go-rust-reverse

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Go / Rust Binary Reverse Engineering

ACTION REQUIRED（读完后立刻执行）

ACTION REQUIRED (Execute Immediately After Reading)

NOW

: 读取

../field-journal/precedent-reverse.md

```
NOW
```
: 确认样本为 Go/Rust 编译产物（
```
file
```
/字符串/运行时特征）
```
NEXT
```
: GoReSym / 相关插件是否可用
```
ACT
```
: 运行时识别 → 符号/元数据恢复 → 业务逻辑

NOW

: Read

../field-journal/precedent-reverse.md

```
NOW
```
: Verify that the sample is a Go/Rust compiled product (
```
file
```
command/strings/runtime features)
```
NEXT
```
: Check if GoReSym / related plugins are available
```
ACT
```
: Runtime identification → Symbol/metadata recovery → Business logic analysis

适用场景

Applicable Scenarios

剥离符号的 Go 恶意软件/工具
Rust 发行二进制、panic 字符串驱动分析
与通用 ida/ghidra 互补的语言专用方法

Stripped-symbol Go malware/tools
Rust release binaries, panic string-driven analysis
Language-specific methods complementary to general-purpose IDA/Ghidra

工作流

Workflow

Go

text

□ 识别 go.buildid、runtime 符号残留、pclntab
□ GoReSym / redress / IDA Go 插件恢复函数名
□ 注意 interface、slice、string 结构在反编译中的形态
□ 网络/加密库路径：crypto/* net/http

text

□ Identify go.buildid, remaining runtime symbols, and pclntab
□ Recover function names using GoReSym / redress / IDA Go plugin
□ Pay attention to the decompiled forms of interface, slice, and string structures
□ Network/encryption library paths: crypto/* net/http

Rust

text

□ panic 字符串、rust_begin_unwind、crate 路径暗示
□ 范型实例化导致的代码膨胀；先定位字符串 xref
□ 异步/tokio 状态机需结合交叉引用

text

□ Panic strings, rust_begin_unwind, crate path hints
□ Code bloat caused by generic instantiation; first locate string cross-references (xref)
□ Async/tokio state machines need to be analyzed with cross-references

动态

Dynamic Analysis

text

□ 仍可用 Frida；注意 Go 栈与调度
□ 优先日志与配置字符串驱动断点

text

□ Frida is still applicable; pay attention to Go stack and scheduling
□ Prioritize breakpoints driven by log and configuration strings

工具链

Toolchain

工具	用途
GoReSym	Go 元数据
IDA/Ghidra + Go/Rust 插件	反编译
radare2	快速字符串
strings / rabin2	分诊

Tool	Purpose
GoReSym	Go metadata recovery
IDA/Ghidra + Go/Rust Plugins	Decompilation
radare2	Fast string extraction
strings / rabin2	Triage

参考

References

```
references/go-rust-notes.md
```

../reverse-engineering/go-reverse.md

../ida-reverse/

../ghidra-reverse/

seed:

field-journal/seed-002_go-malware-stripped.md

```
references/go-rust-notes.md
```

../reverse-engineering/go-reverse.md

../ida-reverse/

../ghidra-reverse/

Seed:

field-journal/seed-002_go-malware-stripped.md

路由上下文

Routing Context

上游: MASTER R33
下游: 恶意样本流程

malware-analysis

；通用 RE

reverse-engineering

Upstream: MASTER R33
Downstream: Malware sample workflow

malware-analysis

; General reverse engineering

reverse-engineering

任务完成自检

Task Completion Self-Check

是否恢复关键函数名或等价映射？
是否标注语言运行时证据？
Checklist？

Have key function names or equivalent mappings been recovered?
Have language runtime evidences been documented?
Have all checklist items been completed?