go-rust-reverse

name	go-rust-reverse
description	Reverse engineer Go and Rust binaries: recognize the language runtime from go.buildid, runtime symbols, or panic strings, recover function tables and names from pclntab, and rebuild symbols with GoReSym or redress before Ghidra/IDA analysis. Use when analyzing stripped Go/Rust malware, ELF/PE binaries with non-standard symbol layouts, or runtime-library-heavy samples.
domain	cybersecurity
subdomain	malware-analysis
tags	["go","rust","reverse-engineering","malware-analysis","pclntab","ghidra","ida","symbol-recovery"]
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["DE.AE-02","RS.AN-03","ID.RA-01"]

Go / Rust Binary Reverse Engineering

Overview

Go and Rust binaries break generic reverse-engineering assumptions. They are statically linked, carry their own runtimes, and when stripped they leave massive symbol tables behind (Go's pclntab, Rust's panic strings) that generic disassemblers ignore. The language-specific shortcut is: recognize the runtime, recover the metadata, then read the business logic — never wade through runtime library code.

This skill covers runtime recognition, pclntab/function-name recovery with GoReSym/redress, and idiomatic decompilation recovery for both languages, plus a dynamic-analysis note for Go's unusual stack/scheduler behavior. It complements (does not replace) the generic Ghidra/IDA workflow in analyzing-go-golang-with-ghidra and similar skills.

Source: cherry-picked and translated from zhaoxuya520/reverse-skill (skills/go-rust-reverse, MIT license); reference notes (go-rust-notes.md) inlined.

When to Use

Trigger phrases:

• "reverse this stripped Go binary"
• "recover function names from pclntab"
• "analyze Rust malware"
• "GoReSym on this ELF"
• "language-specific RE of a Go/Rust sample"
• "find the main entry of a Go binary"

Use this skill when:

• The sample is a Go or Rust compiled artifact (confirmed via file, string inspection, or runtime fingerprints).
• Symbols are stripped and you need function names or the main entry back.
• You want to skip runtime-library noise and go straight to business logic.

Prerequisites

• file, strings/rabin2 for triage.
• GoReSym (and/or redress, or a Go-aware IDA plugin) for Go metadata.
• Ghidra or IDA with Go/Rust plugins for decompilation; radare2 for quick string work.

Workflow

Phase 1: Triage — Identify the Runtime

• Confirm the language before anything else: go.buildid section, runtime. symbol residue, main.main references, or Rust panic strings / rust_begin_unwind.
• Record the language-runtime evidence explicitly — it drives every later step.

Phase 2: Go — Recover Metadata

• Go: locate go.buildid, residual runtime symbols, and the pclntab (program counter line table).