← LeaderboardThe Skill Leaderboard

go-rust-reverse

Reverse engineer stripped Go and Rust binaries: runtime recognition, pclntab/module metadata recovery, panic-string analysis, and idiomatic decompilation strategies.

Published by sickn33 ↗sickn33/agentic-awesome-skills

Try your first task

go-rust-reverse

Start a fresh conversation. Replace the highlighted placeholders.

Use go-rust-reverse to statically triage the authorized stripped Go or Rust binary at [sample path and hash], within [analysis scope], using [available compatible reverse-engineering tools], and return runtime/compiler evidence, recovered or mapped function metadata where supported, and key-logic traces from strings and cross-references, with unknown mappings and metadata-layout limitations recorded. Do not execute or dynamically hook the sample.

Required inputs

  • [sample path and hash]
  • [analysis scope]
  • [available compatible reverse-engineering tools]

User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗

SKILL.md

name: go-rust-reversedescription: "Reverse engineer stripped Go and Rust binaries: runtime recognition, pclntab/module metadata recovery, panic-string analysis, and idiomatic decompilation strategies."risk: safesource: "https://github.com/zhaoxuya520/reverse-skill"source_repo: "zhaoxuya520/reverse-skill"source_type: communitydate_added: "2026-08-25"license: "MIT"license_source: "https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE"

Go / Rust Binary Reverse Engineering

When to Use

  • Analyzing a stripped Go or Rust binary where symbols are absent.
  • Recovering function boundaries and names from language-specific metadata.

适用场景

  • 剥离符号的 Go 恶意软件/工具
  • Rust 发行二进制、panic 字符串驱动分析
  • 与通用 ida/ghidra 互补的语言专用方法

工作流

Go

□ 识别 go.buildid、runtime 符号残留、pclntab
□ GoReSym / redress / IDA Go 插件恢复函数名
□ 注意 interface、slice、string 结构在反编译中的形态
□ 网络/加密库路径：crypto/* net/http

Rust

□ panic 字符串、rust_begin_unwind、crate 路径暗示
□ 范型实例化导致的代码膨胀；先定位字符串 xref
□ 异步/tokio 状态机需结合交叉引用

动态

□ 仍可用 Frida；注意 Go 栈与调度
□ 优先日志与配置字符串驱动断点

工具链

工具用途
GoReSymGo 元数据
IDA/Ghidra + Go/Rust 插件反编译
radare2快速字符串
strings / rabin2分诊

参考

  • references/go-rust-notes.md
  • ../reverse-engineering/go-reverse.md ../ida-reverse/ ../ghidra-reverse/
  • seed: field-journal/seed-002_go-malware-stripped.md

路由上下文

上游: MASTER R33
下游: 恶意样本流程 malware-analysis；通用 RE reverse-engineering

任务完成自检

  • 是否恢复关键函数名或等价映射？
  • 是否标注语言运行时证据？
  • Checklist？

Limitations

  • New compiler versions change metadata layouts; tooling must be kept current.
  • Aggressive inlining still yields large, hard-to-read decompilation.

Adapted from zhaoxuya520/reverse-skill (MIT).