struct LIBCALL {DWORD_PTR Addr;DWORD Argc;DWORD_PTR Argv;DWORD_PTR ReturnValue;[...]}git clone https://github.com/leandrofroes/gftrace.git1、确保gftrace.exe、gftrace.dll和gftrace.cfg位于同一目录中； 2、在gftrace.cfg文件中指定要跟踪的API函数（如果不应用API过滤器，该工具将无法工作）； 3、运行gftrace.exe，并将目标Golang程序路径作为参数传递；
gftrace.exe <filepath> <params>CreateFileW,ReadFile,CreateProcessW- CreateFileW("C:UsersuserDesktopdoc.txt", 0x80000000, 0x3, 0x0, 0x3, 0x1, 0x0) = 0x168 (360)- ReadFile(0x168, 0xc000108000, 0x200, 0xc000075d64, 0x0) = 0x1 (1)- CreateFileW("C:UsersuserDesktopdoc2.txt", 0x80000000, 0x3, 0x0, 0x3, 0x1, 0x0) = 0x168 (360)- ReadFile(0x168, 0xc000108200, 0x200, 0xc000075d64, 0x0) = 0x1 (1)- CreateProcessW("C:WINDOWSSystem32WindowsPowerShellv1.0powershell.exe", "powershell /c "Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn; Get-Recipient | Select Name -ExpandProperty EmailAddresses -first 1 | Select SmtpAddress | ft -hidetableheaders"", 0x0, 0x0, 0x1, 0x80400, "=C:=C:UsersuserDesktop", 0x0, 0xc0000ace98, 0xc0000acd68) = 0x1 (1)- CreateProcessW("C:WINDOWSSystem32WindowsPowerShellv1.0powershell.exe", "powershell /c "Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn; Get-Recipient | Select Name -ExpandProperty EmailAddresses -first 1 | Select SmtpAddress | ft -hidetableheaders"", 0x0, 0x0, 0x1, 0x80400, "=C:=C:UsersuserDesktop", 0x0, 0xc0000c4ec8, 0xc0000c4d98) = 0x1 (1)- CreateProcessW("C:WINDOWSSystem32WindowsPowerShellv1.0powershell.exe", "powershell /c "Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn; Get-Recipient | Select Name -ExpandProperty EmailAddresses -first 1 | Select SmtpAddress | ft -hidetableheaders"", 0x0, 0x0, 0x1, 0x80400, "=C:=C:UsersuserDesktop", 0x0, 0xc00005eec8, 0xc00005ed98) = 0x1 (1)- CreateProcessW("C:WINDOWSSystem32WindowsPowerShellv1.0powershell.exe", "powershell /c "Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn; Get-Recipient | Select Name -ExpandProperty EmailAddresses -first 1 | Select SmtpAddress | ft -hidetableheaders"", 0x0, 0x0, 0x1, 0x80400, "=C:=C:UsersuserDesktop", 0x0, 0xc0000bce98, 0xc0000bcd68) = 0x1 (1)- CreateProcessW("C:WINDOWSsystem32cmd.exe", "cmd /c "wmic computersystem get domain"", 0x0, 0x0, 0x1, 0x80400, "=C:=C:UsersuserDesktop", 0x0, 0xc0000c4ef0, 0xc0000c4dc0) = 0x1 (1)- CreateProcessW("C:WINDOWSsystem32cmd.exe", "cmd /c "wmic computersystem get domain"", 0x0, 0x0, 0x1, 0x80400, "=C:=C:UsersuserDesktop", 0x0, 0xc0000acec0, 0xc0000acd90) = 0x1 (1)- CreateProcessW("C:WINDOWSsystem32cmd.exe", "cmd /c "wmic computersystem get domain"", 0x0, 0x0, 0x1, 0x80400, "=C:=C:UsersuserDesktop", 0x0, 0xc0000bcec0, 0xc0000bcd90) = 0x1 (1)[...]- CreateFileW("config.dat.tmp", 0x80000000, 0x3, 0x0, 0x3, 0x1, 0x0) = 0xffffffffffffffff (-1)- CreateFileW("config.dat.tmp", 0xc0000000, 0x3, 0x0, 0x2, 0x80, 0x0) = 0x198 (408)- CreateFileW("config.dat.tmp", 0xc0000000, 0x3, 0x0, 0x3, 0x80, 0x0) = 0x1a4 (420)- WriteFile(0x1a4, 0xc000112780, 0xeb, 0xc0000c79d4, 0x0) = 0x1 (1)- GetAddrInfoW("reyweb.com", 0x0, 0xc000031f18, 0xc000031e88) = 0x0 (0)- WSASocketW(0x2, 0x1, 0x0, 0x0, 0x0, 0x81) = 0x1f0 (496)- WSASend(0x1f0, 0xc00004f038, 0x1, 0xc00004f020, 0x0, 0xc00004eff0, 0x0) = 0x0 (0)- WSARecv(0x1f0, 0xc00004ef60, 0x1, 0xc00004ef48, 0xc00004efd0, 0xc00004ef18, 0x0) = 0xffffffff (-1)- GetAddrInfoW("reyweb.com", 0x0, 0xc000031f18, 0xc000031e88) = 0x0 (0)- WSASocketW(0x2, 0x1, 0x0, 0x0, 0x0, 0x81) = 0x200 (512)- WSASend(0x200, 0xc00004f2b8, 0x1, 0xc00004f2a0, 0x0, 0xc00004f270, 0x0) = 0x0 (0)- WSARecv(0x200, 0xc00004f1e0, 0x1, 0xc00004f1c8, 0xc00004f250, 0xc00004f198, 0x0) = 0xffffffff (-1)[...]- WSASocketW(0x2, 0x1, 0x0, 0x0, 0x0, 0x81) = 0x130 (304)- setsockopt(0x130, 0xffff, 0x20, 0xc0000b7838, 0x4) = 0xffffffff (-1)- socket(0x2, 0x1, 0x6) = 0x138 (312)- WSAIoctl(0x138, 0xc8000006, 0xaf0870, 0x10, 0xb38730, 0x8, 0xc0000b746c, 0x0, 0x0) = 0x0 (0)- GetModuleFileNameW(0x0, "C:UsersuserDesktopsamplesdeimos.exe", 0x400) = 0x2f (47)- GetUserProfileDirectoryW(0x140, "C:Usersuser", 0xc0000b7a08) = 0x1 (1)- LookupAccountSidw(0x0, 0xc00000e250, "user", 0xc0000b796c, "DESKTOP-TEST", 0xc0000b7970, 0xc0000b79f0) = 0x1 (1)- NetUserGetInfo("DESKTOP-TEST", "user", 0xa, 0xc0000b7930) = 0x0 (0)- GetComputerNameExW(0x5, "DESKTOP-TEST", 0xc0000b7b78) = 0x1 (1)- GetAdaptersAddresses(0x0, 0x10, 0x0, 0xc000120000, 0xc0000b79d0) = 0x0 (0)- CreateToolhelp32Snapshot(0x2, 0x0) = 0x1b8 (440)- GetCurrentProcessId() = 0x2584 (9604)- GetCurrentDirectoryW(0x12c, "C:UsersuserAppDataLocalProgramsretoolkitbin") = 0x39 (57)[...]原文始发于微信公众号（FreeBuf）：gftrace：一款针对Golang源码的Windows API跟踪工具
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论