GoResolver: Using Control-flow Graph Similarity to Deobfuscate Golang Binaries, Automatically

Volexity presents GoResolver, an open-source toolchain that enhances reverse engineering of obfuscated Golang malware by correlating control-flow graph similarities with extracted runtime symbols to recover meaningful function and package names. The report details Garble obfuscation characteristics, outlines how GoResolver fingerprints Golang runtime versions, and demonstrates workflow and results through a Stowaway case study, along with installation guidance and plugins for IDA Pro and Ghidra to streamline symbol import and analysis.