[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GWKSWSCM8TQAJW5CQPQ6NH":3,"skill-same:01M6GWKSWSCM8TQAJW5CQPQ6NH":102},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":49,"repositoryHtmlUrl":50,"repositoryHomepageUrl":6,"ownerHtmlUrl":51,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":52,"install":53,"resources":66},"01M6GWKSWSCM8TQAJW5CQPQ6NH","analyzing-golang-malware-with-ghidra",null,"Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-golang-malware-with-ghidra\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"golang","with","analyzing","analyzing golang malware with ghidra","ghidra","malware","malware-analysis","binary-analysis","go-malware","disassembly","reverse-engineering","recovery","analysis","specialized","engineer","reverse engineer","type","scripts","cybersecurity","reverse","2026-11-10 10:12:30",false,"---\nname: analyzing-golang-malware-with-ghidra\ndescription: Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags: [golang, ghidra, reverse-engineering, malware-analysis, binary-analysis, go-malware, disassembly]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n# Analyzing Golang Malware with Ghidra\n\n## Overview\n\nGo (Golang) has become a popular language for malware authors due to its cross-compilation capabilities, static linking that produces self-contained binaries, and the complexity it introduces for reverse engineering. Go binaries contain the entire runtime, standard library, and all dependencies statically linked, resulting in large binaries (often 5-15MB) with thousands of functions. Ghidra struggles with Go-specific string formats (non-null-terminated), stripped function names, and goroutine concurrency patterns. Specialized tools like GoResolver (Volexity, 2025) use control-flow graph similarity to automatically deobfuscate and recover function names in stripped or obfuscated Go binaries.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing golang malware with ghidra\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Ghidra 11.0+ with JDK 17+\n- GoResolver plugin (for function name recovery)\n- Go Reverse Engineering Tool Kit (go-re.tk)\n- Python 3.9+ for helper scripts\n- Understanding of Go runtime internals (goroutines, channels, interfaces)\n- Familiarity with Go binary structure (pclntab, moduledata, itab)\n\n## Key Concepts\n\n### Go Binary Structure\n\nGo binaries embed rich metadata in the `pclntab` (PC Line Table) structure, which maps program counters to function names, source files, and line numbers. Even stripped binaries retain this metadata. The `moduledata` structure contains pointers to type information, itabs (interface tables), and the pclntab itself. Go strings are stored as a pointer-length pair rather than null-terminated C strings.\n\n### Function Recovery in Stripped Binaries\n\nDespite stripping symbol tables, Go binaries retain function names within the pclntab. However, obfuscation tools like garble rename functions to random strings. GoResolver addresses this by computing control-flow graph signatures of obfuscated functions and matching them against a database of known Go standard library and third-party package functions.\n\n### Crate\u002FDependency Extraction\n\nGo's dependency management embeds module paths and version strings in the binary. Extracting these reveals the malware's third-party dependencies (HTTP libraries, encryption packages, C2 frameworks), which provides insight into capabilities without full reverse engineering.\n\n## Workflow\n\n### Step 1: Initial Binary Analysis\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Analyze Go binary metadata for malware analysis.\"\"\"\nimport struct\nimport sys\nimport re\n\n\ndef find_go_build_info(data):\n    \"\"\"Extract Go build information from binary.\"\"\"\n    # Go buildinfo magic: \\xff Go buildinf:\n    magic = b'\\xff Go buildinf:'\n    offset = data.find(magic)\n    if offset == -1:\n        return None\n\n    print(f\"[+] Go build info at offset 0x{offset:x}\")\n\n    # Extract Go version string nearby\n    go_version = re.search(rb'go\\d+\\.