Why Go Malware Is Harder to Analyze Than C

▶ Watch (5:53)

A “hello world” Go binary compiles to 2.2 MB. The same C binary is 16 KB. Go includes the runtime and a thousand internal functions. Strings use length-prefixed structures – a pointer and an integer – instead of null terminators. The Go PC-line table, introduced in Go 1.2, maps addresses to line numbers. It helps recover function names. The magic number changes with each Go version.

Traditional Tooling for Go Reverse Engineering

▶ Watch (11:34)

First step: locate the symbol table. If stripped, find the Go PC-line table. If neither exists as a section, scan the binary for the magic number. GoStrings, from NCC Group, parses strings correctly after removing predefined rodata strings and known library strings. IDA Pro 9.3 improved its Go support. Ghidra with the Golang compiler setting still misses some strings. GoStrings recovers them.

AI-Assisted Tooling With R2AI

▶ Watch (14:22)

The R2AI plugin in R2 has two models. R2AI acts like Clippy – it suggests commands you can accept or modify. DK is an LLM-based decompiler. It takes assembly instructions and outputs pseudo code. You can ask what a function prints or search for dangerous functions. The plugin supports local, open-source, and commercial models. Davila used Gemini 2.5. The tool can rename functions and variables automatically.

MCP and Agents for Malware Analysis

▶ Watch (18:55)

MCP bridges RE tools with a single API. Davila demonstrated Claude Desktop with R2MCP on R2. The agent asked for permission, ran R2 commands, and returned both execution flow and results. OpenCode is a simpler CLI agent that gave full access to the binary. Sidekick, embedded in Binary Ninja, has a manual and a guided mode. Davila’s rule: guide the model, don’t let it guide you.

Real-World Analysis: Pumabot and GreenBlood

▶ Watch (22:06)

Sidekick identified Pumabot as an SSH brute-forcer targeting Pumatronics cameras. It found the C2 domain but misidentified evasion techniques. For GreenBlood ransomware, Davila used OpenCode with a structured plan (skills). A $1 report found 50+ file types, missing the encryption algorithm. A $5 report with Opus 4.6 found 140+ file types and the precise Go version 1.24. Both reports confused the encryption algorithm.

Limitations and Key Takeaways

▶ Watch (36:42)

AI models fail at IP address identification when addresses are stored as decimals. They confuse encryption algorithms and miss persistence techniques. Packed binaries rarely unpack correctly. Use AI for chunk analysis and triage. Human verification remains required. Davila’s advice: provide a step-by-step plan for the model. Treat AI as a faster sandbox, not a oracle.

Q&A

Does Go have the same aggressive inlining problem as C++? Yes, the main differences are string handling and symbol obfuscation. Unpacking techniques are identical. ▶ 41:12

What is the benefit of using different tools through MCP servers? Davila prefers R2 for scripting and IDA Pro for manual decompilation. R2 has a Python API; Ghidra requires Java scripting, which he avoids. ▶ 43:50

Your thoughts on using MCP for CTFs? Using LLMs in CTFs depends on the goal. If the aim is learning, feeding the challenge to a model defeats the purpose. If earning points and testing model capability is fine, go ahead. CTF developers must design challenges that resist LLM solvers. ▶ 45:42

Notable Quotes

“don’t be afraid of opening different file structures” Asher Davila · ▶ 36:42

“you should be the one that guide the model” Asher Davila · ▶ 35:18

“this is nothing different from providing a sandbox” Asher Davila · ▶ 38:13

“I think it’s just like any other sandbox” Asher Davila · ▶ 38:25

“the more descriptive you are the better results” Asher Davila · ▶ 23:57

Key Takeaways

  • Combine traditional RE tools with AI agents for faster malware triage.
  • Guide the model with step-by-step plans, not the reverse.
  • Verify AI results manually; models confuse encryption algorithms and miss persistence.