#  Go Parser | Yet Another Golang Binary Parser For IDAPro

**URL:** <https://onehack.st/t/go-parser-yet-another-golang-binary-parser-for-idapro/190502>\
**Category:** Tools & Scripts\
**Tags:** tools, programming\
**Created:** [June 20, 2021, 9:32pm UTC](https://onehack.st/t/go-parser-yet-another-golang-binary-parser-for-idapro/190502 "2021-06-20T21:32:58Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![PlayBoy83](https://onehack.st/user_avatar/onehack.st/playboy83/32/164314_2.png) [@PlayBoy83](https://onehack.st/u/PlayBoy83)\
**Post date:** [June 20, 2021, 9:32pm UTC](https://onehack.st/t/go-parser-yet-another-golang-binary-parser-for-idapro/190502/1 "2021-06-20T21:32:58Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/1/5/15d461963e2f72561ab1a5e35a410be3a7b05bdd.jpeg)

## Yet Another Golang binary parser for IDAPro

**Englist | [中文](https://github.com/0xjiayu/go_parser/blob/master/README_cn.md)**

> 💡 **NOTE** :
> 
> This **master** branch is written in Python2 for IDAPython, and tested only on IDA7.2/IDA7.0. If you use IDAPython with Python3 and higher version of IDAPro, please use **[Python3 Branch](https://github.com/0xjiayu/go_parser/tree/py3)** for go\_parser.

Inspired by [golang\_loader\_assist](https://github.com/strazzere/golang_loader_assist) and [jeb-golang-analyzer](https://github.com/pnfsoftware/jeb-golang-analyzer), I wrote a more complete Go binaries parsing tool for IDAPro.

### Main Features：

1. Locate and parse **firstmoduledata** structure in Go binary file, and make comment for each field;
2. Locate **pclntab** (PC Line Table) according to the **firstmoduledata** and parse it. Then find and parse and recover function names and source file paths in the pclntab. Source file paths will be printed in the output window of IDAPro；
3. Parse strings and string pointers, make comment for each string, and make **dref** for each string pointer；
4. According to firstmoduledata, find each **type** and parse it, meke comment for each attribute of **type** , which will be very convenient for malware researcher to analyze a complex type or data structure definition；
5. Parse **itab** (Interface Table).

Helpful information to RE work for Go binaries:

[![](https://github.com/0xjiayu/go_parser/raw/master/imgs/go_binary_info.png)](https://github.com/0xjiayu/go_parser/blob/master/imgs/go_binary_info.png)

And there are two useful feature in **go\_parser** :

1. It also work fine for binaries with malformed File Header information, especially malformed Section Headers information;
2. All those features above are valid for binaries built with **buildmode=pie**.

A config data structure in DDGMiner v5029 (MD5: 95199e8f1ab987cd8179a60834644663) parsing result as below：

[![](https://github.com/0xjiayu/go_parser/raw/master/imgs/map_type_parse_eg.png)](https://github.com/0xjiayu/go_parser/blob/master/imgs/map_type_parse_eg.png)

And the user-defined source file paths list:

[![](https://github.com/0xjiayu/go_parser/raw/master/imgs/srcfiles.png)](https://github.com/0xjiayu/go_parser/blob/master/imgs/srcfiles.png)

### Project files：

- **go\_parser.py** ：Entry file, press **[Alt+F7]** , select and execute this file；
- **common.py** : Common variables and functions definition；
- **pclntbl.py** : Parse **pclntab** (PC Line Table);
- **strings.py** : Parse strings 和 string pointers；
- **moduldata.py** : Parse **firstmoduledata** ；
- **types\_builder.py** : Parse **types** ；
- **itab.py** : Parse **itab** (Interface Table).

Additionally, the **str\_ptr.py** will parse **string pointers** by specify the start address and end address of **string pointers** manually.

### Note

1. This branch is written in Python2 for IDAPython, and tested only on IDA7.2/IDA7.0;
2. The strings parsing module was migrated from [golang\_loader\_assist](https://github.com/strazzere/golang_loader_assist), and I added the feature of string pointers parsing. It only supports x86(32bit & 64bit) architecture for now.

## GitHub:

> **[GitHub - 0xjiayu/go\_parser: Yet Another Golang binary parser for IDAPro](https://github.com/0xjiayu/go_parser)**
>
> Yet Another Golang binary parser for IDAPro