{"id":27775764,"url":"https://github.com/mdsakibanwar/gosonar","last_synced_at":"2026-04-29T00:32:19.598Z","repository":{"id":290257161,"uuid":"973834667","full_name":"mdsakibanwar/gosonar","owner":"mdsakibanwar","description":"Binary symbolic execution for detecting uncontrolled recursion in Go binaries. Published at IEEE S\u0026P 2025.","archived":false,"fork":false,"pushed_at":"2025-04-29T12:42:31.000Z","size":7281,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-30T04:34:16.719Z","etag":null,"topics":["angr","go","golang","security","security-tools","symbolic-execution"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mdsakibanwar.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-04-27T20:43:09.000Z","updated_at":"2025-04-29T12:42:36.000Z","dependencies_parsed_at":"2025-04-30T04:40:03.322Z","dependency_job_id":null,"html_url":"https://github.com/mdsakibanwar/gosonar","commit_stats":null,"previous_names":["mdsakibanwar/gosonar"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/mdsakibanwar/gosonar","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mdsakibanwar%2Fgosonar","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mdsakibanwar%2Fgosonar/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mdsakibanwar%2Fgosonar/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mdsakibanwar%2Fgosonar/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mdsakibanwar","download_url":"https://codeload.github.com/mdsakibanwar/gosonar/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mdsakibanwar%2Fgosonar/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32405901,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-28T19:38:08.556Z","status":"ssl_error","status_checked_at":"2026-04-28T19:37:55.688Z","response_time":56,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["angr","go","golang","security","security-tools","symbolic-execution"],"created_at":"2025-04-30T04:21:41.545Z","updated_at":"2026-04-29T00:32:19.569Z","avatar_url":"https://github.com/mdsakibanwar.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n🛡️ **GoSonar**\n\n**Binary Symbolic Execution for Go Binaries**  \n*Detect and verify uncontrolled recursions with ease.*\n\n![Docker Pulls](https://img.shields.io/docker/pulls/sakibanwar/gosonar?style=flat-square)\n![License](https://img.shields.io/github/license/mdsakibanwar/gosonar?style=flat-square)\n![Issues](https://img.shields.io/github/issues/mdsakibanwar/gosonar?style=flat-square)\n![Stars](https://img.shields.io/github/stars/mdsakibanwar/gosonar?style=flat-square)\n\u003c/div\u003e\n\n---\n\n## 🚀 Overview\n\n**GoSonar** is a tool for *binary symbolic execution* designed to detect **uncontrolled recursions** in Go binaries. This project is based on the research presented in the paper [\"GoSonar: Detecting Logical Vulnerabilities in Memory Safe Languages Using Inductive Constraint Reasoning\"](https://www.computer.org/csdl/proceedings-article/sp/2025/223600a043/21B7QweuVUs), published at IEEE S\u0026P 2025.\n\nGoSonar offers two primary modes for analysis:\n- **Regular Mode**: Direct binary analysis.\n- **Call Resolver Mode**: Source-assisted AST parsing to resolve indirect calls.\n\n\u003e 💬 *Recommended usage: Deploy via Docker container for optimal convenience.*\n\n---\n\n## 🐳 Quick Start\n\n### 1. Pull \u0026 Run the Docker Image\n\n```bash\ndocker run -it sakibanwar/gosonar bash\n```\n\n---\n\n### 2. Project Structure\n\n| Directory  | Purpose                         |\n|------------|----------------------------------|\n| `src/`     | Main source code.                |\n| `bins/`    | Binaries + source for benchmarks and stdlib. |\n| `db/`      | SQLite databases for analysis results. |\n| `logs/`    | Logs of each execution run.       |\n\n---\n\n### 3. Running an Analysis\n\n- Easiest way:  \n  ```bash\n  cd gosonar\n  ./run.sh # runs benchmark\n  ./run.sh \u003cpackage\u003e # runs package analysis assumes binary under go_stdlib in regular mode\n  ./run.sh \u003cpackage\u003e call # runs package analysis assumes binary under go_stdlib in call resolver mode\n  ```\n\n- Or manually:  \n  ```bash\n  cd src/\n  python3 main.py --worker-type \u003ctype\u003e --binary \u003cbinary_path\u003e --package \u003cpackage_name\u003e [other options]\n  ```\n\n---\n\n### 4. Compiling Benchmarks\n\nEach subdirectory under `bins/` has a `compile.sh` to build binaries:  \n```bash\ncd bins/benchmark/src\n./compile.sh\n```\n\n---\n\n## ⚙️ Modes of Operation\n\n| Mode              | Description                                          |\n|-------------------|------------------------------------------------------|\n| Regular Mode      | Pure binary analysis.                                |\n| Call Resolver Mode| Needs source code access. AST parsing for better call graph resolution. |\n\n---\n\n## 🗄️ Database and Logs\n\n- **Databases** are saved inside `db/` folder (separate DB for each mode).\n- **Logs** are saved under `logs/` and named:  \n  ```\n  \u003cbinary\u003e_\u003cworker\u003e_\u003cmode\u003e_\u003ctimestamp\u003e.log\n  ```\n\n---\n\n## 🛠️ Command-Line Arguments\n\n### Required\n- `--worker-type` : Specifies the worker type (**mandatory**).\n\n### At Least One Required\n- `--package` : Target Go package.\n- `--binary` : Path to binary file.\n\n### Optional\n- `--mode` : Running mode (`regular`, `callresolver`, etc.).  \n- `--loglevel` : Logging level (`default: TRACE`).  \n- `--target-func` : Analyze a specific function.  \n- `--stop-addresses` : Addresses to stop execution at.  \n- `--cycle-size` : Cycle size limit (`default: 5`).  \n- `--db` : Target database.  \n- `--recursion-limit` : Max recursion depth (`default: 3`).  \n- `--db-id-start` : Starting database row (`default: 0`).  \n- `--db-amount` : Number of rows to process (`default: 250`).  \n- `--no-prune-callgraph` : Disable call graph pruning.  \n- `--bypass-db` : Skip database operations.  \n- `--timeout` : Analysis timeout (`default: 600s`).\n\n---\n\n## 📜 License\n\nThis project is licensed under the [GPL-3.0](LICENSE).\n\n---\n\n## ✨ Contributions\n\nPull requests are welcome!  \nFor major changes, please open an issue first to discuss what you would like to change.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmdsakibanwar%2Fgosonar","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmdsakibanwar%2Fgosonar","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmdsakibanwar%2Fgosonar/lists"}