Tool
GoReSym
Recover Go build metadata, function names and address ranges, source file and line tables, embedded types and strings from Go binaries, including stripped and some malformed unpacked samples. JSON output can be imported into IDA Pro with the included IDAPython script.
Requirements and limitations
- Reviewed release: v3.4.1, published 2026-09-14 and tagged at the reviewed commit, with prebuilt Linux, macOS and Windows archives; source builds need a recent Go toolchain.
- Documented support covers ARM64 and Intel x86/x64 Mach-O, ELF and PE binaries in either endianness; pclntab parsing and moduledata location need Go 1.2+, and type parsing Go 1.5+. Some stripped binaries need a manual version override, and type parsing fails if that version is wrong.
- MIT. Output is runtime and symbol metadata, not original source or decompiled code. The README's write-up link now redirects to a generic Mandiant page; the article is on the Google Cloud blog. No binaries were analyzed.
About this entry
- Type
- Tool
- Category
- Native analysis tools
- Relationship
- Foundation tool
- Targets
- Binary
Sources reviewed
The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.
Primary sources
- https://github.com/mandiant/GoReSym/blob/722897e0a80da0a06c00c5e40591a253a551f04e/README.md
- https://github.com/mandiant/GoReSym/blob/722897e0a80da0a06c00c5e40591a253a551f04e/LICENSE
- https://github.com/mandiant/GoReSym/blob/722897e0a80da0a06c00c5e40591a253a551f04e/IDAPython/goresym_rename.py
- https://github.com/mandiant/GoReSym/releases/tag/v3.4.1
- https://cloud.google.com/blog/topics/threat-intelligence/golang-internals-symbol-recovery