analyzing-golang-malware-with-ghidra

What problem does it solve?

Reverse engineer Go-compiled malware binaries using Ghidra with specialized scripts to recover function names, extract strings, and reconstruct types in stripped Go binaries.

Core Features & Use Cases

• Go binary metadata extraction (pclntab, buildinfo) to identify Go version and structure.
• Function name recovery in stripped Go binaries using GoResolver-guided workflows.
• Dependency extraction and detection of suspicious strings to map potentially malicious behavior.
• Ghidra automation with Python scripts to streamline Go malware analysis.

Quick Start

Analyze a stripped Go malware binary with the included Ghidra scripts and Python agents to recover function names, extract strings, and map dependencies.