| name | go-rust-reverse |
| description | Reverse engineer Go and Rust binaries: recognize the language runtime from go.buildid, runtime symbols, or panic strings, recover function tables and names from pclntab, and rebuild symbols with GoReSym or redress before Ghidra/IDA analysis. Use when analyzing stripped Go/Rust malware, ELF/PE binaries with non-standard symbol layouts, or runtime-library-heavy samples. |
| domain | cybersecurity |
| subdomain | malware-analysis |
| tags | ["go","rust","reverse-engineering","malware-analysis","pclntab","ghidra","ida","symbol-recovery"] |
| version | 1.0 |
| author | oyi77 |
| license | Apache-2.0 |
| nist_csf | ["DE.AE-02","RS.AN-03","ID.RA-01"] |
Go / Rust Binary Reverse Engineering
Overview
Go and Rust binaries break generic reverse-engineering assumptions. They are
statically linked, carry their own runtimes, and when stripped they leave
massive symbol tables behind (Go's pclntab, Rust's panic strings) that
generic disassemblers ignore. The language-specific shortcut is: recognize
the runtime, recover the metadata, then read the business logic — never wade
through runtime library code.
This skill covers runtime recognition, pclntab/function-name recovery with
GoReSym/redress, and idiomatic decompilation recovery for both languages,
plus a dynamic-analysis note for Go's unusual stack/scheduler behavior. It
complements (does not replace) the generic Ghidra/IDA workflow in
analyzing-go-golang-with-ghidra and similar skills.
Source: cherry-picked and translated from zhaoxuya520/reverse-skill
(skills/go-rust-reverse, MIT license); reference notes
(go-rust-notes.md) inlined.
When to Use
Trigger phrases:
- "reverse this stripped Go binary"
- "recover function names from pclntab"
- "analyze Rust malware"
- "GoReSym on this ELF"
- "language-specific RE of a Go/Rust sample"
- "find the main entry of a Go binary"
Use this skill when:
- The sample is a Go or Rust compiled artifact (confirmed via
file, string
inspection, or runtime fingerprints).
- Symbols are stripped and you need function names or the
main entry back.
- You want to skip runtime-library noise and go straight to business logic.
Prerequisites
file, strings/rabin2 for triage.- GoReSym (and/or redress, or a Go-aware IDA plugin) for Go metadata.
- Ghidra or IDA with Go/Rust plugins for decompilation; radare2 for quick
string work.
Workflow
Phase 1: Triage — Identify the Runtime
- Confirm the language before anything else:
go.buildid section,
runtime. symbol residue, main.main references, or Rust panic
strings / rust_begin_unwind.
- Record the language-runtime evidence explicitly — it drives every later
step.
Phase 2: Go — Recover Metadata
- Go: locate
go.buildid, residual runtime symbols, and the pclntab
(program counter line table).
