f0wl / gotools

Plugin for Ghidra to assist reversing Golang binaries

Go Plugin for Ghidra

Plugin to assist reversing Golang binaries with Ghidra.

This is in a VERY early stage and for now only handles linux/x86_64 binaries.

Installation

1. Download the release for your Ghidra version
2. Copy ZIP to $GHIDRA_DIR/Extensions/Ghidra/
3. Start Ghidra, File > Install Extensions, check the box next to gotools
4. Restart Ghidra

Usage

When importing, select the Language x86:LE:64:golang:default

Features

• Recover function names
• Recover number of arguments and return type

Developers

Code formatted with

clang-format -i -style=Google src/main/java/gotools/*.java

References

• Reversing GO binaries like a pro
• pkg/runtime documentation
• The Go low-level calling convention on x86-64