GoResolver: Using Control-flow Graph Similarity to Deobfuscate Golang Binaries, Automatically
Summary: Volexity released GoResolver, an open-source tool that uses control-flow graph similarity to recover original package and function names from Golang binaries obfuscated with tools such as Garble. The tool fingerprints the Go runtime version by testing only 2% of it, then compares the sample against clean templates compiled with that version, and ships as a pip-installable package with plugins for IDA Pro and Ghidra.
Key Takeaway: Garble strips the symbol table and BuildInfo, so analysts are left with generic sub_OFFSET names and a binary full of embedded libraries; GoResolver's partial symbol recovery lets them skip reversing runtime and library methods and spend that time on the malware's actual core logic.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026