A Deep Dive into Go Malware: Using Metadata to Empower the Analyst
summary
Stripped Go binaries still contain a recoverable PC-to-line table and rich type metadata, so function names, source file paths, and exact line numbers often survive compilation; a custom Go tool reads the PCLN tab and type sections, reconstructs type and function info, and can inject symbols into R2 (IDA support is planned). Live examples include an SSH-bruting worm and a Zebrocy downloader; Go executables routinely have 6,000+ subroutines, and naive stripping often breaks runtime reflection.
AI-written summary · about
chapters (6)
- 0:00Start
- 0:40Agenda
- 4:55Structs
- 16:47Kind Section
- 21:35Educated Guess of the Source Code Structure
- 22:31What Kind of Tools Do You Use to Re Go Samples
related talks
47mReverse Engineering Go Malware: From Manual to AI-Powered Analysis
33mReversing Golang Binaries with Ghidra
32mThe Dark Side of Go: A 2020 Go Malware Round Up
45m"Advanced Malware Threat: handling obfuscated code using..."
40mAnalyzing Windows Malware on Linux: Getting Started Tips and Examples
33mBasic Malware Analysis for Incident Responders
57mHacking with Go
25mCommSec D1 - A Deep Dive Into Malicious Documents