go-rust-reverse
Helps security researchers understand compiled Go and Rust programs by recovering hidden code, function names, and error messages that were stripped away.
Installation
Paste this into Claude Code, Cursor, or any agent that can run commands.
What this skill does
What it does: - Helps analyze Go and Rust programs that have had their names and information removed - Recovers function names and important data from these programs - Finds panic messages and other clues left in the code - Translates the confusing computer code back into something closer to the original When to use it: - You have a Go or Rust program that someone stripped of information to hide what it does - You need to understand what a Rust or Go program does by reading its code - You want to find hidden messages or function names in a compiled program - You are studying how Go or Rust programs work at a deep level
SKILL.mdShow the author's original SKILL.md (not in English)
--- name: go-rust-reverse description: Use for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery. --- # Go / Rust Binary Reverse Engineering ## ACTION REQUIRED（读完后立刻执行） 1. `NOW`: 读取 `../field-journal/precedent-reverse.md` 2. `NOW`: 确认样本为 Go/Rust 编译产物（`file`/字符串/运行时特征） 3. `NEXT`: GoReSym / 相关插件是否可用 4. `ACT`: 运行时识别 → 符号/元数据恢复 → 业务逻辑 ## 适用场景 - 剥离符号的 Go 恶意软件/工具 - Rust 发行二进制、panic 字符串驱动分析 - 与通用 ida/ghidra 互补的语言专用方法 ## 工作流 ### Go ```text □ 识别 go.buildid、runtime 符号残留、pclntab □ GoReSym / redress / IDA Go 插件恢复函数名 □ 注意 interface、slice、string 结构在反编译中的形态 □ 网络/加密库路径：crypto/* net/http ``` ### Rust ```text □ panic 字符串、rust_begin_unwind、crate 路径暗示 □ 范型实例化导致的代码膨胀；先定位字符串 xref □ 异步/tokio 状态机需结合交叉引用 ``` ### 动态 ```text □ 仍可用 Frida；注意 Go 栈与调度 □ 优先日志与配置字符串驱动断点 ``` ## 工具链 | 工具 | 用途 | |------|------| | GoReSym | Go 元数据 | | IDA/Ghidra + Go/Rust 插件 | 反编译 | | radare2 | 快速字符串 | | strings / rabin2 | 分诊 | ## 参考 - `references/go-rust-notes.md` - `../reverse-engineering/go-reverse.md` `../ida-reverse/` `../ghidra-reverse/` - seed: `field-journal/seed-002_go-malware-stripped.md` ## 路由上下文 **上游**: MASTER R33 **下游**: 恶意样本流程 `malware-analysis`；通用 RE `reverse-engineering` ## 任务完成自检 - [ ] 是否恢复关键函数名或等价映射？ - [ ] 是否标注语言运行时证据？ - [ ] Checklist？
Ships with 1 supporting file:
- references/go-rust-notes.md
Mirrored from the author's public source. Install counts from the open skills registry.