No Symbols When Reversing? No Problem, Bring Your Own!
Demonstrates how to generate and distribute custom FunctionID and BSim symbol databases in Ghidra to accelerate reversing stripped Go binaries.
Summary
The Challenge of Stripped Binaries
Opening stripped binaries in disassemblers often presents thousands of unnamed functions, creating severe bottlenecks for malware analysts and reverse engineers.
FunctionID and BSim Databases in Ghidra
Utilizing Ghidra's FunctionID and BSim capabilities enables analysts to create reusable function signature databases and match known library code across stripped targets.
Accelerating Analysis of Golang Binaries
Applying automated symbol matching to complex Golang malware families, such as the qBit family, significantly reduces analysis time and eliminates analytical blind spots.
Scaling Symbol Datasets Across Research Teams
Sharing portable FunctionID datasets and open-source Ghidra helper scripts allows security teams to collaborate efficiently and aggregate reverse engineering insights.
Related talks
Creator Stage·48 min
Asher Davila
Examines the challenges of analyzing Go-based IoT malware and demonstrates reversing techniques using the Pumabot surveillance botnet as a case study.
CSIT Village·18 min
Theodore Lee
Theodore Lee examines reverse engineering (RE) is time consuming and resource intensive.
CSIT Village·20 min
Kan Onn Kit
Kan Onn Kit examines in stripped binaries, malware analysts often struggle in a sea of raw offsets and pointer arithmetic.