ELF: Detect OS from Go binaries #1987
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as outdated.
This comment was marked as outdated.
stevemk14ebr
approved these changes
Feb 14, 2024
|
I would recommend testing on old go versions prior to 1.18 when buildinfo was added. I would also recommend testing with binaries emitted by |
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
Closed
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as resolved.
This comment was marked as resolved.
mr-tz
reviewed
Jun 13, 2024
mr-tz
approved these changes
Jun 13, 2024
ygasparis
pushed a commit
to ygasparis/capa
that referenced
this pull request
Jun 18, 2024
* elf: read segment memory size * elf: add routine to read mapped memory * elf: better detect OS for binaries compiled by Go * elf: guess OS from Go source filenames * changelog * elf: mypy * merge * elf: add OS detection based on vDSO strings * elf: document VTGrep searches * elf: describe further technique to identify Go binaries * elf: search for `.go.buildinfo` section via @yelhamer * black * elf: detect Alpine Linux ident * elf: log interest symtab entries * tests: add test for OS detection by Go buildinfo * loader: handle missing viv modules * pre-commit: run deptry before tests (which are slow) * loader: describe removing viv symbolic switch solver * pyproject: add PyGithub for deptry * black
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
use the strategies pioneered by GoReSym to detect the target OS for ELF binaries compiled by Go:
closes #1978
FYI @C0d3R3ad3r
FYI @stevemk14ebr
Checklist