drosseau / degob

Go library/tool for viewing and reversing Go gob data [Moved to GitLab]

degob

degob is a reversing tool for gobs. If you have the binary form of a gob, but you don't have to struct to decode it into, this library still allows you to get a more readable representation of the data.

cmds/degob

The easiest way to use all of this is to just build the binary in cmds/degob and send gobs to it either through stdin or from files and then get the output to stdout or to a file. See its README for more info.

Setting environmental variable DEGOB_NORAND=1 will stop the anonymous structs from having that hex suffix. The number stays because that is the type ID defined in the gob. DEGOB_SEED sets a specific seed value.

Usage

Create a new Decoder over your reader using NewDecoder and then decode that into a slice of Gobs with Decode or stream Gobs with DecodeStream. DecodeStream seems fairly stable, but it was difficult to test how it handles all error cases, so be wary of errors. Once you have Gobs you can either play with the types directly or just print them out to a writer using the WriteTypes and WriteValues methods.

The output from the Write methods on Gob should be close to valid Go source.

The provided degob command provides a straightforward sample usage.

Limitations

There are a few limitations that I can't really get around.

• gobs don't include information about the bit size of the type so all types are their largest possible (int64, uint64, complex128, float64) so as to be able to accept anything. This means that the representations you get aren't exactly the representations that the source was using with respect to bitsizes.
• bytes are received as uint64, but []byte is correct. There is no type id for a single byte in the gob format.
• There is no way to differentiate between a type and a pointer to that type.
• There is an included JSON output format, but, since a gob can be any valid Go type, there are plenty of valid gobs that cannot be accurately represented as JSON. Simple types will not print valid JSON. Bad map types will return an error JSON that contains the SingleLine format of the map under val.
• GobEncoder, TextEncoder, and BinaryMarshaler are all displayed as []byte since the format is opaque without the actual type definition.

TODO

• Printing stylized output
• Some more testing (I'm around ~80%)
• Include more "bad gob" tests, but to be honest this tool shouldn't be seeing very many bad gobs. It isn't really meant to be doing much validating, so this is pretty low priority, and part of the reason I'm OK with some of the panics and lack of testing around bad gobs.

degob's Issues

Degobbing struct with time.Time doesn't seem to work

This gob doesn't decode:

00000000  3e ff 81 03 01 01 0b 55  73 65 72 53 65 73 73 69  |>......UserSessi|
00000010  6f 6e 01 ff 82 00 01 03  01 08 55 73 65 72 6e 61  |on........Userna|
00000020  6d 65 01 0c 00 01 07 49  73 41 64 6d 69 6e 01 02  |me.....IsAdmin..|
00000030  00 01 06 49 73 73 75 65  64 01 ff 84 00 00 00 10  |...Issued.......|
00000040  ff 83 05 01 01 04 54 69  6d 65 01 ff 84 00 00 00  |......Time......|
00000050  1f ff 82 01 09 61 6e 6f  6e 79 6d 6f 75 73 02 0f  |.....anonymous..|
00000060  01 00 00 00 0e d7 5e ce  8a 2e 16 ec 5c 00 3c 00  |......^.....\.<.|
00000070

type UserSession struct {
	Username string
	IsAdmin  bool
	Issued   time.Time
}

With the error
failed to decode gob: error: found unexpected delta value when trying to decode type after processing 68 bytes

But this one does:

00000000  32 ff 81 03 01 01 0b 55  73 65 72 53 65 73 73 69  |2......UserSessi|
00000010  6f 6e 01 ff 82 00 01 02  01 08 55 73 65 72 6e 61  |on........Userna|
00000020  6d 65 01 0c 00 01 07 49  73 41 64 6d 69 6e 01 02  |me.....IsAdmin..|
00000030  00 00 00 0e ff 82 01 09  61 6e 6f 6e 79 6d 6f 75  |........anonymou|
00000040  73 00                                             |s.|
00000042

type UserSession struct {
	Username string
	IsAdmin bool
}