reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-golang-malware-internals/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: analyzing-golang-malware-internals
+description: 'Analyzes Go-compiled malware by recovering function names from the pclntab, detecting
+  the Go build/version string, and listing embedded package paths to overcome stripped symbols.
+  Activates for requests to analyze Go malware, recover Go function names, or identify a Golang
+  binary build.'
+domain: cybersecurity
+subdomain: reverse-engineering
+tags:
+  - reverse-engineering
+  - golang
+  - symbol-recovery
+  - pclntab
+  - stripped-binaries
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1027
+  - T1587.001
+  - T1059
+d3fend:
+  - D3-SDA
+  - D3-DA
+references:
+  - 'Go runtime pclntab format (Go source: runtime/symtab.go) — https://go.dev/src/runtime/symtab.go'
+  - 'Go binary build info (debug/buildinfo) — https://pkg.go.dev/debug/buildinfo'
+---
+
+# Analyzing Golang Malware Internals
+
+## When to Use
+
+- You have a Go-compiled binary (often large, statically linked) and standard symbol recovery
+  fails because user symbols are stripped.
+- You need function names from the pclntab, the Go version, and embedded package/module paths.
+
+**Do not use** this for non-Go binaries — confirm the Go build signature first. This skill reads
+the binary statically and executes nothing.
+
+## Prerequisites
+
+- The Go binary (read inertly).
+
+## Safety & Handling
+
+- Read bytes statically; treat strings as untrusted data.
+
+## Workflow
+
+### Step 1: Confirm it is Go and get the version
+
+```bash
+python scripts/analyst.py info sample.bin
+```
+
+Looks for the `Go build ID`, the `go1.x` version string, and `runtime.` references.
+
+### Step 2: Recover function names from pclntab
+
+The pclntab (preceded by a magic like `\xfb\xff\xff\xff`/`\xf0\xff\xff\xff` across Go versions)
+contains function name strings; extract `main.*`, package-qualified, and `runtime.*` names.
+
+### Step 3: Enumerate package paths
+
+List embedded import/module paths (`github.com/...`, vendored deps) to fingerprint capabilities
+and third-party libraries.
+
+### Step 4: Map and document
+
+Map suspicious packages (networking, crypto, exec) to behavior and ATT&CK.
+
+## Validation
+
+- The Go build signature/version is confirmed before deeper parsing.
+- Recovered names include plausible `main.*`/package-qualified functions.
+- Package paths are real module paths, not random strings.
+
+## Pitfalls
+
+- pclntab magic differs across Go versions; try the known set.
+- Obfuscators (garble) rename symbols and strip build info — names may be hashed.
+- Confusing vendored library code with the author's `main` package.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the analyzer.
+- Go pclntab/buildinfo references (linked in frontmatter).