{
  "schema": "sosec.go-binary-protection.public-receipt.v1",
  "frozen_at": "2026-07-24T23:20:00+08:00",
  "status_refreshed_at": "2026-07-26T07:00:00+08:00",
  "purpose": "A sanitized, public evidence ledger for the SOSEC Go binary protection study. It contains pinned build identities, representative command templates, control definitions, measured observations, market-census boundaries, and limitations. It contains no authorization bypass, patch offset, reusable machine-code signature, vendor package, license, or private fixture source.",
  "experiment_scope": {
    "platform": "windows/amd64",
    "os_build": "Microsoft Windows NT 10.0.26200.0",
    "go_version": "go1.26.5",
    "fixture": "A small Ed25519-signed entitlement verifier with fixed time and inputs.",
    "artifact_states": 14,
    "controls_per_artifact": 10,
    "expected_control_results": 140,
    "measured_surfaces": [
      "exact exit code and stdout/stderr behavior",
      "selected ASCII and UTF-16 marker visibility",
      "Go-aware function, type, string, module, and build-info recovery",
      "one Delve source-name breakpoint workflow",
      "official UPX unpacking and restored analysis surface",
      "inner-helper and caller-side control-flow placement",
      "two rotating-order startup and hot-path runs",
      "fresh-cache reproducibility"
    ],
    "excluded": [
      "active modification of authorization outcomes",
      "exact patch locations",
      "reusable machine-code signatures",
      "integrity-data recalculation",
      "licensed commercial virtualization on the controlled fixture",
      "Linux, macOS, and ARM execution",
      "a large production application",
      "current real-time endpoint-security compatibility",
      "analyst-hours or time-to-bypass measurement"
    ]
  },
  "pinned_tools": [
    {
      "name": "Go",
      "version": "1.26.5",
      "source": "https://go.dev/dl/",
      "role": "compiler and linker"
    },
    {
      "name": "Garble",
      "version": "v0.16.0",
      "commit": "60a6019f196ece4da360038f905b6c154426a64a",
      "tool_sha256": "5C5C2A781C6F46D0BFE573FA3D938E472D911568916D7837BB6C0DAA975FAF4D",
      "source": "https://github.com/burrowers/garble/releases/tag/v0.16.0",
      "role": "Go-aware name, path, literal, tiny, and experimental control-flow transformations"
    },
    {
      "name": "gostrip",
      "commit": "df648e23621cec5bf8b01cb6696dd2afd3ef01d3",
      "tool_sha256": "E1350FD9A6970DA4741232E73D99208E57B2B8005DB3BC15CCFB89187749830F",
      "source": "https://github.com/idaifish/gostrip",
      "role": "narrow post-link pclntab and build-info processing"
    },
    {
      "name": "Aurum-OBF",
      "commit": "9d703c54c923ea7d313c4a2876387723d3b932a1",
      "tool_sha256": "33B89EF47469E9933200661F331BB161856E58A05DDC8847499316B8A079F47A",
      "source": "https://github.com/adjisoft/aurum-obf",
      "role": "experimental Windows targeted-string and overlay processing"
    },
    {
      "name": "UPX",
      "version": "5.2.0",
      "commit": "034b6d0",
      "release_archive_sha256": "B471EBF1B7F20F4A89150264ED9A008A2A5BFD247F3C6D1184A75BB59CA08F5D",
      "tool_sha256": "F4C0CC7ACA0F1FF0D0B750E966B44139F2FA1A2DB7281F48FC52194400712E1D",
      "source": "https://github.com/upx/upx/releases/tag/v5.2.0",
      "role": "compression and official-unpacking control"
    },
    {
      "name": "GoReSym",
      "version": "v1.7.2-0.20260701202802-157cabbafb9c",
      "tool_sha256": "3C31A79B34734938550C17B5E593ED288025D4D0E69F1114AFD2D564C6F60F28",
      "source": "https://github.com/mandiant/GoReSym",
      "role": "Go-aware metadata recovery"
    },
    {
      "name": "Redress",
      "version": "v1.2.78",
      "tool_sha256": "B549AE956EF9B0D5D93D5EA6015BEBD3D2CFC8E99380884E0C663FF0D980B668",
      "source": "https://github.com/goretk/redress",
      "role": "Go build and symbol context recovery"
