go-rust-reverse
starsforks
How to install go-rust-reverse?
zhaoxuya520/reverse-skill/go-rust-reverse
$npx -y skills add zhaoxuya520/reverse-skill --skill go-rust-reverseUse for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery.
SKILL.md
| 1 | # Go / Rust Binary Reverse Engineering |
| 2 | |
| 3 | ## ACTION REQUIRED（读完后立刻执行） |
| 4 | |
| 5 | 1. `NOW`: 读取 `../field-journal/precedent-reverse.md` |
| 6 | 2. `NOW`: 确认样本为 Go/Rust 编译产物（`file`/字符串/运行时特征） |
| 7 | 3. `NEXT`: GoReSym / 相关插件是否可用 |
| 8 | 4. `ACT`: 运行时识别 → 符号/元数据恢复 → 业务逻辑 |
| 9 | |
| 10 | ## 适用场景 |
| 11 | |
| 12 | - 剥离符号的 Go 恶意软件/工具 |
| 13 | - Rust 发行二进制、panic 字符串驱动分析 |
| 14 | - 与通用 ida/ghidra 互补的语言专用方法 |
| 15 | |
| 16 | ## 工作流 |
| 17 | |
| 18 | ### Go |
| 19 | |
| 20 | ```text |
| 21 | □ 识别 go.buildid、runtime 符号残留、pclntab |
| 22 | □ GoReSym / redress / IDA Go 插件恢复函数名 |
| 23 | □ 注意 interface、slice、string 结构在反编译中的形态 |
| 24 | □ 网络/加密库路径：crypto/* net/http |
| 25 | ``` |
| 26 | |
| 27 | ### Rust |
| 28 | |
| 29 | ```text |
| 30 | □ panic 字符串、rust_begin_unwind、crate 路径暗示 |
| 31 | □ 范型实例化导致的代码膨胀；先定位字符串 xref |
| 32 | □ 异步/tokio 状态机需结合交叉引用 |
| 33 | ``` |
| 34 | |
| 35 | ### 动态 |
| 36 | |
| 37 | ```text |
| 38 | □ 仍可用 Frida；注意 Go 栈与调度 |
| 39 | □ 优先日志与配置字符串驱动断点 |
| 40 | ``` |
| 41 | |
| 42 | ## 工具链 |
| 43 | |
| 44 | | 工具 | 用途 | |
| 45 | |------|------| |
| 46 | | GoReSym | Go 元数据 | |
| 47 | | IDA/Ghidra + Go/Rust 插件 | 反编译 | |
| 48 | | radare2 | 快速字符串 | |
| 49 | | strings / rabin2 | 分诊 | |
| 50 | |
| 51 | ## 参考 |
| 52 | |
| 53 | - `references/go-rust-notes.md` |
| 54 | - `../reverse-engineering/go-reverse.md` `../ida-reverse/` `../ghidra-reverse/` |
| 55 | - seed: `field-journal/seed-002_go-malware-stripped.md` |
| 56 | |
| 57 | ## 路由上下文 |
| 58 | |
| 59 | **上游**: MASTER R33 |
| 60 | **下游**: 恶意样本流程 `malware-analysis`；通用 RE `reverse-engineering` |
| 61 | |
| 62 | ## 任务完成自检 |
| 63 | |
| 64 | - [ ] 是否恢复关键函数名或等价映射？ |
| 65 | - [ ] 是否标注语言运行时证据？ |
| 66 | - [ ] Checklist？ |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
