reverse-skills-max/vendor-new/analyst-ai-pack/skills/analyzing-golang-malware-internals/references/api-reference.md

API Reference: Analyzing Golang Malware Internals

Overview

scripts/analyst.py confirms a Go build (build ID / go1.x / runtime.main), detects pclntab magic markers, and recovers Go function names and package import paths from printable strings, mapping notable packages to capabilities. It reads bytes statically and executes nothing. This is a heuristic scan, not a full pclntab structure parser.

Dependencies

Package	Version	Purpose
(stdlib)	—	regex, JSON, file IO

Core functions

info(path)

Returns Go detection, versions, pclntab magics present, recovered functions, package paths, and capabilities.

Heuristics

• Go detection: Go build ID, go1.x, runtime.main.
• pclntab magics: \xfb\xff\xff\xff, \xfa…, \xf0…, \xf1… (across Go versions).
• Functions: main.*, runtime.*, net.*, crypto.*, os/exec.*, syscall.*.

Usage

python scripts/analyst.py info sample.bin

Sources

• Go runtime pclntab format (runtime/symtab.go) — https://go.dev/src/runtime/symtab.go
• Go build info (debug/buildinfo) — https://pkg.go.dev/debug/buildinfo
• Go RE techniques (pclntab name recovery, garble obfuscation) from public Go-malware research