\\d+(?:\\.\\d+)?', data[offset:offset+256])\n    if go_version:\n        print(f\"  Go Version: {go_version.group().decode()}\")\n\n    return offset\n\n\ndef find_pclntab(data):\n    \"\"\"Locate the pclntab (PC Line Table) structure.\"\"\"\n    # pclntab magic bytes vary by Go version\n    magics = {\n        b'\\xfb\\xff\\xff\\xff\\x00\\x00': \"Go 1.2-1.15\",\n        b'\\xfa\\xff\\xff\\xff\\x00\\x00': \"Go 1.16-1.17\",\n        b'\\xf1\\xff\\xff\\xff\\x00\\x00': \"Go 1.18-1.19\",\n        b'\\xf0\\xff\\xff\\xff\\x00\\x00': \"Go 1.20+\",\n    }\n\n    for magic, version in magics.items():\n        offset = data.find(magic)\n        if offset != -1:\n            print(f\"[+] pclntab found at 0x{offset:x} ({version})\")\n            return offset, version\n\n    return None, None\n\n\ndef extract_function_names(data, pclntab_offset):\n    \"\"\"Extract function names from pclntab.\"\"\"\n    if pclntab_offset is None:\n        return []\n\n    functions = []\n    # Function name strings follow specific patterns\n    func_pattern = re.compile(\n        rb'(?:main|runtime|fmt|net|os|crypto|encoding|io|sync|'\n        rb'syscall|reflect|strings|bytes|path|time|math|sort|'\n        rb'github\\.com|golang\\.org)[\u002F\\.][\\w\u002F.]+',\n    )\n\n    for match in func_pattern.finditer(data):\n        name = match.group().decode('utf-8', errors='replace')\n        if len(name) > 4 and len(name) \u003C 200:\n            functions.append(name)\n\n    return sorted(set(functions))\n\n\ndef extract_go_strings(data):\n    \"\"\"Extract Go-style strings (pointer+length pairs).\"\"\"\n    # Go strings are not null-terminated; extract readable sequences\n    strings = []\n    ascii_pattern = re.compile(rb'[\\x20-\\x7e]{10,}')\n\n    for match in ascii_pattern.finditer(data):\n        s = match.group().decode('ascii')\n        # Filter for interesting malware strings\n        interesting = [\n            'http', 'https', 'tcp', 'udp', 'dns',\n            'cmd', 'shell', 'exec', 'upload', 'download',\n            'encrypt', 'decrypt', 'key', 'token', 'password',\n            'c2', 'beacon', 'agent', 'implant', 'bot',\n            'mutex', 'persist', 'registry', 'scheduled',\n        ]\n        if any(kw in s.lower() for kw in interesting):\n            strings.append(s)\n\n    return strings\n\n\ndef extract_dependencies(data):\n    \"\"\"Extract Go module dependencies from binary.\"\"\"\n    deps = []\n    # Module paths follow pattern: github.com\u002Fuser\u002Frepo\n    dep_pattern = re.compile(\n        rb'((?:github\\.com|gitlab\\.com|golang\\.org|gopkg\\.in|'\n        rb'go\\.etcd\\.io|google\\.golang\\.org)\u002F[^\\x00\\s]{5,80})'\n    )\n\n    for match in dep_pattern.finditer(data):\n        dep = match.group().decode('utf-8', errors='replace')\n        deps.append(dep)\n\n    unique_deps = sorted(set(deps))\n    return unique_deps\n\n\ndef analyze_go_binary(filepath):\n    \"\"\"Full analysis of Go malware binary.\"\"\"\n    with open(filepath, 'rb') as f:\n        data = f.read()\n\n    print(f\"[+] Analyzing Go binary: {filepath}\")\n    print(f\"  File size: {len(data):,} bytes\")\n    print(\"=\" * 60)\n\n    # Build info\n    find_go_build_info(data)\n\n    # pclntab\n    pclntab_offset, go_version = find_pclntab(data)\n\n    # Functions\n    functions = extract_function_names(data, pclntab_offset)\n    print(f\"\\n[+] Recovered {len(functions)} function names\")\n\n    # Categorize functions\n    categories = {\n        \"network\": [], \"crypto\": [], \"os_exec\": [],\n        \"file_io\": [], \"main\": [], \"third_party\": [],\n    }\n    for f in functions:\n        if 'net\u002F' in f or 'http' in f.lower():\n            categories[\"network\"].append(f)\n        elif 'crypto' in f:\n            categories[\"crypto\"].append(f)\n        elif 'os\u002Fexec' in f or 'syscall' in f:\n            categories[\"os_exec\"].append(f)\n        elif 