools like GoResolver become essential components in the security researcher’s arsenal. Developed by Volexity, this innovative solution employs control-flow graph similarity techniques to recover obfuscated function names, significantly enhancing reverse engineers’ ability to analyze increasingly common Golang-based malicious code. While previous solutions like Mandiant’s GoReSym extracted symbol information from Golang’s internal runtime structures, GoResolver takes recovery a step further by comparing the structural patterns of functions across binaries. “Binaries written in Golang are often challenging to analyze because of the embedded libraries and the sheer size of the resulting binaries”, notes Volexity in their official announcement. The tool first identified the malware’s Golang version by fingerprinting runtime characteristics, then computed binary similarities to resolve obfuscated symbols. These obfuscated samples present formidable obstacles for reverse engineers due to embedded libraries, large binary sizes, and stripped symbol information. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Even partially resolved symbols provided significant context about package names, helping analysts focus on core malware logic rather than runtime libraries. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 03 Apr 2025 09:40:18 +0000