Go / Rust Binary Reverse Engineering

ACTION REQUIRED (Execute Immediately After Reading)

1. NOW

   : Read

   ../field-journal/precedent-reverse.md

2. NOW

   : Verify that the sample is a Go/Rust compiled product (

   file

   command/strings/runtime features)

3. NEXT

   : Check if GoReSym / related plugins are available

4. ACT

   : Runtime identification → Symbol/metadata recovery → Business logic analysis

Applicable Scenarios

• Stripped-symbol Go malware/tools
• Rust release binaries, panic string-driven analysis
• Language-specific methods complementary to general-purpose IDA/Ghidra

Workflow

Go

□ Identify go.buildid, remaining runtime symbols, and pclntab
□ Recover function names using GoReSym / redress / IDA Go plugin
□ Pay attention to the decompiled forms of interface, slice, and string structures
□ Network/encryption library paths: crypto/* net/http

Rust

□ Panic strings, rust_begin_unwind, crate path hints
□ Code bloat caused by generic instantiation; first locate string cross-references (xref)
□ Async/tokio state machines need to be analyzed with cross-references

Dynamic Analysis

□ Frida is still applicable; pay attention to Go stack and scheduling
□ Prioritize breakpoints driven by log and configuration strings

Toolchain

References

• references/go-rust-notes.md

• ../reverse-engineering/go-reverse.md

  ../ida-reverse/

  ../ghidra-reverse/

• Seed:

  field-journal/seed-002_go-malware-stripped.md

Routing Context

malware-analysis

reverse-engineering

Task Completion Self-Check

• Have key function names or equivalent mappings been recovered?
• Have language runtime evidences been documented?
• Have all checklist items been completed?