# Analyzing Golang Malware With Ghidra

Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab...

- Repository: https://github.com/mukul975/Anthropic-Cybersecurity-Skills (35398 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-08-31
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-golang-malware-with-ghidra -g -a claude-code -y`
Codex: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-golang-malware-with-ghidra -g -a codex -y`
Cursor: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-golang-malware-with-ghidra -g -a cursor -y`
Gemini CLI: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-golang-malware-with-ghidra -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add mukul975/Anthropic-Cybersecurity-Skills`

## Description

Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a garble-packed Go binary, or recovering function names and third-party dependencies from a stripped Go executable.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Analyzing Golang Malware with Ghidra

## Overview

Go (Golang) has become a popular language for malware authors due to its cross-compilation capabilities, static linking that produces self-contained binaries, and the complexity it introduces for reverse engineering. Go binaries contain the entire runtime, standard library, and all dependencies statically linked, resulting in large binaries (often 5-15MB) with thousands of functions. Ghidra struggles with Go-specific string formats (non-null-terminated), stripped function names, and goroutine concurrency patterns. Specialized tools like GoResolver (Volexity, 2025) use control-flow graph similarity to automatically deobfuscate and recover function names in stripped or obfuscated Go binaries.


## When to Use

- When investigating security incidents that require analyzing golang malware with ghidra
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques

## Prerequisites

- Ghidra 11.0+ with JDK 17+
- GoResolver plugin (for function name recovery)
- Go Reverse Engineering Tool Kit (go-re.tk)
- Python 3.9+ for helper scripts
- Understanding of Go runtime internals (goroutines, channels, interfaces)
- Familiarity with Go binary structure (pclntab, moduledata, itab)

## Key Concepts

### Go Binary Structure

Go binaries embed rich metadata in the `pclntab` (PC Line Table) structure, which maps program counters to function names, source files, and line numbers. Even stripped binaries retain this metadata. The `moduledata` structure contains pointers to type information, itabs (interface tables), and the pclntab itself. Go strings are stored as a pointer-length pair rather than null-terminated C strings.

### Function Recovery in Stripped Binaries

The rest: https://github.com/mukul975/Anthropic-Cybersecurity-Skills/blob/HEAD/skills/analyzing-golang-malware-with-ghidra/SKILL.md