GoResolver, a ground-breaking open-source tool, was unveiled to address one of the most persistent issues in malware analysis: deobfuscating Golang binaries.
Developed by Volexity, this innovative solution employs control-flow graph similarity techniques to recover obfuscated function names, significantly enhancing reverse engineers’ ability to analyze increasingly common Golang-based malicious code.
The Go programming language (Golang) has gained substantial popularity among malware developers in recent years.
Security researchers consistently encounter malicious binaries written in Golang that deliberately employ obfuscation tools like Garble to hinder analysis.
The Growing Golang Malware Challenge
These obfuscated samples present formidable obstacles for reverse engineers due to embedded libraries, large binary sizes, and stripped symbol information.
“Binaries written in Golang are often challenging to analyze because of the embedded libraries and the sheer size of the resulting binaries”, notes Volexity in their official announcement.
“This issue is amplified when samples are obfuscated using tools such as Garble”.
GoResolver distinguishes itself from existing tools by implementing control-flow graph similarity algorithms.
While previous solutions like Mandiant’s GoReSym extracted symbol information from Golang’s internal runtime structures, GoResolver takes recovery a step further by comparing the structural patterns of functions across binaries.
The tool’s approach is based on computing the normalized similarity (0.0 to 1.0) between control-flow graphs by analyzing the weighted ratio of similar assembly instructions.
By generating clean template Golang samples and comparing them against obfuscated binaries, GoResolver can effectively match randomized symbols to their original form.
The GoResolver Toolchain Architecture
The complete toolchain consists of four integrated projects:
- GoResolver: Symbol recovery through extraction and graph similarity.
- GoGrapher: Binary similarity tool computing control-flow graph similarities.
- GoStrap: Reference sample bootstrapping tool for any Golang version.
- GitToolFetcher Tool: to manage GitHub-hosted projects.
Installation requires Go 1.20.6+ and Python 3.12+, with components available through PyPI via a simple command:
GoResolver also provides plugins for IDA Pro 9+ and Ghidra 11.3+, streamlining integration into existing analysis workflows.
Practical Application and Effectiveness
In a case study, Volexity demonstrated GoResolver’s capabilities by analyzing an obfuscated Stowaway agent.
The tool first identified the malware’s Golang version by fingerprinting runtime characteristics, then computed binary similarities to resolve obfuscated symbols.
The results transformed generic function names like sub_OFFSET into meaningful identifiers that revealed package relationships and functionality.
Even partially resolved symbols provided significant context about package names, helping analysts focus on core malware logic rather than runtime libraries.
Volexity plans to enhance GoResolver with automatic Golang string parsing and other improvements to facilitate more efficient analysis of Golang binaries.
As malware authors increasingly turn to Golang for its cross-platform capabilities and obfuscation-friendly features, tools like GoResolver become essential components in the security researcher’s arsenal.
The tool represents a significant advancement in the ongoing arms race between malware developers and security researchers, providing a powerful countermeasure against obfuscation techniques that have previously complicated analysis efforts.
