Implement dynamic Go (Golang) stripped symbol recovery and tracing

[doomedraven]

Implements advanced in-memory symbol recovery and tracing for Go binaries:

1. Creates hook_go.c containing a dynamic C-based Go pclntab (Program Counter Line Table) memory parser supporting Go 1.16 through Go 1.24+.
2. Scans executable image space for Go version-specific magic bytes (0xFFFFFFF1, 0xFFFFFFF0, 0xFFFFFFFA, 0xFFFFFFFB) to locate pclntab.
3. Automatically maps and recovers fully qualified Go function names and absolute virtual addresses from the pclntab table (even on heavily stripped binaries).
4. Targets critical cryptographic and networking packages (e.g. crypto/aes, crypto/cipher, net/http) and main package decrypters/injectors to programmatically register in-process debugger breakpoint hooks.
5. Implements a pointer-size-aware and calling-convention-aware parameter tracer (supporting Go 1.17+ register-based arguments in RAX/RBX/RCX and pre-1.17 stack-based arguments) with safe Go string extraction.
6. Integrates Go symbol parsing into CAPE_post_init() inside CAPE/CAPE.c, and updates capemon.vcxproj/filters for compiling.

Inspired by GoReSym and ExtremeDumper concepts.

---

Key Technical Achievements

1. Created Dynamic In-Memory pclntab Parser (hook_go.c):

   • Implemented a C-based metadata parser that scans the process space of the main module at startup for version-specific Go magic header bytes (0xFFFFFFF1, 0xFFFFFFF0, 0xFFFFFFFA, 0xFFFFFFFB), covering Go 1.16
     through Go 1.24+.
   • Parses the pcHeader fields, walks the function entry tables (functabOffset), resolves absolute virtual addresses from the runtime text base, and recovers fully qualified Go function names (e.g.,
     main.decryptPayload, crypto/aes.(*aesCipher).Encrypt, net/http.Get)—even when the Go binary has been heavily stripped (-ldflags="-s -w").

2. Setup Automated In-Process Hooking (GoSetFunctionHook):

   • Leveraged capemon's native, stealthy in-process breakpoint debugger.
   • When critical, high-signal cryptographic, dropper, or networking functions are recovered (targeting packages like crypto/aes, crypto/cipher, net/http, net/websocket, or main package decrypters), capemon
     programmatically registers an execution breakpoint hook (SetNextAvailableBreakpoint).

3. Architected Calling-Convention-Aware Parameter Tracing:

   • Implemented GoBreakpointCallback to capture arguments dynamically when breakpoints are hit.
   • Handles both 64-bit register-based calling conventions (introduced in Go 1.17, tracing arguments in RAX, RBX, RCX...) and 32-bit stack-based calling conventions (tracing parameters sequentially on the
     stack).
   • Designed a safe Go String Parser (LogGoString) that extracts strings based on Go’s native struct layout (Data Pointer + Explicit Length) instead of standard null-terminated characters, ensuring stability.

4. Surgical Integration & MSBuild Updates:

   • Registered GoRecoverSymbols() inside CAPE_post_init() (CAPE/CAPE.c) right after the debugger has finished initialising.
   • Updated capemon.vcxproj and capemon.vcxproj.filters to incorporate hook_go.c for automated, clean compilation.

---

[kevoreilly]

Very nice idea. Might be better to use software breakpoints here, I'll take a look at that.

[doomedraven]

I Will update it, I think I still have pending stuff to push

[doomedraven]

ok i think im done here, but i will test compilation tomorrow and fix any issues with it. but i would suggest you to start with smaller PRs to review and go to more complex one