{
  "added_at": "2026-10-17",
  "additional_evidence_urls": [
    "https://github.com/mandiant/GoReSym/blob/722897e0a80da0a06c00c5e40591a253a551f04e/LICENSE",
    "https://github.com/mandiant/GoReSym/blob/722897e0a80da0a06c00c5e40591a253a551f04e/IDAPython/goresym_rename.py",
    "https://github.com/mandiant/GoReSym/releases/tag/v3.4.1",
    "https://cloud.google.com/blog/topics/threat-intelligence/golang-internals-symbol-recovery"
  ],
  "category": "native-analysis",
  "description_en": "Recover Go build metadata, function names and address ranges, source file and line tables, embedded types and strings from Go binaries, including stripped and some malformed unpacked samples. JSON output can be imported into IDA Pro with the included IDAPython script.",
  "description_zh": "从 Go 二进制中恢复构建元数据、函数名与地址范围、源文件和行号表、内嵌类型及字符串，也可处理已剥离符号以及部分经 UPX 等脱壳后结构异常的样本。JSON 输出可借助附带的 IDAPython 脚本导入 IDA Pro。",
  "entry_url": "https://awesomerea.org/resources/goresym/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/goresym/",
  "evidence_url": "https://github.com/mandiant/GoReSym/blob/722897e0a80da0a06c00c5e40591a253a551f04e/README.md",
  "group": "tools",
  "id": "goresym",
  "json_url": "https://awesomerea.org/resources/goresym/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/goresym/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/goresym/index.md",
  "name": "GoReSym",
  "name_zh": "GoReSym Go 符号恢复工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Reviewed release: v3.4.1, published 2026-09-14 and tagged at the reviewed commit, with prebuilt Linux, macOS and Windows archives; source builds need a recent Go toolchain.",
    "Documented support covers ARM64 and Intel x86/x64 Mach-O, ELF and PE binaries in either endianness; pclntab parsing and moduledata location need Go 1.2+, and type parsing Go 1.5+. Some stripped binaries need a manual version override, and type parsing fails if that version is wrong.",
    "MIT. Output is runtime and symbol metadata, not original source or decompiled code. The README's write-up link now redirects to a generic Mandiant page; the article is on the Google Cloud blog."
  ],
  "requirements_zh": [
    "所审阅版本为 v3.4.1，发布于 2026-09-14，其标签指向所审阅的提交，提供 Linux、macOS 和 Windows 预编译压缩包；从源码构建需要较新的 Go 工具链。",
    "文档所列支持范围涵盖 ARM64 与 Intel x86/x64 架构、Mach-O/ELF/PE 格式及大小端的各种组合；pclntab 解析和 moduledata 定位需要 Go 1.2+，类型解析需要 Go 1.5+。部分已剥离符号的二进制需手动指定 Go 版本，若版本不准确，类型解析会失败。",
    "采用 MIT 许可。输出是运行时与符号元数据，并非原始源码或反编译代码。README 中的技术文章链接现跳转到 Mandiant 通用页面，文章本身位于 Google Cloud 博客。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/mandiant/GoReSym",
  "verification": "source-reviewed",
  "verified_at": "2026-10-17"
}