Forked from: github.com/burrowers/garble
You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
Go to file
Daniel Martí 63c42c3cc7
support typechecking all of std (#236)
There was one bug keeping the command below from working:

	GOPRIVATE='*' garble build std

The bug is rather obscure; I'm still working on a minimal reproducer
that I can submit upstream, and I'm not yet convinced about where the
bug lives and how it can be fixed.

In short, the command would fail with:

	typecheck error: /go/src/crypto/ecdsa/ecdsa.go:122:12: cannot use asn1.SEQUENCE (constant 48 of type asn1.Tag) as asn1.Tag value in argument to b.AddASN1

Note that the error is ambiguous; there are two asn1 packages, but they
are actually mismatching. We can see that by manually adding debug
prints to go/types:

	constant: asn1.SEQUENCE (constant 48 of type golang.org/x/crypto/cryptobyte/asn1.Tag)
	argument type: vendor/golang.org/x/crypto/cryptobyte/asn1.Tag

It's clear that, for some reason, go/types ends up confused and loading
a vendored and non-vendored version of asn1. There also seems to be no
way to work around this with our lookup function, as it just receives an
import path as a parameter, and returns an object file reader.

For now, work around the issue by *not* using a custom lookup function
in this rare edge case involving vendored dependencies in std packages.
The added code has a lengthy comment explaining the reasoning.

I still intend to investigate this further, but there's no reason to
keep garble failing if we can work around the bug.

Fixes #223.
5 years ago
.github CI: comment out test-gotip for now (#157) 5 years ago
internal if the seed is random and the build fails, print the seed (#213) 5 years ago
scripts obfuscate fewer std packages (#196) 5 years ago
testdata support typechecking all of std (#236) 5 years ago
.gitattributes start testing on GitHub Actions 6 years ago
.gitignore skip literals used in constant expressions 5 years ago
AUTHORS set up an AUTHORS file to attribute copyright 5 years ago
CONTRIBUTING.md CONTRIBUTING: include some basic terminology (#188) 5 years ago
LICENSE set up an AUTHORS file to attribute copyright 5 years ago
README.md README: document how to use different Go versions (#229) 5 years ago
bench_test.go obfuscate unexported names like exported ones (#227) 5 years ago
go.mod make -coverprofile include toolexec processes (#216) 5 years ago
go.sum make -coverprofile include toolexec processes (#216) 5 years ago
hash.go better document and position the hash base64 encoding (#234) 5 years ago
import_obfuscation.go make the handling of import paths more robust 5 years ago
line_obfuscator.go initial support for reversing panic output (#225) 5 years ago
main.go support typechecking all of std (#236) 5 years ago
main_test.go remove unused test cmds (#226) 5 years ago
reverse.go reverse: support unexported names and package paths (#233) 5 years ago
runtime_strip.go Replaced asthelper.Ident with ast.NewIdent 5 years ago
shared.go support typechecking all of std (#236) 5 years ago

README.md

garble

GO111MODULE=on go get mvdan.cc/garble

Obfuscate Go code by wrapping the Go toolchain. Requires Go 1.15.x; note that support for Go 1.16 is a work in progress.

garble build [build flags] [packages]

See garble -h for up to date usage information.

Purpose

Produce a binary that works as well as a regular build, but that has as little information about the original source code as possible.

The tool is designed to be:

  • Coupled with cmd/go, to support modules and build caching
  • Deterministic and reproducible, given the same initial source code
  • Reversible given the original source, to deobfuscate panic stack traces

Mechanism

The tool wraps calls to the Go compiler and linker to transform the Go build, in order to:

  • Replace as many useful identifiers as possible with short base64 hashes
  • Replace package paths with short base64 hashes
  • Remove all build and module information
  • Strip filenames and shuffle position information
  • Strip debugging information and symbol tables
  • Obfuscate literals, if the -literals flag is given
  • Remove extra information if the -tiny flag is given

Options

By default, the tool obfuscates the packages under the current module. If not running in module mode, then only the main package is obfuscated. To specify what packages to obfuscate, set GOPRIVATE, documented at go help module-private.

Note that commands like garble build will use the go version found in your $PATH. To use different versions of Go, you can install them and set up $PATH with them. For example, for Go 1.15.8:

$ go get golang.org/dl/go1.15.8
$ go1.15.8 download
$ PATH=$(go1.15.8 env GOROOT)/bin:${PATH} garble build

You can also declare a function to make multiple uses simpler:

$ withgo() {
        local gocmd=go${1}
        shift

        PATH=$(${gocmd} env GOROOT)/bin:${PATH} "$@"
}
$ withgo 1.15.8 garble build

Caveats

Most of these can improve with time and effort. The purpose of this section is to document the current shortcomings of this tool.

  • Exported methods are never obfuscated at the moment, since they could be required by interfaces and reflection. This area is a work in progress.

  • Functions implemented outside Go, such as assembly, aren't obfuscated since we currently only transform the input Go source.

  • Go plugins are not currently supported; see #87.

  • There are cases where garble is a little too agressive with obfuscation, this may lead to identifiers getting obfuscated which are needed for reflection, e.g. to parse JSON into a struct; see #162. To work around this you can pass a hint to garble, that an type is used for reflection via passing it to reflect.TypeOf or reflect.ValueOf in the same file:

    // this is used for parsing json
    type Message struct {
        Command string
        Args    string
    }
    
    // never obfuscate the Message type
    var _ = reflect.TypeOf(Message{})
    

Tiny Mode

When the -tiny flag is passed, extra information is stripped from the resulting Go binary. This includes line numbers, filenames, and code in the runtime the prints panics, fatal errors, and trace/debug info. All in all this can make binaries 6-10% smaller in our testing.

Note: if -tiny is passed, no panics, fatal errors will ever be printed, but they can still be handled internally with recover as normal. In addition, the GODEBUG environmental variable will be ignored.

Contributing

We actively seek new contributors, if you would like to contribute to garble use the CONTRIBUTING.md as a starting point.