Tool
GoReSym
Recover Go build metadata, function names and address ranges, source file and line tables, embedded types and strings from Go binaries, including stripped and some malformed unpacked samples. JSON output can be imported into IDA Pro with the included IDAPython script.
- Targets
- Binary
- Category
- Native analysis tools
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Reviewed release: v3.4.1, published 2026-09-14 and tagged at the reviewed commit, with prebuilt Linux, macOS and Windows archives; source builds need a recent Go toolchain.
- Documented support covers ARM64 and Intel x86/x64 Mach-O, ELF and PE binaries in either endianness; pclntab parsing and moduledata location need Go 1.2+, and type parsing Go 1.5+. Some stripped binaries need a manual version override, and type parsing fails if that version is wrong.
- MIT. Output is runtime and symbol metadata, not original source or decompiled code. The README's write-up link now redirects to a generic Mandiant page; the article is on the Google Cloud blog.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · mandiant/GoReSym · Revision 722897e
- LICENSE GitHub · mandiant/GoReSym · Revision 722897e
- IDAPython/goresym_rename.py GitHub · mandiant/GoReSym · Revision 722897e
- https://github.com/mandiant/GoReSym/releases/tag/v3.4.1
- https://cloud.google.com/blog/topics/threat-intelligence/golang-internals-symbol-recovery
More in Native binaries
- rev.ng · Tool
- Rizin · Tool
- Decompiler Explorer · Tool
- pwndbg · Tool
- DynamoRIO · Tool
- Decompyle++ (pycdc) · Tool