← LeaderboardThe Skill Leaderboard

go-rust-reverse

Use for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery.

Published by zhaoxuya520 ↗zhaoxuya520/reverse-skill

Try your first task

go-rust-reverse

Start a fresh conversation. Replace the highlighted placeholders.

Use go-rust-reverse to analyze the authorized [stripped Go or Rust binary], first verify its language-runtime evidence, then recover key symbols or equivalent mappings and produce a concise business-logic report with the supporting runtime evidence.

Required inputs

[stripped Go or Rust binary]

User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗

SKILL.md

name: go-rust-reversedescription: Use for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery.

Go / Rust Binary Reverse Engineering

ACTION REQUIRED（读完后立刻执行）

NOW: 读取 ../field-journal/precedent-reverse.md
NOW: 确认样本为 Go/Rust 编译产物（file/字符串/运行时特征）
NEXT: GoReSym / 相关插件是否可用
ACT: 运行时识别 → 符号/元数据恢复 → 业务逻辑

适用场景

剥离符号的 Go 恶意软件/工具
Rust 发行二进制、panic 字符串驱动分析
与通用 ida/ghidra 互补的语言专用方法

工作流

Go

□ 识别 go.buildid、runtime 符号残留、pclntab
□ GoReSym / redress / IDA Go 插件恢复函数名
□ 注意 interface、slice、string 结构在反编译中的形态
□ 网络/加密库路径：crypto/* net/http

Rust

□ panic 字符串、rust_begin_unwind、crate 路径暗示
□ 范型实例化导致的代码膨胀；先定位字符串 xref
□ 异步/tokio 状态机需结合交叉引用

动态

□ 仍可用 Frida；注意 Go 栈与调度
□ 优先日志与配置字符串驱动断点

工具链

工具	用途
GoReSym	Go 元数据
IDA/Ghidra + Go/Rust 插件	反编译
radare2	快速字符串
strings / rabin2	分诊

参考

references/go-rust-notes.md
../reverse-engineering/go-reverse.md ../ida-reverse/ ../ghidra-reverse/
seed: field-journal/seed-002_go-malware-stripped.md

路由上下文

上游: MASTER R33
下游: 恶意样本流程 malware-analysis；通用 RE reverse-engineering

任务完成自检

是否恢复关键函数名或等价映射？
是否标注语言运行时证据？
Checklist？