Crate gobin 

gobin: Go Binary Reverse Engineering Library

A pure-Rust library for statically analyzing compiled Go binaries. Given an arbitrary byte slice, gobin can determine whether it was produced by the Go toolchain and extract rich metadata that the Go runtime embeds in every binary.

Motivation

Go binaries are unusually rich targets for static analysis. Unlike C/C++ binaries, stripped Go binaries still contain:

• Full function names (package-qualified, e.g. net/http.(*Client).Do)
• Source file paths (the full path used at compile time)
• Go version and module dependency information
• Type descriptors for every type used in the program

This metadata survives stripping (-ldflags="-s -w") because the Go runtime requires it for stack traces, garbage collection, and interface dispatch. These structures are defined in the Go source tree under src/runtime/ and src/internal/abi/.

Quick Start

use gobin::GoBinary;

let data = std::fs::read("some_binary").unwrap();
if let Some(bin) = GoBinary::parse(&data) {
    println!("Go version: {:?}", bin.go_version());
    for f in bin.functions() {
        println!("  {}", f.name);
    }
}

Supported Formats

Format	Detection	Build ID	Build Info	pclntab	Functions
ELF	Yes	ELF note + raw	Yes	Yes	Yes
Mach-O	Yes	Raw marker	Yes	Yes	Yes
PE	Yes	Raw marker	Yes	Yes	Yes
Wasm	Yes	go:buildid section	Version only	Yes	Yes

Wasm support reconstructs a single linear-memory image from the wasm Data section’s individual segments so runtime structures (pclntab, moduledata, type descriptors) that span multiple disjoint segments can be addressed by their linear-memory VA — see structures::wasm and the BinaryFormat::Wasm variant rustdoc for details.

Architecture

The crate is organized into two API layers:

• Low-level: formats::BinaryContext parses the binary format once and provides zero-copy section slicing, VA translation, and ELF note access. Individual structure parsers (structures::pclntab, structures::buildid, etc.) take &BinaryContext.
• High-level: GoBinary wraps BinaryContext and performs the full Go metadata extraction pipeline, exposing comfortable accessors for functions, types, build info, etc.

Modules

detection

Go binary detection via heuristic string matching.

formats

Binary format detection and Go-specific section discovery.

metadata

High-level metadata extracted from Go binaries.

structures

Parsers for Go runtime structures embedded in compiled binaries.

Structs

GoBinary

A parsed Go binary with all extractable metadata.

Functions

detect

Fast best-effort check for “is this byte slice a Go binary?” without running the full parse pipeline.