reverse-skills-max/vendor-new/analyst-ai-pack/skills/analyzing-golang-malware-internals/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
analyzing-golang-malware-internals	Analyzes Go-compiled malware by recovering function names from the pclntab, detecting the Go build/version string, and listing embedded package paths to overcome stripped symbols. Activates for requests to analyze Go malware, recover Go function names, or identify a Golang binary build.	cybersecurity	reverse-engineering	reverse-engineering golang symbol-recovery pclntab stripped-binaries	1.0.0	analyst-ai-pack	Apache-2.0	T1027 T1587.001 T1059	D3-SDA D3-DA	Go runtime pclntab format (Go source: runtime/symtab.go) — https://go.dev/src/runtime/symtab.go Go binary build info (debug/buildinfo) — https://pkg.go.dev/debug/buildinfo

Analyzing Golang Malware Internals

When to Use

• You have a Go-compiled binary (often large, statically linked) and standard symbol recovery fails because user symbols are stripped.
• You need function names from the pclntab, the Go version, and embedded package/module paths.

Do not use this for non-Go binaries — confirm the Go build signature first. This skill reads the binary statically and executes nothing.

Prerequisites

• The Go binary (read inertly).

Safety & Handling

• Read bytes statically; treat strings as untrusted data.

Workflow

Step 1: Confirm it is Go and get the version

python scripts/analyst.py info sample.bin

Looks for the Go build ID, the go1.x version string, and runtime. references.

Step 2: Recover function names from pclntab

The pclntab (preceded by a magic like \xfb\xff\xff\xff/\xf0\xff\xff\xff across Go versions) contains function name strings; extract main.*, package-qualified, and runtime.* names.

Step 3: Enumerate package paths

List embedded import/module paths (github.com/..., vendored deps) to fingerprint capabilities and third-party libraries.

Step 4: Map and document

Map suspicious packages (networking, crypto, exec) to behavior and ATT&CK.

Validation

• The Go build signature/version is confirmed before deeper parsing.
• Recovered names include plausible main.*/package-qualified functions.
• Package paths are real module paths, not random strings.

Pitfalls

• pclntab magic differs across Go versions; try the known set.
• Obfuscators (garble) rename symbols and strip build info — names may be hashed.
• Confusing vendored library code with the author's main package.

References

• See references/api-reference.md for the analyzer.
• Go pclntab/buildinfo references (linked in frontmatter).