When to Use
- Analyzing a stripped Go or Rust binary where symbols are absent.
- Recovering function boundaries and names from language-specific metadata.
Use cases
- Stripped Go malware/tools
- Rust release binaries, panic string-driven analysis
- Language-specific methods complementary to generic ida/ghidra
Workflow
Go
□ 识别 go.buildid、runtime 符号残留、pclntab
□ GoReSym / redress / IDA Go 插件恢复函数名
□ 注意 interface、slice、string 结构在反编译中的形态
□ 网络/加密库路径：crypto/* net/http
Rust
□ panic 字符串、rust_begin_unwind、crate 路径暗示
□ 范型实例化导致的代码膨胀；先定位字符串 xref
□ 异步/tokio 状态机需结合交叉引用
Dynamic
□ 仍可用 Frida；注意 Go 栈与调度
□ 优先日志与配置字符串驱动断点
Toolchain
| Tool | Purpose |
|---|---|
| GoReSym | Go metadata |
| IDA/Ghidra + Go/Rust plugins | Decompilation |
| radare2 | Quick strings |
| strings / rabin2 | Triage |
References
references/go-rust-notes.md../reverse-engineering/go-reverse.md../ida-reverse/../ghidra-reverse/- seed:
field-journal/seed-002_go-malware-stripped.md
Routing context
Upstream: MASTER R33
Downstream: malware sample flow malware-analysis; generic RE reverse-engineering
Task completion self-check
- Are key function names or equivalent mappings recovered?
- Is language runtime evidence annotated?
- Checklist？
Limitations
- New compiler versions change metadata layouts; tooling must be kept current.
- Aggressive inlining still yields large, hard-to-read decompilation.
Adapted from zhaoxuya520/reverse-skill (MIT).