I can't find how to use gobfuscate

[AXDOOMER]

Hi.

I'm new to Go. I'm working on a CTF project and would like to obfuscate my binary using your tool.

When I run ./gobfuscate botnet ./out, I get:

2018/09/06 00:33:50 Copying GOPATH...
Failed to re-build import graph: botnet

My GOPATH contains /home/ax/go:/usr/share/go/1.9/contrib and my program is in /home/ax/go/src/botnet/. The only source code in this folder is botnet.go, the package name inside the file is botnet and it contains func main.

I tried to run it on other packages like keylogger which I have in /home/ax/go/src/github.com/MarinX/keylogger/, in this case it would return Failed to build import graph: keylogger.

What am I doing wrong? I don't know how to get it right.

Thank you

[XiaoMouR]

I met the same problem as yours. Need something modified to the code mentioned above.

[AXDOOMER]

@riddlesomebody I guess that's correct. My gopath is /home/ax/go:/usr/share/go/1.9/contrib. I'll do the change and see if it fixes the tool.

[AXDOOMER]

So it works if I change my GOPATH to /home/ax/go. For some reason it fails to obfuscate every packages.

Obfuscating package names...
Renamed 6 occurrences in 1 file in 1 package.
Renamed 4 occurrences in 1 file in 1 package.
Renamed 10 occurrences in 1 file in 1 package.
Renamed 19 occurrences in 1 file in 1 package.
Renamed 2 occurrences in 1 file in 1 package.
Renamed 3 occurrences in 1 file in 1 package.
2018/12/12 21:46:39 Obfuscating strings...
2018/12/12 21:46:39 Obfuscating symbols...
Renamed 5 occurrences in 2 files in 1 package.
Failed to obfuscate symbols: top-level renaming: package "gfdmkdmimmfipndjbcpb/nnijpfecmaephifobcio/mahmgcpilhcicaliadmh" has no member "KERN_PROC_PROC"

It progresses if I run it more times. It always fails with a different reason every time.

Obfuscating package names...
Renamed 6 occurrences in 1 file in 1 package.
Renamed 2 occurrences in 1 file in 1 package.
Renamed 4 occurrences in 1 file in 1 package.
Renamed 10 occurrences in 1 file in 1 package.
Renamed 19 occurrences in 1 file in 1 package.
Renamed 3 occurrences in 1 file in 1 package.
2018/12/12 21:48:00 Obfuscating strings...
2018/12/12 21:48:00 Obfuscating symbols...
Renamed 2 occurrences in 1 file in 1 package.
Renamed 2 occurrences in 1 file in 1 package.
Renamed 9 occurrences in 3 files in 2 packages.
Renamed 2 occurrences in 1 file in 1 package.
Renamed 2 occurrences in 1 file in 1 package.
Renamed 3 occurrences in 1 file in 1 package.
Renamed 3 occurrences in 2 files in 2 packages.
Renamed 3 occurrences in 1 file in 1 package.
Renamed 3 occurrences in 1 file in 1 package.
Renamed 4 occurrences in 1 file in 1 package.
Renamed 2 occurrences in 1 file in 1 package.
Renamed 2 occurrences in 1 file in 1 package.
Renamed 2 occurrences in 1 file in 1 package.
Failed to obfuscate symbols: top-level renaming: package "gdhoidagpgcghjckmfaa/malhkpafchiflaninmhc/kmapichamcgofgfldhaa" has no member "procCloseHandle"

Eventually, it came back to the first error, so I had to remove the package that was causing the problem, which is "github.com/mitchellh/go-ps". It produced a package, but I was expecting an executable because the file in my package was a program with a main function.

[AXDOOMER]

For reference, the error message that I was receiving is on this line: https://github.com/unixpickle/gobfuscate/blob/9e966305f26d78b1c96ede9cc5e985af74ab986f/gopath_copy.go#L24

Just above on line 22, you have ctx with contains the GOPATH (/home/ax/go:/usr/share/go/1.9/contrib) which must be /home/ax/go for me in order to work.

[XiaoMouR]

@AXDOOMER This tool can't handle the build tags correctly as I submitted this before. BTW, you can use path list as GOPATH to compile target packages but need some modification in this function. https://github.com/unixpickle/gobfuscate/blob/86b3fcd4c07abb65d9d8180a71999cdd442e24ca/gopath_copy.go#L60 In the function mentioned above, package path is just joined simply, which is the key point to make the error message.

[AXDOOMER]

The error that I get happens on line 22, the copyDep function is only called on line 33.

[XiaoMouR]

The error that I get happens on line 22, the copyDep function is only called on line 33.

I mean, you need to modify the code to make this tool work with GOPATH like /a/gopath1:/b/gopath. And then you can let the original GOPATH /home/ax/go:/usr/share/go/1.9/contrib work correctly which will not trigger the error message on line 22 .

[AXDOOMER]

I think there's no simple way to fix it. If an error happens on the line forward, _, errs := importgraph.Build(&ctx), then the program should try removing the path that doesn't work and keep the path that works to generate the graph.

[XiaoMouR]

@AXDOOMER To let importgraph.Build work as expected, try the following step.

1. Make sure that you source code can be compile correctly.
2. Make sure all dependency you import to your code doesn't have any relative path.
3. Make sure the target package you want to obfuscate is located in GOPATH.

The example you mentioned is fitted the step 3 that the target package is not keylogger but github.com/MarinX/keylogger.So check the correct package name once more.

[AXDOOMER]

@riddlesomebody The problem was only the /usr/share/go/1.9/contrib part that was in my GOPATH.

Also, this tool generated a package, but I was expecting an executable. Do you know how I can get it to build an executable instead of a package?

[XiaoMouR]

If there is nothing in the path /usr/share/go/1.9/contrib, I think you can ignore it. Or migrate the package to a single new path, and then set the GOPATH to this new path.

[unixpickle]

Did you end up managing to resolve your issues? And if not, are the issues resolved on the latest master branch?

[AXDOOMER]

No, I couldn't solve my issue and I won't test with the latest version.