1.3 KiB
1.3 KiB
API Reference: Analyzing Golang Malware Internals
Overview
scripts/analyst.py confirms a Go build (build ID / go1.x / runtime.main), detects pclntab
magic markers, and recovers Go function names and package import paths from printable strings,
mapping notable packages to capabilities. It reads bytes statically and executes nothing. This is
a heuristic scan, not a full pclntab structure parser.
Dependencies
| Package | Version | Purpose |
|---|---|---|
| (stdlib) | — | regex, JSON, file IO |
Core functions
info(path)
Returns Go detection, versions, pclntab magics present, recovered functions, package paths, and capabilities.
Heuristics
- Go detection:
Go build ID,go1.x,runtime.main. - pclntab magics:
\xfb\xff\xff\xff,\xfa…,\xf0…,\xf1…(across Go versions). - Functions:
main.*,runtime.*,net.*,crypto.*,os/exec.*,syscall.*.
Usage
python scripts/analyst.py info sample.bin
Sources
- Go runtime pclntab format (runtime/symtab.go) — https://go.dev/src/runtime/symtab.go
- Go build info (debug/buildinfo) — https://pkg.go.dev/debug/buildinfo
- Go RE techniques (pclntab name recovery, garble obfuscation) from public Go-malware research