Reverse engineering a Go binary
Cursor, connected to Ghidra through a GhidraMCP server, analyzed a stripped Golang HTTP binary and identified its libraries, API routes, and file structure.
The agent rebuilt readable Go source from the stripped binary, but got some route paths wrong, such as /my-messages instead of /me/messages.
Overview
How it was set up
Cursor with the GhidraMCP bridge. Ghidra with the Golang Analyzer Extension to restore symbols in the stripped binary. Any MCP-capable agent would also work.
Worth knowing
Tested on a small demo server, not a large program. Some routes were wrong, and parts looked skipped lazily.
A prompt to start from
I am reverse engineering a Golang binary. Use Ghidra MCP to tell me what kind of program it is and what functions it has. Then convert the decompiled C back into Go.
Written by Agentic Feats from the source. Not the author's exact prompt.
Sources 1
History
- Source published
- 2026-03-01
- Added to Agentic Feats
- 2026-10-13
- Pick
- No
- Markdown copy
- /c/reverse-engineering-a-go-binary-cursor.md
More in coding
68 featsResultA live blog aggregator pulling posts from Dev.to, AWS Community Builders, Bravo LT and RedMonk, built and deployed in a single day.
ResultA live MVP website for the podcast and newsletter went up after about 10 hours of struggling to load it on a custom URL.
ResultWithin one night Devin produced a working unanswered-emails interface using the Gmail API, after the author wrote the authentication code themselves.