No Symbols When Reversing? No Problem: Bring Your Own

Overview

Opening an unknown file and facing hundreds of unfamiliar functions can make analysis slow and tedious, often leading to missed malware insights. This talk will present a proven method for efficiently handling thousands of unknown functions, using the Golang-based qBit family as an example. While focused on Ghidra, this approach is applicable to other tools. We’ll cover creating and using FunctionID and BSim databases to generate portable symbols that streamline analysis. This method benefits both individual researchers and larger teams, scaling well for collaborative efforts. The talk will include a dataset of symbols for Golang binaries and provide access to the discussed scripts and databases.