Lion Cipher Lab
Attribute a Go-compiled binary by its build toolchain (recover what stripped strings hide)
- Threat Intel Analyst
- Advanced
- ~75 min
- Free · no account required
Why it matters
A growing share of commodity and targeted malware is written in Go, and Go quietly breaks the reflexes analysts built on C/C++ Windows malware: the binary is statically linked so there is no informative import table to read, the Go runtime bloats it, and `strings` output drowns in runtime noise. Analysts who don't adjust conclude 'it's packed / I can't tell what it does' and stall. But Go binaries carry rich internal structure — function names, source paths, the exact compiler version, the developer's module namespace, and sometimes VCS build info — that survives stripping and can be…
What you'll learn
- Reverse-engineering triage of Go binaries
- Recovering build metadata (go version -m / buildinfo)
- Recovering symbols from the pclntab with GoReSym
- Toolchain-based attribution reasoning
- Estimative language and false-flag skepticism
Steps in this lab
- Why Go breaks your normal triage reflex
- Confirm the Go toolchain is installed
- Write a tiny, benign Go program with recognisable names
- Build two versions: normal, and fully stripped
- Watch naive triage fail on the stripped binary
- Recover build metadata that survives stripping: `go version -m`
- Recover function names and source paths from the pclntab with GoReSym
- Feed the symbols back into Ghidra (described)
- The attribution judgment — and the false-flag caveat