    },
    {
      "name": "Delve",
      "version": "v1.27.0",
      "commit": "0782d3511ee64ac561a207d35b3403f49d3744a6",
      "tool_sha256": "816FE108BF6A7C57362C817F1BDBD72D23671E615DF3D7CEE6BAF0650D5E92D0",
      "source": "https://github.com/go-delve/delve",
      "role": "one controlled source-name breakpoint and launch workflow"
    }
  ],
  "reproduction_commands": {
    "plain": "go build -buildvcs=false -trimpath -ldflags \"-buildid=\" -o <output> .",
    "stripped": "go build -buildvcs=false -trimpath -ldflags \"-s -w -buildid=\" -o <output> .",
    "garble_base": "garble -seed=<stored-base64-seed> build -trimpath -buildvcs=false -ldflags \"-buildid=\" -o <output> .",
    "garble_literals": "garble -seed=<stored-base64-seed> -literals build -trimpath -buildvcs=false -ldflags \"-buildid=\" -o <output> .",
    "garble_tiny": "garble -seed=<stored-base64-seed> -tiny build -trimpath -buildvcs=false -ldflags \"-buildid=\" -o <output> .",
    "garble_controlflow_note": "Control-flow is experimental in v0.16.0. Set GARBLE_EXPERIMENTAL_CONTROLFLOW=1 and add //garble:controlflow only to the selected function. The measured parameters were block_splits=4 junk_jumps=16 flatten_passes=2. This is POC-only, not the production default.",
    "upx_pack": "upx --best --lzma <trusted-input>",
    "upx_unpack": "upx -d <packed-input>",
    "gostrip": "gostrip -o <output> <input>",
    "operational_order": [
      "build an ordinary reference artifact",
      "apply source and compiler-stage transformations",
      "apply any justified post-link or commercial protection",
      "run every positive and negative entitlement control",
      "measure startup, hot path, crash, update, and endpoint behavior",
      "apply the final platform signature",
      "record hashes, seed or project, mappings, and rollback artifact"
    ]
  },
  "entitlement_controls": [
    {
      "name": "valid",
      "expected_exit": 0,
      "expected_result": "premium operation allowed"
    },
    {
      "name": "bad_signature",
      "expected_exit": 3,
      "expected_result": "denied"
    },
    {
      "name": "expired",
      "expected_exit": 3,
      "expected_result": "denied"
    },
    {
      "name": "wrong_product",
      "expected_exit": 3,
      "expected_result": "denied"
    },
    {
      "name": "wrong_feature",
      "expected_exit": 3,
      "expected_result": "denied"
    },
    {
      "name": "empty_customer",
      "expected_exit": 3,
      "expected_result": "denied"
    },
    {
      "name": "signed_invalid_json",
      "expected_exit": 3,
      "expected_result": "denied"
    },
    {
      "name": "damaged_envelope",
      "expected_exit": 3,
      "expected_result": "denied"
    },
    {
      "name": "damaged_base64",
      "expected_exit": 3,
      "expected_result": "denied"
    },
    {
      "name": "missing_file",
      "expected_exit": 2,
      "expected_result": "input error"
    }
  ],
  "artifacts": [
    {
      "name": "plain-current",
      "bytes": 3626496,
      "sha256": "DDD2199ABC18A596745CB63D9E917A16E4FF96ED4A674CFC1F50644FAC2E18C7",
      "controls_passed": 10,
      "selected_marker_hits": 7
    },
    {
      "name": "stripped-current",
      "bytes": 2492928,
      "sha256": "A4E659BA9258B6FAD27FEFFA4394F1E3B153E986E131D8BE1700588C14BE12D8",
      "controls_passed": 10,
      "selected_marker_hits": 7
    },
    {
      "name": "garble-base-current",
      "bytes": 2678272,
      "sha256": "681D59CB0E164BEE547DBDCBA0A4126A86ADB772CEB56D1E882512409EAB616F",
      "controls_passed": 10,
      "selected_marker_hits": 3
    },
    {
      "name": "garble-literals-current",
      "bytes": 5578752,
      "sha256": "73484826632F9E02A14F0C2A5A2F2F7F57263ABE36A7C9AE190F014ED2BFD98E",
      "controls_passed": 10,
      "selected_marker_hits": 0
    },
    {
      "name": "garble-tiny-only-current",
      "bytes": 2311680,
