Commit Graph

622 Commits (abcdc1fcbffbc684f42d23a0ab126815cc03b7e7)
 

Author SHA1 Message Date
Daniel Martí 98113d0124 properly skip non-build flags for 'go list'
If the flags list included ["-o" "binary"], we would properly skip "-o",
but we wouldn't skip "binary".

Thus, 'go list' would receive "binary" as the first argument, and assume
that's the first parameter and the end of the flags.

And add a unit test case.

Fixes , again.
lu4p 870cde9a0a
Remove xor from the name of literal obfuscators. ()
pagran 28adbaa73b
Randomize operator (xor, add, subtract) on all obfuscators ()
Co-authored-by: lu4p <lu4p@pm.me>
pagran 2eba744530
Add XorSeed obfuscator ()
Co-authored-by: lu4p <lu4p@pm.me>
Daniel Martí aa9767b0d2 add a regression test for
The test case we had didn't have a realistic-looking module path with a
dot, so we hadn't noticed the bug with IndexByte.

Fix that. We verified that the new test fails if we undo the fix.
Daniel Martí d0e01478f0 keep build flags when calling 'go list'
Otherwise any build flags like -tags won't be used, and we might easily
end up with errors or incorrect packages.

The common case with -tags is covered by one of the integration test
scripts. On top of that, we add a table-driven unit test to cover all
edge cases, since there are many we can do quickly in a unit test.

Fixes .
Zachary Wasserman fc4eb4f940 Handle ldflags set variable with . in package name
Fixes 
Daniel Martí 7fe0bf4787 simplify the main code flow somewhat
We don't really care about tools other than "compile" and "link". Stop
trying to keep a complete list.

Use "if err := f(); err != nil {" where it makes sense.

Simplify some declarations, and use a better variable name than "fW".
pagran 9c25f4c2b2
Add xorShuffle obfuscator ()
* Refactoring

* Rename Xor2 to XorShuffle
lu4p 0dd97ed0fa
math/rand.Intn(n) generates a `value`, ()
which has the following properties `value >=0 && value < n`.

I previously thought it was `value >=0 && value <= n`.
pagran c51e08ef37
Add split obfuscator ()
Daniel Martí 65461aabce reuse a single 'go list -json -export -deps' call
Instead of doing a 'go list' call every time we need to fetch a
dependency's export file, we now do a single 'go list' call before the
build begins. With the '-deps' flag, it gives us all the dependency
packages recursively.

We store that data in the gob format in a temporary file, and share it
with the future garble sub-processes via an env var.

This required lazy parsing of flags for the 'build' and 'test' commands,
since now we need to run 'go list' with the same package pattern
arguments.

Fixes .
pagran c2079ac0a1
Add test for literal obfuscators ()
* Combine literals-all-obfuscators.txt nad literals.txt
Rewrite literals.txt logic

* Remove unused \s

* Refactoring and add float ast helpers
lu4p 21c67b91b1
Only obfuscate required identifiers ()
The following identifiers are now skipped,
because they never show up in the binary:

- constant identifiers
- identifiers of local variables
(includes function params and named returns)
- identifiers of local types
lu4p 5cbbac56f3
move asthelper functions to separate package ()
Daniel Martí 846ddb4097
internal/literals: minor adjustments to the last commits ()
First, unindent some of the AST code.

Second, genRandInt is unused; delete it.

Third, genRandIntn is really just mathrand.Intn. Just use it directly.

Fourth, don't use inline comments if they result in super long lines.
pagran 14a19b3e6b
intLiteral helper now accepts int ()
pagran 4b73c37ed7
Add new obfuscators for literals - swap ()
Implement swap obfuscator
lu4p 50d24cdf51 Add float, int, and boolean literal obfuscation.
Add ast helper functions to reduce ast footprint.

Add binsubfloat and binsubint functions for testing.

Fixes .
Daniel Martí 3ea6fda837 CI: test on gotip
Since the new linker was failing on our crypto/aes shenanigans until the
recent commit to remove it for literal obfuscation.

Building Go does take about two minutes on the CI machine, but that's
fast enough. One can see the exact version that was used via the 'go
version' line.
lu4p 705f9d3a28 Fix byte array and untyped constant obfuscation.
Byte arrays were previously,
obfuscated as byte slices.

Untyped constants are now skipped,
because they cannot be replaced with typed variables.
lu4p d48bdbadae Use XOR instead of AES for literal obfuscation.
Implement a literal obfuscator interface,
to allow the easy addition of new encodings.

Add literal obfuscation for byte literals.

