AwesomeREA.org

Tool

GolangAnalyzerExtension

Ghidra extension whose Golang Analyzer reads the runtime header and module data in Go binaries built with go1.6 through go1.27 to identify the Go version, rename functions, correct their arguments, comment source files and line numbers, add Go types to the Data Type Manager and label Go strings. A plugin window lists the recovered functions, types, source files and strings with links to Go source, and WebAssembly builds are handled when a separate Wasm loader such as ghidra-wasm-plugin is installed. A bundled script also renames functions that decode gobfuscate-style obfuscated strings and comments the decoded text.

Targets
Binary
Category
Native analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Latest release at review: 1.4.0, published 2026-07-21 from the reviewed master commit, with notes stating support for go1.6 through go1.27. It provides prebuilt zips for Ghidra 12.0 through 12.0.4 and for 12.1, 12.1.2, 12.1.3 and 12.1.4, the last two built on 2026-10-14; install the zip matching the Ghidra release through File > Install Extensions and restart Ghidra. Source builds use Gradle with GHIDRA_INSTALL_DIR set to a Ghidra installation.
  • Analysis runs on Go executables the user supplies, and the analyzer is enabled by default. Source has function handlers for x86, ARM, PowerPC and RISC-V; WebAssembly needs a separate Wasm loader. Function disassembly is off by default, and optional PcHeader-address and Go-version settings override detection. Function-name guessing by pattern matching and BSim exists in source, but its option is not registered and stays off.
  • The repository commits generated name-guessing data: a 4.3 MB list of calling-function names under test resources and a 53 KB H2 BSim database under scripts, with scripts that produce them by compiling a small sample Go program with each listed Go toolchain and running Ghidra headless. The copy under src/main/resources is empty at this commit, and no target binaries are committed. JUnit tests cover version, header, string and name-data parsing; there is no CI workflow, and this review built, installed and ran nothing.
  • The MIT license sits in GolangAnalyzerExtension/LICENSE (2021, mooncat-greenpy); it is not at the repository root, so GitHub detects no license. Output annotates the Ghidra program and needs analyst checking; it does not produce Go source. The reviewed sources establish no REA or AI use.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · mooncat-greenpy/Ghidra_GolangAnalyzerExtension · Revision c0d1540
  2. https://github.com/mooncat-greenpy/Ghidra_GolangAnalyzerExtension/releases/tag/1.4.0
  3. GolangAnalyzerExtension/LICENSE GitHub · mooncat-greenpy/Ghidra_GolangAnalyzerExtension · Revision c0d1540
  4. GolangAnalyzerExtension/build.gradle GitHub · mooncat-greenpy/Ghidra_GolangAnalyzerExtension · Revision c0d1540
  5. GolangAnalyzerExtension/src/main/java/golanganalyzerextension/AnalyzerOption.java GitHub · mooncat-greenpy/Ghidra_GolangAnalyzerExtension · Revision c0d1540
  6. GolangAnalyzerExtension/src/main/java/golanganalyzerextension/GolangAnalyzerExtensionAnalyzer.java GitHub · mooncat-greenpy/Ghidra_GolangAnalyzerExtension · Revision c0d1540
  7. GolangAnalyzerExtension/src/main/java/golanganalyzerextension/function/GolangFunction.java GitHub · mooncat-greenpy/Ghidra_GolangAnalyzerExtension · Revision c0d1540
  8. GolangAnalyzerExtension/ghidra_scripts/degobfuscate.py GitHub · mooncat-greenpy/Ghidra_GolangAnalyzerExtension · Revision c0d1540
  9. scripts/extract.sh GitHub · mooncat-greenpy/Ghidra_GolangAnalyzerExtension · Revision c0d1540
  10. scripts/build/build.sh GitHub · mooncat-greenpy/Ghidra_GolangAnalyzerExtension · Revision c0d1540

More in Native binaries

All 129 entries in Native binaries