      "sha256": "C1B91B596908F6BF6AD3104AE9FA76E309662571B29DE5A792CB7D5A2DC65227",
      "controls_passed": 10,
      "selected_marker_hits": 3
    },
    {
      "name": "garble-literals-tiny-current",
      "bytes": 4988416,
      "sha256": "692EFAB974BE2FB9A5ADEE6EFB0113D90D22CE501BC05BFF41240FEDC468AEC0",
      "controls_passed": 10,
      "selected_marker_hits": 0
    },
    {
      "name": "garble-controlflow-inner-current",
      "bytes": 4970496,
      "sha256": "0166E31ECF5146990F24CE3CBDF3D95B262F00337C9D3156DF5AA26109F4F6E9",
      "controls_passed": 10,
      "selected_marker_hits": 0,
      "status": "experimental POC"
    },
    {
      "name": "garble-controlflow-inner-caller-current",
      "bytes": 4985344,
      "sha256": "EBA1C41D35DF3004C51AA8D2AEE163088CEF4E018CB40044C01563E0171079C1",
      "controls_passed": 10,
      "selected_marker_hits": 0,
      "status": "experimental POC; fresh-cache hash drift observed"
    },
    {
      "name": "stripped-upx-5.2.0-current",
      "bytes": 828416,
      "sha256": "164F418FB4E4A66A38E065ED0F16C54997AC11C10F83B9E0645624B7730C9C25",
      "controls_passed": 10,
      "selected_marker_hits": 0
    },
    {
      "name": "garble-literals-upx-5.2.0-current",
      "bytes": 1647104,
      "sha256": "766971C9B05388118BD9FA59AC850ADC3991640D157EA45F608C448274280C1F",
      "controls_passed": 10,
      "selected_marker_hits": 0
    },
    {
      "name": "stripped-upx-5.2.0-unpacked",
      "bytes": 2492928,
      "sha256": "7C9B57A74591351CCDCEB0E6FB392AFA688F092032E875C7CADAC963E1CF1191",
      "controls_passed": 10,
      "selected_marker_hits": 7
    },
    {
      "name": "garble-literals-upx-5.2.0-unpacked",
      "bytes": 5578752,
      "sha256": "AC7207A5D60629BE7543C499FB93A604000A880078747161A8D5905E3C206925",
      "controls_passed": 10,
      "selected_marker_hits": 0
    },
    {
      "name": "gostrip-clean-commit",
      "bytes": 2492928,
      "sha256": "4F34F12389757A9C6A96DD10B324C3047860C208397747B81D59AF96525C4DE1",
      "controls_passed": 10,
      "selected_marker_hits": 4
    },
    {
      "name": "aurum-max-clean-commit",
      "bytes": 2501717,
      "sha256": "3CA56B82869FA5B8503B9DA18E32B02797F847A4570A8035FEB15E563022440D",
      "controls_passed": 10,
      "selected_marker_hits": 4
    }
  ],
  "analysis_observations": {
    "plain": {
      "goresym_go_version": "1.26.5",
      "user_functions": 373,
      "standard_library_functions_approx": 2361,
      "types": 11943,
      "strings": 1025,
      "delve_named_breakpoint": "set and hit; source line and arguments visible"
    },
    "stripped": {
      "size_reduction_percent": 31.3,
      "goresym_user_functions": 373,
      "goresym_types": 11943,
      "delve_named_breakpoint": "name lookup failed; controlled invalid entitlement still exited 3"
    },
    "garble_base": {
      "module_and_three_decision_name_direct_hits": 0,
      "goresym": "parser exited on this artifact",
      "redress": "parser exited on this artifact",
      "delve_named_breakpoint": "name lookup failed"
    },
    "garble_literals": {
      "selected_marker_hits": 0,
      "meaning": "cheap marker-led discovery changed; runtime recovery and manual analysis were not ruled out"
    },
    "upx": {
      "stripped_size_reduction_percent": 66.8,
      "official_unpack_result": "restored the stripped artifact's Go version, function count, type count, string count, module path, and three decision names without restoring the original file hash",
      "delve_packed_launch": "Delve returned a launch workflow error for both packed artifacts; this is a workflow boundary, not proof that runtime debugging is unavailable"
    },
    "gostrip": {
      "result": "current GoReSym exited and Redress did not recover the module root; runtime names intentionally remained where the implementation required them"
    },
    "aurum": {
