5e3cdf89a8
Back in early April we added initial support for Go 1.17, working on a commit from master at that time. For that to work, we just needed to add a couple of packages to runtimeRelated and tweak printFile a bit to not break the new "//go:build" directives. A significant amount of changes have landed since, though, and the tests broke in multiple ways. Most notably, the new register ABI is enabled by default for GOOS=amd64. That affected garble indirectly in two ways: there's a new internal package to add to runtimeRelated, and we must make reverse.txt more clever in making its output constant across ABIs. Another noticeable change is that Go 1.17 changes how its own version is injected into the runtime package. It used to be via a constant in runtime/internal/sys, such as: const TheVersion = `devel ...` Since we couldn't override such constants via the linker's -X flag, we had to directly alter the declaration while compiling. Thankfully, Go 1.17 simply uses a "var buildVersion string" in the runtime package, and its value is injected by the linker. This means we can now override it with the linker's -X flag. We make the code to alter TheVersion for Go 1.16 a bit more clever, to not break the package when building with Go 1.17. Finally, our hack to work around ambiguous TOOLEXEC_IMPORTPATH values now only kicks in for non-test packages, since Go 1.17 includes our upstream fix. Otherwise, some tests would end up with the ".test" variant suffix added a second time: test/bar [test/bar.test] [test/bar [test/bar.test].test] All the code to keep compatibility with Go 1.16.x remains in place. We're still leaving TODOs to remind ourselves to remove it or simplify it once we remove support for 1.16.x. The 1.17 development freeze has already been in place for a month, and beta1 is due to come this week, so it's unlikely that Go will change in any considerable way at this point. Hence, we can say that support for 1.17 is done. Fixes #347. |
5 years ago | |
|---|---|---|
| .github | 5 years ago | |
| internal | 5 years ago | |
| scripts | 5 years ago | |
| testdata | 5 years ago | |
| .gitattributes | 6 years ago | |
| .gitignore | 6 years ago | |
| AUTHORS | 6 years ago | |
| CHANGELOG.md | 5 years ago | |
| CONTRIBUTING.md | 5 years ago | |
| LICENSE | 6 years ago | |
| README.md | 5 years ago | |
| bench_test.go | 5 years ago | |
| go.mod | 5 years ago | |
| go.sum | 5 years ago | |
| hash.go | 5 years ago | |
| main.go | 5 years ago | |
| main_test.go | 5 years ago | |
| position.go | 5 years ago | |
| reverse.go | 5 years ago | |
| runtime_strip.go | 5 years ago | |
| shared.go | 5 years ago | |
README.md
garble
GO111MODULE=on go get mvdan.cc/garble
Obfuscate Go code by wrapping the Go toolchain. Requires Go 1.16 or later.
garble build [build flags] [packages]
The tool also supports garble test to run tests with obfuscated code,
and garble reverse to de-obfuscate text such as stack traces.
See garble -h for up to date usage information.
Purpose
Produce a binary that works as well as a regular build, but that has as little information about the original source code as possible.
The tool is designed to be:
- Coupled with
cmd/go, to support modules and build caching - Deterministic and reproducible, given the same initial source code
- Reversible given the original source, to de-obfuscate panic stack traces
Mechanism
The tool wraps calls to the Go compiler and linker to transform the Go build, in order to:
- Replace as many useful identifiers as possible with short base64 hashes
- Replace package paths with short base64 hashes
- Remove all build and module information
- Strip filenames and shuffle position information
- Strip debugging information and symbol tables via
-ldflags="-w -s" - Obfuscate literals, if the
-literalsflag is given - Remove extra information, if the
-tinyflag is given
By default, the tool obfuscates the packages under the current module. If not
running in module mode, then only the main package is obfuscated. To specify
what packages to obfuscate, set GOPRIVATE, documented at go help private.
Note that commands like garble build will use the go version found in your
$PATH. To use different versions of Go, you can
install them
and set up $PATH with them. For example, for Go 1.16.1:
$ go get golang.org/dl/go1.16.1
$ go1.16.1 download
$ PATH=$(go1.16.1 env GOROOT)/bin:${PATH} garble build
Literal obfuscation
Using the -literals flag causes literal expressions such as strings to be
replaced with more complex variants, resolving to the same value at run-time.
This feature is opt-in, as it can cause slow-downs depending on the input code.
Literal expressions used as constants cannot be obfuscated, since they are
resolved at compile time. This includes any expressions part of a const
declaration.
Tiny mode
When the -tiny flag is passed, extra information is stripped from the resulting
Go binary. This includes line numbers, filenames, and code in the runtime that
prints panics, fatal errors, and trace/debug info. All in all this can make binaries
2-5% smaller in our testing, as well as prevent extracting some more information.
With this flag, no panics or fatal runtime errors will ever be printed, but they
can still be handled internally with recover as normal. In addition, the
GODEBUG environmental variable will be ignored.
Note that this flag can make debugging crashes harder, as a panic will simply
exit the entire program without printing a stack trace, and all source code
positions are set to line 1. Similarly, garble reverse is generally not useful
in this mode.
Speed
garble build should take about twice as long as go build, as it needs to
complete two builds. The original build, to be able to load and type-check the
input code, and finally the obfuscated build.
Go's build cache is fully supported; if a first garble build run is slow, a
second run should be significantly faster. This should offset the cost of the
double builds, as incremental builds in Go are fast.
Determinism and seeds
Just like Go, garble builds are deterministic and reproducible if the inputs
remain the same: the version of Go, the version of Garble, and the input code.
This has significant benefits, such as caching builds or being able to use
garble reverse to de-obfuscate stack traces.
However, it also means that an input package will be obfuscated in exactly the
same way if none of those inputs change. If you want two builds of your program
to be entirely different, you can use -seed to provide a new seed for the
entire build, which will cause a full rebuild.
If any open source packages are being obfuscated, providing a custom seed can also provide extra protection. It could be possible to guess the versions of Go and garble given how a public package was obfuscated without a seed.
Caveats
Most of these can improve with time and effort. The purpose of this section is to document the current shortcomings of this tool.
-
Exported methods are never obfuscated at the moment, since they could be required by interfaces and reflection. This area is a work in progress.
-
It can be hard for garble to know what types will be used with reflection, including JSON encoding or decoding. If your program breaks because a type's names are obfuscated when they should not be, you can add an explicit hint:
type Message struct { Command string Args string } // Never obfuscate the Message type. var _ = reflect.TypeOf(Message{}) -
Go plugins are not currently supported; see #87.
Contributing
We welcome new contributors. If you would like to contribute, see CONTRIBUTING.md as a starting point.