mirror of
https://github.com/praetorian-inc/wasmforge
synced 2026-06-22 22:52:31 +00:00
Michael Weber
75 lines
3.3 KiB
Markdown
75 lines
3.3 KiB
Markdown
# Ghost Binary Profiling
|
|
|
|
Ghost profiling replaces WasmForge's `gopclntab` function, type, and package names with names harvested from real enterprise Go binaries. ML classifiers that analyze `gopclntab` string patterns see function distributions identical to known-good software (Traefik, Caddy, Terraform) instead of synthetic random names.
|
|
|
|
## Embedded Profiles
|
|
|
|
WasmForge ships with three profiles built in:
|
|
|
|
| Profile | Symbols | Packages | Source |
|
|
| ------------ | ------- | -------- | ------------------------------------------------------------------------- |
|
|
| `traefik` | 154,681 | 3,083 | [Traefik](https://github.com/traefik/traefik) reverse proxy |
|
|
| `terraform` | 91,253 | 1,392 | [Terraform](https://github.com/hashicorp/terraform) IaC tool |
|
|
| `caddy` | 42,423 | 749 | [Caddy](https://github.com/caddyserver/caddy) web server |
|
|
|
|
`traefik` is recommended for the lowest VirusTotal detection rates because of its symbol density and package breadth.
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
# Use Traefik's gopclntab profile (recommended)
|
|
wasmforge build --ghost traefik --win32-apis -o app.exe ./myproject
|
|
|
|
# Use Caddy or Terraform profiles
|
|
wasmforge build --ghost caddy --win32-apis -o app.exe ./myproject
|
|
wasmforge build --ghost terraform --win32-apis -o app.exe ./myproject
|
|
|
|
# Random profile per build (default when --ghost is omitted)
|
|
wasmforge build --win32-apis -o app.exe ./myproject
|
|
```
|
|
|
|
## What Ghost Profiling Affects
|
|
|
|
When `--ghost <name>` is set, the profile drives:
|
|
|
|
- Module name and import paths
|
|
- Package paths in `gopclntab`
|
|
- Function, method, and type names in `gopclntab`
|
|
- Dead code package content (filler packages added for symbol density)
|
|
- All polymorphic identifier renames
|
|
|
|
The wazero fork identity scrubbing, WASM opcode permutation, and PE hardening are independent build-time layers and are always active regardless of profile choice.
|
|
|
|
## Generating Custom Profiles
|
|
|
|
You can build a profile from any Go binary you have access to:
|
|
|
|
```bash
|
|
go run ./cmd/gen-ghost-profile \
|
|
-binary /path/to/any-go-binary \
|
|
-name myprofile \
|
|
-out internal/build/ghost_profiles/
|
|
```
|
|
|
|
The tool extracts `gopclntab` symbols, normalizes package/function/type names, deduplicates, and writes a profile file that gets embedded into the wasmforge binary on the next build.
|
|
|
|
After generating a profile, rebuild wasmforge:
|
|
|
|
```bash
|
|
go build -o wasmforge ./cmd/wasmforge
|
|
./wasmforge build --ghost myprofile --win32-apis -o app.exe ./myproject
|
|
```
|
|
|
|
## Choosing a Profile
|
|
|
|
- **Highest evasion (Windows targets):** `traefik` — large symbol set, broad package distribution, mirrors a real enterprise reverse-proxy binary
|
|
- **Smaller payload influence:** `caddy` — fewer symbols, smaller fingerprint
|
|
- **Cloud / DevOps cover:** `terraform` — useful when the deployment context is a developer or DevOps workstation
|
|
- **Custom cover identity:** generate a profile from a binary that fits the target environment (e.g., a vendor-specific tool already deployed on the target host)
|
|
|
|
## Related Documentation
|
|
|
|
- [Main README](../README.md) — quick start and feature overview
|
|
- [CSHARP.md](./CSHARP.md) — .NET / C# project compilation
|
|
- [MACOS.md](./MACOS.md) — macOS framework bridge and Apple targets
|