      "result": "three targeted plaintext values were rewritten; GoReSym still recovered 376 user functions, 11943 types, the module path, and all three business-function names"
    }
  },
  "performance": {
    "method": "Two runs with rotated execution order. Each hot-path variant received two warm-ups and 15 measured processes; each process verified 5000 valid entitlements. Startup received three warm-ups and 30 measured processes. The shared host was not isolated.",
    "baseline_hot_p50_microseconds": [
      59.73,
      76.4
    ],
    "stable_or_decision_relevant_results": [
      {
        "name": "garble-controlflow-inner-current",
        "hot_p50_delta_percent": [
          6.16,
          6.266
        ],
        "status": "experimental POC"
      },
      {
        "name": "garble-controlflow-inner-caller-current",
        "hot_p50_delta_percent": [
          29.803,
          13.196
        ],
        "status": "experimental POC; broader and more variable cost"
      },
      {
        "name": "stripped-upx-5.2.0-current",
        "startup_p50_multiple": [
          5.692,
          6.103
        ]
      },
      {
        "name": "garble-literals-upx-5.2.0-current",
        "startup_p50_multiple": [
          8.218,
          8.813
        ]
      }
    ],
    "interpretation": "Small or directionally inconsistent differences for the other variants do not support a performance ranking. Results are fixture- and host-specific."
  },
  "reproducibility": {
    "fresh_cache_identical": [
      "garble-base-current",
      "garble-literals-current",
      "garble-tiny-only-current",
      "garble-literals-tiny-current",
      "garble-controlflow-inner-current"
    ],
    "fresh_cache_drift": {
      "name": "garble-controlflow-inner-caller-current",
      "run1_sha256": "EBA1C41D35DF3004C51AA8D2AEE163088CEF4E018CB40044C01563E0171079C1",
      "run2_sha256": "3EE0849E473CFC6CD0C9CD3516861FEC7051BFD28EC75545D9392A82A145077B",
      "different_bytes": 4,
      "location": "runtime PC table in .rdata",
      "text_section_equal": true,
      "localization": "Repository-derived observation around declaration groups built through maps; no upstream confirmation."
    }
  },
  "market_census": {
    "search_date": "2026-07-24",
    "closure_rule": "Method families close when every attacker-workflow stage has an engineering mechanism, recovery route, product cost, and owner. The repository census is a dated candidate inventory, not a claim that every similarly named script on the internet was captured.",
    "github_queries": [
      {
        "query": "obfuscator golang in:name,description language:Go",
        "results": 27
      },
      {
        "query": "obfuscation golang in:name,description language:Go",
        "results": 26
      },
      {
        "query": "protector golang in:name,description language:Go",
        "results": 4
      },
      {
        "query": "\"Go binary\" protection in:name,description language:Go",
        "results": 5
      },
      {
        "query": "topic:obfuscation language:Go",
        "results": 53
      },
      {
        "query": "topic:code-obfuscator language:Go",
        "results": 1
      },
      {
        "query": "topic:anti-debugging language:Go",
        "results": 2
      },
      {
        "query": "topic:binary-obfuscation language:Go",
        "results": 0
      },
      {
        "query": "GoDefender in:name,description",
        "results": 1
      },
      {
        "query": "golang \"anti debugging\" in:name,description",
        "directly_relevant_results": 4
      },
      {
        "query": "golang \"anti tamper\" in:name,description",
        "results": 0
      }
    ],
    "named_open_source_candidates": {
      "direct_or_current": [
        "burrowers/garble",
        "idaifish/gostrip",
        "adjisoft/aurum-obf",
        "guno1928/alosgarble",
        "lukaszraczylo/go-obfuscation",
