go-rust-reverse – Coding skill for AI agents

Reverse engineer stripped Go and Rust binaries: runtime recognition, pclntab/module metadata recovery, panic-string analysis, and idiomatic decompilation strategies.

CodingSKILL.mdClaude Code · Codex · Hermes · DeepSeek

Install the go-rust-reverse skill with one command

Pick the tool you use, copy the command and paste it in your terminal. The skill lands in that tool's skills folder and is ready in your next session.

Claude Code

mkdir -p ~/.claude/skills && curl -fsSL https://skill.dn1nguoi.com/z/go-rust-reverse-69873.tgz | tar xz -C ~/.claude/skills

Call it in Claude Code: /go-rust-reverse – then describe the task you want done.

Codex

mkdir -p ~/.codex/skills && curl -fsSL https://skill.dn1nguoi.com/z/go-rust-reverse-69873.tgz | tar xz -C ~/.codex/skills

Call it in Codex: $go-rust-reverse – then describe the task you want done.

Hermes Agent

mkdir -p ~/.hermes/skills && curl -fsSL https://skill.dn1nguoi.com/z/go-rust-reverse-69873.tgz | tar xz -C ~/.hermes/skills

Call it in Hermes Agent: /go-rust-reverse – then describe the task you want done.

DeepSeek

mkdir -p ~/.deepcode/skills && curl -fsSL https://skill.dn1nguoi.com/z/go-rust-reverse-69873.tgz | tar xz -C ~/.deepcode/skills

Call it in DeepSeek: /go-rust-reverse – then describe the task you want done.

SKILL.md content

Go / Rust Binary Reverse Engineering

When to Use

Analyzing a stripped Go or Rust binary where symbols are absent.
Recovering function boundaries and names from language-specific metadata.

适用场景

剥离符号的 Go 恶意软件/工具
Rust 发行二进制、panic 字符串驱动分析
与通用 ida/ghidra 互补的语言专用方法

工作流

Go

□ 识别 go.buildid、runtime 符号残留、pclntab
□ GoReSym / redress / IDA Go 插件恢复函数名
□ 注意 interface、slice、string 结构在反编译中的形态
□ 网络/加密库路径：crypto/* net/http

Rust

□ panic 字符串、rust_begin_unwind、crate 路径暗示
□ 范型实例化导致的代码膨胀；先定位字符串 xref
□ 异步/tokio 状态机需结合交叉引用

动态

□ 仍可用 Frida；注意 Go 栈与调度
□ 优先日志与配置字符串驱动断点

工具链

| 工具 | 用途 |

|------|------|

| GoReSym | Go 元数据 |

| IDA/Ghidra + Go/Rust 插件 | 反编译 |

| radare2 | 快速字符串 |

| strings / rabin2 | 分诊 |

参考

references/go-rust-notes.md
../reverse-engineering/go-reverse.md ../ida-reverse/ ../ghidra-reverse/
seed: field-journal/seed-002_go-malware-stripped.md

路由上下文

上游: MASTER R33

下游: 恶意样本流程 malware-analysis；通用 RE reverse-engineering

任务完成自检

[ ] 是否恢复关键函数名或等价映射？
[ ] 是否标注语言运行时证据？
[ ] Checklist？

Limitations

New compiler versions change metadata layouts; tooling must be kept current.
Aggressive inlining still yields large, hard-to-read decompilation.

> Adapted from [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) (MIT).

Related skills

golang-pro – Master Go 1.21+ with modern patterns, advanced concurrency, performance optimization…
google-no-code – Design Google Forms and wire Apps Script triggers (onFormSubmit) for email alerts…
graphql-schema – GraphQL queries, mutations, and code generation patterns. Use when creating GraphQL…
grok-delegate – Delegate coding tasks to the Grok Build CLI only when the user explicitly requests it…
grpc-golang – Build production-ready gRPC services in Go with mTLS, streaming, and observability. Use…
hasdata-cli – Command-line access to search, scraping, and structured web data.
site-architecture – When the user wants to audit, redesign, or plan their website's structure, URL…
skill-doctor – Use when the user wants their agent setup graded from real conversation history, asks…

← Browse all skills