update identify.py #908
update identify.py #908
Conversation
identify Go samples with stomped PCNLTAB magic bytes
floss/language/identify.py
Outdated
| b"runtime.newproc", | ||
| b"runtime.gcWriteBarrier", | ||
| b"runtime.Gosched", | ||
| ] | ||
| # look for the .rdata section first | ||
| for section in pe.sections: | ||
| try: |
There was a problem hiding this comment.
please use get_rdata_section here as well
Co-authored-by: Moritz <[email protected]>
Co-authored-by: Moritz <[email protected]>
floss/language/identify.py
Outdated
| except ValueError: | ||
| logger.debug(".rdata section not found") | ||
|
|
||
| section_va = section.VirtualAddress |
There was a problem hiding this comment.
this now needs to be in an else clause so we don't end up here even if there's no .rdata section
|
The concept of how this should work seems solid to me. I like that .rdata is checked first, but that all sections are scanned after, this is important for obfuscated binaries with garbled section names. If we ever discover actors begin to zero out the strings we search for, we can migrate to signature scanning assembly per architecture as I do in GoReSym https://github.com/mandiant/GoReSym/blob/master/objfile/scanner.go but I don't believe this is neccessary at all for now. And I quite like the simpler string based scanning approach to start with. |
|
Thanks, @sara-rn! |
identify Go samples with stomped PCNLTAB magic bytes
reused function get_rdata_section from language.rust