Anthropic-Cybersecurity-Skills/skills/analyzing-golang-malware-with-ghidra/references/workflows.md

# Go Malware Analysis Workflows

## Workflow 1: Stripped Binary Recovery
```
[Stripped Go Binary] --> [Find pclntab] --> [Recover Function Names]
                                                    |
                                                    v
                                           [Apply GoResolver] --> [Deobfuscate Names]
                                                                        |
                                                                        v
                                                               [Categorize Functions]
```

## Workflow 2: Full Ghidra Analysis
```
[Go Binary] --> [Import to Ghidra] --> [Run Go Analysis Scripts]
                                              |
                                              v
                                    [Fix String References]
                                              |
                                              v
                                    [Identify main Package]
                                              |
                                              v
                                    [Analyze C2/Network Logic]
```

## Workflow 3: Dependency-Based Capability Assessment
```
[Go Binary] --> [Extract Module Info] --> [List Dependencies]
                                                |
                                                v
                                       [Map to Capabilities]
                                                |
                                                v
                                       [Prioritize Analysis]
```