'os.' in f or 'io\u002F' in f:\n            categories[\"file_io\"].append(f)\n        elif f.startswith('main.'):\n            categories[\"main\"].append(f)\n        elif 'github.com' in f or 'golang.org' in f:\n            categories[\"third_party\"].append(f)\n\n    for cat, funcs in categories.items():\n        if funcs:\n            print(f\"\\n  [{cat}] ({len(funcs)} functions):\")\n            for fn in funcs[:10]:\n                print(f\"    {fn}\")\n\n    # Dependencies\n    deps = extract_dependencies(data)\n    print(f\"\\n[+] Dependencies ({len(deps)}):\")\n    for dep in deps[:20]:\n        print(f\"    {dep}\")\n\n    # Suspicious strings\n    sus_strings = extract_go_strings(data)\n    print(f\"\\n[+] Suspicious strings ({len(sus_strings)}):\")\n    for s in sus_strings[:20]:\n        print(f\"    {s}\")\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(f\"Usage: {sys.argv[0]} \u003Cgo_binary>\")\n        sys.exit(1)\n    analyze_go_binary(sys.argv[1])\n```\n\n### Step 2: Ghidra Analysis Script\n\n```python\n# Ghidra script (run within Ghidra's script manager)\n# Save as AnalyzeGoBinary.py in Ghidra scripts directory\n\n# @category MalwareAnalysis\n# @description Analyze Go binary structure and recover metadata\n\ndef analyze_go_binary_ghidra():\n    \"\"\"Ghidra script for Go binary analysis.\"\"\"\n    from ghidra.program.model.mem import MemoryAccessException\n\n    program = getCurrentProgram()\n    memory = program.getMemory()\n    listing = program.getListing()\n\n    print(\"[+] Go Binary Analysis Script\")\n    print(f\"  Program: {program.getName()}\")\n\n    # Find pclntab\n    pclntab_magics = [\n        bytes([0xf0, 0xff, 0xff, 0xff]),  # Go 1.20+\n        bytes([0xf1, 0xff, 0xff, 0xff]),  # Go 1.18-1.19\n        bytes([0xfa, 0xff, 0xff, 0xff]),  # Go 1.16-1.17\n        bytes([0xfb, 0xff, 0xff, 0xff]),  # Go 1.2-1.15\n    ]\n\n    for magic in pclntab_magics:\n        addr = memory.findBytes(\n            program.getMinAddress(), magic, None, True, None\n        )\n        if addr:\n            print(f\"[+] pclntab found at {addr}\")\n            # Create label\n            program.getSymbolTable().createLabel(\n                addr, \"go_pclntab\", None,\n                ghidra.program.model.symbol.SourceType.ANALYSIS\n            )\n            break\n\n    # Fix Go string definitions\n    # Go strings are ptr+len, not null terminated\n    print(\"[+] Fixing Go string references...\")\n\n    # Search for function names containing package paths\n    symbol_table = program.getSymbolTable()\n    func_count = 0\n    for symbol in symbol_table.getAllSymbols(True):\n        name = symbol.getName()\n        if ('.' in name and\n            any(pkg in name for pkg in\n                ['main.', 'runtime.', 'net.', 'crypto.', 'os.'])):\n            func_count += 1\n\n    print(f\"[+] Found {func_count} Go function symbols\")\n\n\n# Execute\nanalyze_go_binary_ghidra()\n```\n\n## Validation Criteria\n\n- Go version and build information extracted from binary\n- pclntab located and parsed for function name recovery\n- Third-party dependencies identified revealing malware capabilities\n- Main package functions enumerated for targeted analysis\n- Network, crypto, and OS exec functions categorized\n- Ghidra analysis correctly labels Go runtime structures\n\n## References\n\n- [CUJO AI - Reverse Engineering Go Binaries with Ghidra](https:\u002F\u002Fcujo.com\u002Fblog\u002Freverse-engineering-go-binaries-with-ghidra\u002F)\n- [Volexity GoResolver](https:\u002F\u002Fwww.volexity.com\u002Fblog\u002F2025\u002F04\u002F01\u002Fgoresolver-using-control-flow-graph-similarity-to-deobfuscate-golang-binaries-automatically\u002F)\n- [Go Reverse Engineering Tool Kit](https:\u002F\u002Fgo-re.tk\u002Fabout\u002F)\n- [SentinelOne AlphaGolang](https:\u002F\u002Fwww.sentinelone.com\u002Flabs\u002Falphagolang-a-step-by-step-go-malware-reversing-methodology-for-ida-pro\u002F)\n- [Go Binary Reversing