Choose a random obfuscator on literal obfuscation,
useful when multiple obfuscators are implemented.

Fixes 
Daniel Martí 9c4b7d5a44 add the first benchmark and CONTRIBUTING doc
Pagran 0c5e0a8944 Fix 'A required privilege is not held by the client' on Windows
Daniel Martí bad4e52ac4 don't use CombinedOutput for 'go list -json'
Since sometimes it will output warnings to stderr even when succeeding,
such as when having to deal with cgo.

Fixes .
Daniel Martí 47b1bc8e6a minor code cleanup for position shuffling
Make the comments a bit more self-explanatory, and reduce unnecessary
verbosity.
lu4p b4ed621eed
Shuffle the order of top-level definitions. ()
lu4p b3616f19c4
fix implementedOutsideGo, fixes ()
Injected functions were mistaken for functions implemented outside go.

Asm functions:
obj.Scope().Pos() == 0
obj.Scope().End() == 0

Injected functions:
obj.Scope().Pos() == 0
obj.Scope().End() == 1

We now check for the End instead of the Pos.
Andrew LeFevre 796f2b833e fix README mentioning old HidePanics function
Daniel Martí b171463a47 slightly less verbose runtime AST code
And rewrite a loop to be a bit simpler.
Andrew LeFevre 7ede37cc0b
add runtime API to suppress printing fatal errors
Fixes .
lu4p baae7a46fd
simplify detection of reflection
lu4p f1bf6f91ee
skip literals used in constant expressions
Fixes .
Daniel Martí c9bc7bac3b add a bit of code to aid debugging tests
Andrew LeFevre ee18db7ef1 only add crypto dependencies if -literals is passed
Daniel Martí 3e4f3821ea don't leak build version information via a const either
This requires a bit of extra magic to replace one constant in
runtime/internal/sys, but that was simple enough given that we can reuse
a lot of the code to parse the files and write them to a temporary dir.

We can also drop the -X flags, as runtime.buildVersion is based on the
constant that we replace here.

Fixes , again.
Daniel Martí 442eb4e139 speed up builds with the compiler's -dwarf=false flag
Generating DWARF in the compiler object files could take as much as 10%
extra CPU time, while we ignore it entirely at the link stage.

Speeds up 'go test -short' from ~19.5s to ~18.5s on my laptop.
Daniel Martí ccd46404c0 improve binsubstr error messages a bit
By printing all the strings that failed at once, not just the first.
lu4p 44f638e84d
upgrade dependencies
Daniel Martí 51550e98e8 README: simplify and update with the latest changes
Daniel Martí 649cc2f6ba strip Go version information from the binary too
Fixes .
Daniel Martí c7d1fc7c60 strip buildid information from linked binaries
Otherwise, one can use 'go tool buildid' to obtain the main package's
build ID, which can make de-obfuscating the main package much simpler.

Fixes .
lu4p 199d24d24f
use fmt's %q to encode []byte literals
I now implemented and tested hex encoded strings, binary literals, and fmt.Sprintf("%q", data).
In the case of garble all produce the exact same binary size.

I decided to use %q because it is the simplest, leads to the smallest garbled code file size size
of the three, and is faster at compile time than binary literals.

It looks like:

    var ztN0xdMLL = garbleDecrypt([]byte("\xaf\xbd\x01\\&\x14\xab\xeb\x94\x10Q\xf2H#\xde\x17\a\x8f\x89MmZs\u0088\xcfw\xba?\x9e\xe1\x81\x1eպD\xe1@\xf2\x8d\xe3Ije\xca\bB\xbey\x8b"))

From the fmt docs:

    String and slice of bytes (treated equivalently with these verbs):
    [...]
    %q    a double-quoted string safely escaped with Go syntax

Fixes .
lu4p fdc7f97db8
use binary literals instead of hex strings
Fixes 
lu4p 234174b418
don't obfuscate some literals which might break typechecking
lu4p 4c64b13506
make -seed=random use the same random seed for all packages
Otherwise, a different random seed per package will break imported names.
lu4p 0cf8d4e7a6
add seed flag to control how builds are reproducible
Fixes .
Daniel Martí 5604a2aa9e avoid importing fmt in strings test
Reduces its 'go test -short' time from ~3s to ~2.4s on my laptop, since
we have to compile fewer dependencies.
Daniel Martí a09b197fe2 remove the code to handle a nil file.Imports
I could not reproduce the supposed panic, even after I was able to reach
a nil x.Imports in that line in question with the modified test.
Daniel Martí 1bb85bbf9b simplify the code to obfuscate literals a bit