Golang execute child process from binary data in memory

Question

I know that it is possible to embed executables in Golang executables and run them, or run Golang code from a string using projects like Yaegi, but is it possible to run a binary stored as a variable without writing it to a file, as a child process? The binary is already in memory as a variable so is it possible to just execute it somehow?

If I'm not mistaken there is a difference between executable memory and data memory so would that prevent this from being done?

The reason for my question is that I'm writing a RAT/payload dropper as a project to learn Go(lang) and would like to make is as modular as possible, including file-less updates and binary (also file-less) payloads.

EDIT: Any solution is welcome, but cross-platform solutions are preferred.

EDIT2: According to this SO answer, this is not possible / very difficult in C++. Seemingly, the main reason for this is dynamically linking libraries. As Golang is statically linked, would this be any easier?

I'm not sure what the cause of the downvote is. I believe this is a legitimate question which I have researched beforehand. I have linked similar questions too which do not quite answer my question and added a further question to highlight the difference. Can I have some constructive criticism? — user9123
– user9123, Commented May 4, 2020 at 14:49
Take a look at eli.thegreenplace.net/2013/11/05/how-to-jit-an-introduction -- you could do all that with Go using syscalls or cgo. Running Go code like that is trickier, though, since it would need load-time relocation/linking, etc. — Eli Bendersky
– Eli Bendersky, Commented May 6, 2020 at 12:29
@EliBendersky I certainly will. Just from a quick glance it looks pretty interesting and useful. Thanks! — user9123
– user9123, Commented May 6, 2020 at 15:09

opensource · Accepted Answer · 2021-03-13 02:28:19Z

2

Yes, try this way to do this. https://github.com/amenzhinsky/go-memexec

answered Mar 13, 2021 at 2:28

opensource

7588 silver badges11 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

user9123 Over a year ago

Thanks for the answer! Unfortunately, it seems like that project actually creates a temporary file and executes it as opposed to using what's already in memory :(

Helyrk Over a year ago

As of version 0.5.0, the author of go-memexec has updated behavior (for Linux) to mount allocated memory as a process instead of creating a temporary file.

Volker · Accepted Answer · 2020-05-04 13:36:07Z

1

No, there is no portable way to do this.

answered May 4, 2020 at 13:36

Volker

42.6k8 gold badges86 silver badges97 bronze badges

5 Comments

user9123 Over a year ago

Thanks for your answer. You seem to imply that there are non-portable ways to do it though. Is that the case?

Volker Over a year ago

@TR_SLimey Yes.

user9123 Over a year ago

Could you give some examples, like some links or keywords to search for? While single-platform code is not ideal I am doing this mainly to learn the language so it would still be helpful.

Volker Over a year ago

@TR_SLimey You are not going to learn anything about the language while using syscalls and cgo.

user9123 Over a year ago

I take it that means I should look at how to do that in C and then use Cgo? Thanks.

Collectives™ on Stack Overflow

Golang execute child process from binary data in memory

2 Answers 2

2 Comments

5 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

5 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related