Notes](https:\u002F\u002Fgist.github.com\u002F0xdevalias\u002F4e430914124c3fd2c51cb7ac2801acba)\n","# Analyzing Golang Malware with Ghidra\n\n## Overview\n\nGo (Golang) has become a popular language for malware authors due to its cross-compilation capabilities, static linking that produces self-contained binaries, and the complexity it introduces for reverse engineering. Go binaries contain the entire runtime, standard library, and all dependencies statically linked, resulting in large binaries (often 5-15MB) with thousands of functions. Ghidra struggles with Go-specific string formats (non-null-terminated), stripped function names, and goroutine concurrency patterns. Specialized tools like GoResolver (Volexity, 2025) use control-flow graph similarity to automatically deobfuscate and recover function names in stripped or obfuscated Go binaries.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing golang malware with ghidra\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Ghidra 11.0+ with JDK 17+\n- GoResolver plugin (for function name recovery)\n- Go Reverse Engineering Tool Kit (go-re.tk)\n- Python 3.9+ for helper scripts\n- Understanding of Go runtime internals (goroutines, channels, interfaces)\n- Familiarity with Go binary structure (pclntab, moduledata, itab)\n\n## Key Concepts\n\n### Go Binary Structure\n\nGo binaries embed rich metadata in the `pclntab` (PC Line Table) structure, which maps program counters to function names, source files, and line numbers. Even stripped binaries retain this metadata. The `moduledata` structure contains pointers to type information, itabs (interface tables), and the pclntab itself. Go strings are stored as a pointer-length pair rather than null-terminated C strings.\n\n### Function Recovery in Stripped Binaries\n\nDespite stripping symbol tables, Go binaries retain function names within the pclntab. However, obfuscation tools like garble rename functions to random strings. GoResolver addresses this by computing control-flow graph signatures of obfuscated functions and matching them against a database of known Go standard library and third-party package functions.\n\n### Crate\u002FDependency Extraction\n\nGo's dependency management embeds module paths and version strings in the binary. Extracting these reveals the malware's third-party dependencies (HTTP libraries, encryption packages, C2 frameworks), which provides insight into capabilities without full reverse engineering.\n\n## Workflow\n\n### Step 1: Initial Binary Analysis\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Analyze Go binary metadata for malware analysis.\"\"\"\nimport struct\nimport sys\nimport re\n\n\ndef find_go_build_info(data):\n    \"\"\"Extract Go build information from binary.\"\"\"\n    # Go buildinfo magic: \\xff Go buildinf:\n    magic = b'\\xff Go buildinf:'\n    offset = data.find(magic)\n    if offset == -1:\n        return None\n\n    print(f\"[+] Go build info at offset 0x{offset:x}\")\n\n    # Extract Go version string nearby\n    go_version = re.search(rb'go\\d+\\.\\d+(?:\\.\\d+)?', data[offset:offset+256])\n    if go_version:\n        print(f\"  Go Version: {go_version.group().decode()}\")\n\n    return offset\n\n\ndef find_pclntab(data):\n    \"\"\"Locate the pclntab (PC Line Table) structure.\"\"\"\n    # pclntab magic bytes vary by Go version\n    magics = {\n        b'\\xfb\\xff\\xff\\xff\\x00\\x00': \"Go 1.2-1.15\",\n        b'\\xfa\\xff\\xff\\xff\\x00\\x00': \"Go 1.16-1.17\",\n        b'\\xf1\\xff\\xff\\xff\\x00\\x00': \"Go 1.18-1.19\",\n        b'\\xf0\\xff\\xff\\xff\\x00\\x00': \"Go 1.20+\",\n    }\n\n    for magic, version in magics.items():\n        offset = data.find(magic)\n        if offset != -1:\n            print(f\"[+] pclntab found at 0x{offset:x} ({version})\")\n            return offset, version\n\n    return None, None\n\n\ndef extract_function_names(data, pclntab_offset):\n    \"\"\"Extract function names from pclntab.\"\"\"\n    if pclntab_offset is None:\n        return []\n\n    functions = []\n    # Function name strings follow specific patterns\n    func_pattern = re.compile(\n        rb'(?:main|runtime|fmt|net|os|crypto|encoding|io|sync|'\n        rb'syscall|reflect|strings|bytes|path|time|math|sort|'\n        rb'github\\.com|golang\\.org)[\u002F\\.][\\w\u002F.]+',\n    )\n\n    for match in func_pattern.finditer(data):\n        name = match.group().decode('utf-8', errors='replace')\n        if len(name) > 4 and len(name) \u003C 200:\n            functions.append(name)\n\n    return sorted(set(functions))\n\n\ndef extract_go_strings(data):\n    \"\"\"Extract Go-style strings (pointer+length pairs).\"\"\"\n    # Go strings are not null-terminated; extract readable sequences\n    strings = []\n    ascii_pattern = re.compile(rb'[\\x20-\\x7e]{10,}')\n\n    for match in ascii_pattern.finditer(data):\n        s = match.group().decode('ascii')\n        # Filter for interesting malware strings\n        interesting = [\n            'http', 'https', 'tcp', 'udp', 'dns',\n            'cmd', 'shell', 'exec', 'upload', 'download',\n            'encrypt', 'decrypt', 'key', 'token', 'password',\n            'c2', 'beacon', 'agent', 'implant', 'bot',\n            'mutex', 'persist', 'registry', 'scheduled',\n        ]\n        if any(kw in s.lower() for kw in interesting):\n            strings.append(s)\n\n    return strings\n\n\ndef extract_dependencies(data):\n    \"\"\"Extract Go module dependencies from binary.\"\"\"\n    deps = []\n    # Module paths follow pattern: github.com\u002Fuser\u002Frepo\n    dep_pattern = re.compile(\n        rb'((?:github\\.com|gitlab\\.com|golang\\.org|gopkg\\.in|'\n        rb'go\\.etcd\\.io|google\\.golang\\.org)\u002F[^\\x00\\s]{5,80})'\n    )\n\n    for match in dep_pattern.finditer(data):\n        dep = match.group().decode('utf-8', errors='replace')\n        deps.append(dep)\n\n    unique_deps = sorted(set(deps))\n    return unique_deps\n\n\ndef analyze_go_binary(filepath):\n    \"\"\"Full analysis of Go malware binary.\"\"\"\n    with open(filepath, 'rb') as f:\n        data = f.read()\n\n    print(f\"[+] Analyzing Go binary: {filepath}\")\n    print(f\"  File size: {len(data):,} bytes\")\n    print(\"=\" * 60)\n\n    # Build info\n    find_go_build_info(data)\n\n    # pclntab\n    pclntab_offset, go_version = find_pclntab(data)\n\n    # Functions\n    functions = extract_function_names(data, pclntab_offset)\n    print(f\"\\n[+] Recovered {len(functions)} function names\")\n\n    # Categorize functions\n    categories = {\n        \"network\": [], \"crypto\": [], \"os_exec\": [],\n        \"file_io\": [], \"main\": [], \"third_party\": [],\n    }\n    for f in functions:\n        if 'net\u002F' in f or 'http' in f.lower():\n            categories[\"network\"].append(f)\n        elif 'crypto' in f:\n            categories[\"crypto\"].append(f)\n        elif 'os\u002Fexec' in f or 'syscall' in f:\n            categories[\"os_exec\"].append(f)\n        elif 'os.' in f or 'io\u002F' in f:\n            categories[\"file_io\"].append(f)\n        elif f.startswith('main.'):\n            categories[\"main\"].append(f)\n        elif 'github.com' in f or 'golang.org' in f:\n            categories[\"third_party\"].append(f)\n\n    for cat, funcs in categories.items():\n        if funcs:\n            print(f\"\\n  [{cat}] ({len(funcs)} functions):\")\n            for fn in funcs[:10]:\n                print(f\"    {fn}\")\n\n    # Dependencies\n    deps = extract_dependencies(data)\n    print(f\"\\n[+] Dependencies ({len(deps)}):\")\n    for dep in deps[:20]:\n        print(f\"    {dep}\")\n\n    # Suspicious strings\n    sus_strings = extract_go_strings(data)\n    print(f\"\\n[+] Suspicious strings ({len(sus_strings)}):\")\n    for s in sus_strings[:20]:\n        print(f\"    {s}\")\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(f\"Usage: {sys.argv[0]} \u003Cgo_binary>\")\n        sys.exit(1)\n    analyze_go_binary(sys.argv[1])\n```\n\n### Step 2: Ghidra Analysis Script\n\n```python\n# Ghidra script (run within Ghidra's script manager)\n# Save as AnalyzeGoBinary.py in Ghidra scripts directory\n\n# @category MalwareAnalysis\n# @description Analyze Go binary structure and recover metadata\n\ndef analyze_go_binary_ghidra():\n    \"\"\"Ghidra script for Go binary analysis.\"\"\"\n    from ghidra.program.model.mem import MemoryAccessException\n\n    program = getCurrentProgram()\n    memory = program.getMemory()\n    listing = program.getListing()\n\n    print(\"[+] Go Binary Analysis Script\")\n    print(f\"  Program: {program.getName()}\")\n\n    # Find pclntab\n    pclntab_magics = [\n        bytes([0xf0, 0xff, 0xff, 0xff]),  # Go 1.20+\n        bytes([0xf1, 0xff, 0xff, 0xff]),  # Go 1.18-1.19\n        bytes([0xfa, 0xff, 0xff, 0xff]),  # Go 1.16-1.17\n        bytes([0xfb, 0xff, 0xff, 0xff]),  # Go 1.2-1.15\n    ]\n\n    for magic in pclntab_magics:\n        addr = memory.findBytes(\n            program.getMinAddress(), magic, None, True, None\n        )\n        if addr:\n            print(f\"[+] pclntab found at {addr}\")\n            # Create label\n            program.getSymbolTable().createLabel(\n                addr, \"go_pclntab\", None,\n                ghidra.program.model.symbol.SourceType.ANALYSIS\n            )\n            break\n\n    # Fix Go string definitions\n    # Go strings are ptr+len, not null terminated\n    print(\"[+] Fixing Go string references...\")\n\n    # Search for function names containing package paths\n    symbol_table = program.getSymbolTable()\n    func_count = 0\n    for symbol in symbol_table.getAllSymbols(True):\n        name = symbol.getName()\n        if ('.' in name and\n            any(pkg in name for pkg in\n                ['main.', 'runtime.', 'net.', 'crypto.', 'os.'])):\n            func_count += 1\n\n    print(f\"[+] Found {func_count} Go function symbols\")\n\n\n# Execute\nanalyze_go_binary_ghidra()\n```\n\n## Validation Criteria\n\n- Go version and build information extracted from binary\n- pclntab located and parsed for function name recovery\n- Third-party dependencies identified revealing malware capabilities\n- Main package functions enumerated for targeted analysis\n- Network, crypto, and OS exec functions categorized\n- Ghidra analysis correctly labels Go runtime structures\n\n## References\n\n- [CUJO AI - Reverse Engineering Go Binaries with Ghidra](https:\u002F\u002Fcujo.com\u002Fblog\u002Freverse-engineering-go-binaries-with-ghidra\u002F)\n- [Volexity GoResolver](https:\u002F\u002Fwww.volexity.com\u002Fblog\u002F2025\u002F04\u002F01\u002Fgoresolver-using-control-flow-graph-similarity-to-deobfuscate-golang-binaries-automatically\u002F)\n- [Go Reverse Engineering Tool Kit](https:\u002F\u002Fgo-re.tk\u002Fabout\u002F)\n- [SentinelOne AlphaGolang](https:\u002F\u002Fwww.sentinelone.com\u002Flabs\u002Falphagolang-a-step-by-step-go-malware-reversing-methodology-for-ida-pro\u002F)\n- [Go Binary Reversing Notes](https:\u002F\u002Fgist.github.com\u002F0xdevalias\u002F4e430914124c3fd2c51cb7ac2801acba)\n",{"name":5,"tags":43,"author":44,"domain":36,"license":14,"version":45,"subdomain":24,"description":7},[18,22,28,24,25,26,27],"mahipal","1.0","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-golang-malware-with-ghidra",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":54,"prompt":64,"zipAvailable":65},[55,58,61],{"tool":56,"command":57},"npx","npx skills add micsapp\u002Fmicstec-skills --skill analyzing-golang-malware-with-ghidra",{"tool":59,"command":60},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill analyzing-golang-malware-with-ghidra",{"tool":62,"command":63},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill analyzing-golang-malware-with-ghidra","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-golang-malware-with-ghidra\u002FSKILL.md",true,[67,73,78,84,88,92,98],{"path":68,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":71,"sourceHtmlUrl":72},"assets\u002Ftemplate.md","ASSET","资产文件",752,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-golang-malware-with-ghidra\u002Fassets\u002Ftemplate.md",{"path":74,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-golang-malware-with-ghidra\u002FLICENSE",{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fapi-reference.md","REFERENCE","参考文档",2602,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-golang-malware-with-ghidra\u002Freferences\u002Fapi-reference.md",{"path":85,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Fstandards.md",882,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-golang-malware-with-ghidra\u002Freferences\u002Fstandards.md",{"path":89,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fworkflows.md",1606,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-golang-malware-with-ghidra\u002Freferences\u002Fworkflows.md",{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"scripts\u002Fagent.py","SCRIPT","脚本",9117,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-golang-malware-with-ghidra\u002Fscripts\u002Fagent.py",{"path":99,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":100,"sourceHtmlUrl":101},"scripts\u002Fprocess.py",4706,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-golang-malware-with-ghidra\u002Fscripts\u002Fprocess.py",[103,141,171,192,212,237],{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":120,"publishedAt":38},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[110,115],{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":116,"categoryName":117,"taxonomyType":118,"taxonomyTypeDesc":119},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140],"architecture","azure","azure apim architecture","component","authentication","gateway","topology","Optimization","network","api","team","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode","for",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":155,"publishedAt":38},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[147,148,151,154],{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},{"categoryNo":149,"categoryName":150,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":152,"categoryName":153,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":116,"categoryName":117,"taxonomyType":118,"taxonomyTypeDesc":119},[156,157,158,159,122,160,161,162,163,164,165,166,130,131,137,167,168,138,169,170],"deployment","apiops deployment","workflows","azure devops","infrastructure","code","infrastructure as code","actions","ci","github actions","github-actions","as","guides","CI\u002FCD","implementing",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":178,"publishedAt":38},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[177],{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},[179,180,181,182,122,125,130,131,183,184,185,186,187,188,189,138,190,191,170,140],"policy","authoring","apim policy authoring","security","access","use","ready","api security","Access Control","error","processing","cors configuration","production-ready",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":200,"publishedAt":38},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[198,199],{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},{"categoryNo":116,"categoryName":117,"taxonomyType":118,"taxonomyTypeDesc":119},[201,182,202,130,186,203,122,156,204,205,206,207,131,208,138,209,210,211,139,140],"review","security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":218,"publishedAt":38},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[219,220,221,158,222,223,224,225,130,226,227,228,229,230,231,232,233,234,235,236],"cli","jira","jira cli","init","tasks","create","issues","common","work","command","edit","list","view","project","project work","token","line","sprints",{"skillNo":238,"name":239,"nameZh":6,"description":240,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":241,"categories":242,"keywords":243,"publishedAt":38},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[239,244,245,246,247,248,249,184,250,251],"npm","js","calculate","node","math","user","compute","errors"]