Go / Rust binary reversing

When it applies

You have a stripped binary in scope (tradecraft-scope-roe, scope.txt) and triage (reverse-eng-binary-triage) shows Go or Rust residue — a Go malware sample, a Rust release build, a Go-compiled red-team tool. Generic decompilation drowns you in runtime code; these languages carry enough metadata to rebuild the symbol map first.

Why it works

Both toolchains ship binaries that are mostly runtime, but both embed rich metadata: Go keeps the pclntab (function names, file:line, type info) even when the symbol table is stripped, and Rust leaks panic strings with full source paths. Recovering that metadata turns an anonymous blob back into named functions, and the runtime residue itself fingerprints the language and version.