Analyzing Go Binaries

Go binaries look hostile — statically linked, tens of megabytes, no imports you recognize, and "stripped" in a way that makes tools show thousands of sub_ functions. They are not. Go ships its own symbol table for runtime reflection and panic traces, and strip does not remove it. Recover it and the binary becomes one of the easiest targets there is.

When to Use

• strings shows runtime.main, go:buildid, go.buildinfo, or runtime.gopanic
• A "stripped" binary is 5–50 MB with almost no dynamic imports
• The disassembler shows thousands of unnamed functions and unreadable strings
• Analyzing Go malware, a Go CLI tool, or a compiled Go service

When NOT to Use