quangnh89

• Dissecting Go Binaries
• Go: Overview of the Compiler
• Go compiler internals: adding a new statement to Go - Part 1
• Go compiler internals: adding a new statement to Go - Part 2
• Reversing GO binaries like a pro
• How a Go Program Compiles down to Machine Code
• Analyzing Golang Executables
• Go Reverse Engineering Tool Kit
• go-internals book
• [Reconstructing Program Semantics from Go Binaries](http://home.in.tu

quangnh89

//
// Ref = src
// https://www.blackhat.com/docs/eu-17/materials/eu-17-Liberman-Lost-In-Transaction-Process-Doppelganging.pdf
//
// Credits:
//  Vyacheslav Rusakov @swwwolf
//  Tom Bonner @thomas_bonner
//

#include <Windows.h>

quangnh89

#!/usr/bin/env python
import angr


def malloc_cb(state):
    print "malloc!"
    state.regs.eax = 0xc0000000  # concrete address


def strlen_cb(state):

quangnh89

# Slide : https://docs.google.com/presentation/d/1jLUDucNtvGotHw0LOvDonMYwCkXYcb-cnsOWLNt-Ag0
import sys
import pefile
from capstone import *
from capstone.x86 import *
from keystone import *
from datetime import datetime

MAX_DISASM_COUNT = 1000 * 1000
FILE_NAME = r"dump-g4pic.dll"