Skip to content

Add Go calling convention and string recovery#8304

Open
seekbytes wants to merge 1 commit into
Vector35:devfrom
seekbytes:golang-plugin
Open

Add Go calling convention and string recovery#8304
seekbytes wants to merge 1 commit into
Vector35:devfrom
seekbytes:golang-plugin

Conversation

@seekbytes

@seekbytes seekbytes commented Jul 3, 2026

Copy link
Copy Markdown

Based on the two rust plugins we have for Objective-C and Swift, here's a third one that provides some enhancements around golang support for binaries.

Features include:

  • a MLIL workflow that sets of the correct calling convention for golang binaries. As reported in Go internal ABI specification, we have two main calling conventions for go: one based from the stack, and one that uses only mainly registers. First, we detect if we're dealing with a golang binary; second, if the function has a symbol for it and the symbol ends with .abi0 we apply the cc based on the stack. At third, we try to base the heuristic with the first basic block of the routine. If we detect we're accessing a possible argument within LLIL into the stack, then we apply the stack cc otherwise the reg one.

  • a HLIL workflow that adjusts the strings length passed as parameters. This is done without checking symbols (🥳 ) by simply taking advantage of the correct calling convention. A string in golang is a structure that is defined by two fields: a set of characters and the length. Given any structure with less than 3 parameters is splitted into registers/stack, we check in the HLIL call for every argument: if we're able to detect a const ptr + len within two arguments (I'm using window(2) which can be definitely improved). If yes, we cap the length of the datavar defined for the const ptr and we set the len correctly.

Some questions:

  • I just saw I enforced 2024 as rust version, should I downgrade it?
  • I defined most of the calling conventions related to golang explicitly inside this plugin (although I see that x86 has go-stack). Should I consider to move them outside of this plugin and implement them in arch?

Todo:

  • CMakeList.txt

Should be related to:

@CLAassistant

CLAassistant commented Jul 3, 2026

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@seekbytes seekbytes changed the title Added plugin for golang Enchanted golang support Jul 3, 2026
@seekbytes seekbytes changed the title Enchanted golang support Add Go calling convention and string recovery Jul 3, 2026
@seekbytes

Copy link
Copy Markdown
Author

Before:
go_before

After:
go_after

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants