analyzing-go-binaries

Analyzing Go Binaries

Go binaries look hostile — statically linked, tens of megabytes, no imports you recognize, and "stripped" in a way that makes tools show thousands of sub_ functions. They are not. Go ships its own symbol table for runtime reflection and panic traces, and strip does not remove it. Recover it and the binary becomes one of the easiest targets there is.

When to Use

• strings shows runtime.main, go:buildid, go.buildinfo, or runtime.gopanic
• A "stripped" binary is 5–50 MB with almost no dynamic imports
• The disassembler shows thousands of unnamed functions and unreadable strings
• Analyzing Go malware, a Go CLI tool, or a compiled Go service

When NOT to Use

• Rust binaries — use analyzing-rust-binaries; the symbol recovery is entirely different
• .NET assemblies — use analyzing-dotnet-assemblies
• Suspected malware, before containment — use analyzing-malware for the environment, then come back here
• General native RE — use analyzing-binaries

Confirm It Is Go, and Which Version

strings -n 6 target | rg -m5 'go1\.[0-9]+|go:buildid|runtime\.main|GOROOT'
go version target                     # works on unstripped and many stripped builds
go version -m target                  # module list and build settings — free SBOM

go version -m is the highest-value first command. It prints the module dependency graph with versions, which gives you the third-party libraries in use before you disassemble anything — often answering the question outright (which HTTP library, which crypto, which C2 framework).

The Go version matters because pclntab layout changed at 1.2, 1.16, 1.18, and 1.20. Tooling that fails is usually version mismatch, not a hardened binary.

Recover Symbols

# GoReSym — extracts pclntab, moduledata, types, and build info
GoReSym -t -d -p target > syms.json
#   -t  user type metadata
#   -d  include standard library
#   -p  paths

# redress — Go-aware analysis, works well when GoReSym struggles
redress info target
redress symbols target
redress types target

# Load into the disassembler
#   IDA:    AlphaGolang, golang_loader_assist, or the GoReSym IDA script
#   Ghidra: GolangAnalyzerExtension, or gotools
#   Binja:  the Golang loader plugin