Decrypting Garble-Obfuscated Go Binaries with ungarble_ida

By /

Listen to this Post

Featured Image
Garble is a popular open-source obfuscation tool for Go programs, hardening binaries against reverse engineering. ungarble_ida is an IDAPython plugin designed to decrypt strings obfuscated by Garble, even when control-flow transformations are applied. It supports both ELF and PE binaries (x86/x64) and uses emulation to handle various string transformations.

GitHub Repository: hexamine22/ungarble_ida

You Should Know:

1. Installing ungarble_ida

To use the plugin, follow these steps:

1. Prerequisites:

  • IDA Pro 9.0+
  • Python 3.x (bundled with IDA)

2. Installation:

  • Clone the repository: 
    git clone https://github.com/hexamine22/ungarble_ida.git
  • Copy the plugin to IDA’s plugins directory: 
    cp ungarble_ida.py ~/ida/plugins/

3. Usage:

  • Open a Garble-obfuscated Go binary in IDA.
  • Run the plugin via Edit > Plugins > ungarble_ida.

2. How Garble Obfuscation Works

Garble applies multiple transformations:

  • String Literal Encryption: Encodes strings to hinder static analysis.
  • Control-Flow Flattening: Obfuscates function logic.
  • Type & Function Renaming: Renames symbols to random strings.

Example of a Garble-encrypted string in assembly:

mov eax, 0xDEADBEEF 
call decrypt_routine

3. Manual Decryption (Without ungarble_ida)

If you need to manually decrypt strings in a Garble-protected binary:

1. Locate Decryption Functions:

Search for repetitive `call` patterns followed by memory writes.

2. Emulate Decryption in Python (Using Unicorn Engine):

from unicorn import 
from unicorn.x86_const import

def emulate_decryption(encrypted_data, key):
mu = Uc(UC_ARCH_X86, UC_MODE_64)
mu.mem_map(0x1000000, 0x1000)
mu.mem_write(0x1000000, encrypted_data)
mu.reg_write(UC_X86_REG_RAX, key)
mu.emu_start(0x1000000, 0x1000000 + len(encrypted_data))
return mu.mem_read(0x1000000, len(encrypted_data))

3. Extract Strings with radare2:

r2 -A binary
/R call.mov.eax

4. Handling Control-Flow Obfuscation

If Garble’s control-flow flattening is applied:

  • Use IDA’s microcode to simplify branches.
  • Apply symbolic execution via angr: 
    import angr
proj = angr.Project("obfuscated_binary", auto_load_libs=False)
state = proj.factory.entry_state()
simgr = proj.factory.simulation_manager(state)
simgr.explore(find=0xADDR, avoid=0xBADDR)

What Undercode Say

Reverse engineering obfuscated Go binaries requires a mix of static and dynamic analysis. ungarble_ida simplifies this by automating string decryption, but manual techniques remain useful for deeper analysis.

Key Commands Recap:

  • Static Analysis: 
    strings --encoding=l binary | grep "secret"
objdump -d binary > disassembly.txt
  • Dynamic Analysis: 
    gdb -q ./binary
break 0xADDR
run
x/s $rax
  • Windows Alternatives: 
    .\x64dbg.exe binary
!findcalls "decrypt"

Expected Output:

Decrypted strings should appear in IDA’s output window or via manual emulation. For further research, check:
– Garble GitHub
– Unicorn Engine Docs

Prediction

As Go adoption grows, obfuscation tools like Garble will evolve, requiring more advanced deobfuscation techniques. Future plugins may integrate AI-assisted pattern recognition to handle polymorphic obfuscation.

IT/Security Reporter URL:

Reported By: Hassan Faraz – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Related Posts: