Getting it into your agent
There is no command for this one: it runs only inside a plugin, and the catalogue could not identify which plugin ships it. The source is linked below.
Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-go)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-go"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-go/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-go"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-go.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.05334 |
| Opus 5 | $0.00020 | $0.02667 |
| Sonnet 5 | $0.00008 | $0.01067 |
| Haiku 4.5 | $0.00004 | $0.00533 |
Grade A, and why
re-go scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 141 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Go 二进制逆向（符号 / 字符串表 / goroutine）
何时使用 / 何时不用
- 用：确认是 Go 编译的二进制（
file输出 Go BuildID / 节表含.gopclntab）后，利用 Go 默认保留符号的特性还原逻辑；识别 Go 版本与构建信息；分析多 goroutine 程序的控制流；恢复 strip 后的 Go 符号 - 用：恶意 Go 样本（[[re-malware]] 静态还原——Go 恶意程序多带明文 C2 配置与 buildinfo）
- 不用：非 Go 原生程序（C/C++ 直接 [[re-binary-core]]；Rust 走 [[re-rust]]）
- 不用：确认带壳先走 [[re-anti-analysis]]（Go 二进制被加壳后 pclntab 偏移失效，脱壳后再回本技能）
- 注意：动态步骤默认沙箱（[[platform-tips]] 最高原则）；Go 二进制体积大，静态优先（大型样本原则）
工具准备
参考 [[platform-tips]]——Go 二进制通常 1MB 起（runtime 占大头），遵循「静态优先（大型样本）」；动态（dlv/gdb 运行样本）默认进沙箱。
Go 工具链（go version / go tool buildid / go version -m）
- Debian/Ubuntu:
apt install golang-go（官方包；Debian 版可能滞后——go version -m的 buildinfo 指纹需 Go 1.18+，工具太旧可用官方 tarball） - Fedora:
dnf install golang；Arch:pacman -S go - macOS:
brew install go；Windows:choco install golang或官方安装器 - 验证:
go version；go tool buildid sample能输出 build ID（非 Go 程序会报错）
Ghidra（内置 Go 支持）与 Go 插件
- Ghidra 11.2+ 内置 Go 分析器（识别 Go 二进制、从 pclntab 恢复符号、runtime 类型标注），装法见 [[re-ghidra]]
- IDA 侧插件（可选）: GitHub
0xjiayu/go_parser——IDA Pro 的 Go 解析脚本，恢复类型与结构体 - 验证: Ghidra 导入后函数树出现
main.*/runtime.*命名
GoReSym（strip 后符号恢复，可选但关键）
- 无发行版官方包 → 官方安装（需 Go 工具链）:
go install github.com/mandiant/GoReSym@latest - 用法:
GoReSym -t -d -p sample > gosyms.json（-t 类型、-d 标准库包、-p 文件路径） - 导入反编译器:
goresym_rename.py（GoReSym 官方仓库脚本，Ghidra/IDA 导入，PR #11 已合入） - 验证:
GoReSym -about输出 about 与 license 信息；输出 JSON 含函数名/地址
redress（Go 二进制元数据，可选）
- 无发行版官方包 → 官方安装:
go install github.com/goretk/redress@latest - 用法:
redress info sample（编译器版本/GoRoot/main 包路径）、redress packages sample --std --vendor（包列表）、redress source sample（源码树投影）、redress types struct sample --methods（类型） - 验证:
redress version
garble —— Go 混淆识别（恶意样本常见，无独立工具）
- garble 是社区维护的第三方 Go 混淆器（构建期变换，非运行时壳；作者 mvdan，非 Go 官方项目）——Go 恶意样本越来越常见，需先识别再分析
- 识别特征：①字符串/节表偶见
garble标识（默认剥离构建信息，非必然残留）②garble 构建默认无 DWARF（readelf -S无.debug_*）③函数名 hash 化（main.main→ 短 hash 名，pclntab 保留但名字不可读）④-literals构建字符串乱码 - 常见构建标志：
garble -literals build（字符串混淆；去调试为默认行为无需标志；另有-tiny移除位置信息/剥离 panic 打印与符号名，体积约 -15%） - 分析要点见步骤 3（hash 函数名 / 字符串惰性解密 / interface 方法名保留）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 141 lines · 40 tokens per session scan A 471abbd37238
re-go is a skill published in the GitHub repository dslsdzc/rev-skills (52 stars, last pushed 12d ago), licensed Apache-2.0. It adds 40 tokens to every session and 5,334 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
analyzing-golang-malware-with-ghidra
Use when reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries. Use when reverseing engineer go-compiled malware using ghidra with specialized scripts for.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.