        "AeonDave/garble"
      ],
      "legacy_or_single_purpose": [
        "unixpickle/gobfuscate",
        "jeromer/mumbojumbo",
        "artemixer/gofuscator",
        "CRYBOII/monmind",
        "redskal/obfuscatxor",
        "pedroalbanese/obfuse",
        "timwhitez/Doge-Obf",
        "luftwaffe66/GoBfuscator",
        "GH0st3rs/obfus"
      ],
      "runtime_probe_or_anti_analysis": [
        "KiExitDispatcher/GoDefender (archived)",
        "CRYBOII/buggi",
        "guno1928/antidebug",
        "SecureX",
        "Chronoss3/Anti-Debug",
        "Trigleos/ELFREVGO"
      ],
      "adjacent_toolchains_or_packers": [
        "TinyGo",
        "gccgo",
        "UPX",
        "Pakkero",
        "Kiteshield"
      ]
    },
    "commercial_product_lines_with_direct_public_go_material": [
      {
        "vendor": "VMProtect Software",
        "product": "VMProtect 3.10.6",
        "platforms": "Windows, Linux, macOS, Android; x86/x64/ARM64",
        "local_evidence": "signed demo identity and wrapper workflow only; no controlled function-virtualization result"
      },
      {
        "vendor": "Oreans Technologies",
        "product": "Themida 3.2.5.0",
        "platforms": "Windows x86/x64",
        "local_evidence": "older signed demo workflow only; no protected controlled target"
      },
      {
        "vendor": "Oreans Technologies",
        "product": "WinLicense 3.2.5.0",
        "platforms": "Windows x86/x64",
        "local_evidence": "official product-family material only"
      },
      {
        "vendor": "Oreans Technologies",
        "product": "Code Virtualizer 3.2.5.0",
        "platforms": "Windows, Linux, macOS; x86/x64/ARM64",
        "local_evidence": "official product-family material only"
      },
      {
        "vendor": "Virbox",
        "product": "Virbox Protector 3.6.0.22848",
        "platforms": "Windows, Linux, macOS; native Go material",
        "local_evidence": "official documentation only"
      }
    ],
    "excluded_classes": [
      "shellcode encoders and payload crypters",
      "network or data obfuscation libraries",
      "documentation-only repositories",
      "unverifiable binary downloads",
      "tools marketed through parser CVEs or absolute anti-analysis claims",
      "general protectors without direct current Go evidence",
      "PELock because the product target is 32-bit Windows rather than the Windows/amd64 matrix"
    ]
  },
  "receipt_digests": {
    "functional_controls_sha256": "71B8081E12792F290B928CE97756B974AB73AAF5196E007CBF08F6878C7F4EDD",
    "static_analysis_sha256": "F75E08AE72671D4C10A2E39FCE7F813E399E0004D0A62CAF8DE9FEECE4BD9E2C",
    "delve_sha256": "ABF467EBE3A404B51D2D591D5B1DC32646EC81973A5750A1A09AB23694AF0718",
    "performance_comparison_sha256": "C22CA6F4A12B39FA255D52BBA174DBD9346A7731BC335A6403E95240203A4CA4",
    "reproducibility_sha256": "D6A1E57F602C3666F80E7FE0C958E360D2B8F6A246A6EE0F8DA6C5CBAAD43BF3"
  },
  "decision_rules": [
    "Treat release stripping as hygiene and measure Go-aware metadata separately.",
    "Use pinned base Garble as the open-source default; scope it to private packages with GOGARBLE.",
    "Use -literals where plaintext is a useful locator and benchmark the real program.",
    "Keep -tiny outside the default because it removes panic and trace output.",
    "Treat Garble control-flow as an experimental POC enabled only on selected cold paths.",
    "Use UPX only for a measured size objective.",
    "Run commercial products on the buyer's real binary before ranking or purchasing them.",
    "Keep issuer private keys and long-lived symmetric secrets out of the client.",
    "Use short-lived server capabilities, replay and device controls, revocation, and server-resident value for connected high-value features.",
    "Preserve seeds, mappings, symbols, hashes, signed rollback artifacts, and positive and negative controls for every release."
  ]
}