Behind the Binary by Google Cloud Security
Welcome to Behind the Binary, the podcast that introduces you to the fascinating people, technology, and tools driving the world of reverse engineering. Join your host, Josh Stroschein, a reverse engineer with the FLARE team at Google, and someone passionate about sharing knowledge and shedding light on the art of reverse engineering, as he sits down with intriguing guests to explore the human side of this profession.
Behind the Binary goes beyond the code, sharing the stories, motivations, and unique perspectives of the individuals who dedicate their lives to unraveling the complexities of technology. We'll hear about their journeys into the field, the challenges they face, and the impact their work has on securing our digital world.
Whether you're a seasoned malware analyst, a software developer, a security researcher, or just someone curious about the world of reverse engineering, Behind the Binary offers insightful and engaging conversations for everyone interested in this fascinating field.
Behind the Binary by Google Cloud Security
EP27 The Challenges of Reversing Modern Languages: From C++ to Go and Rust with Jae Young Kim
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
When malware analysis first emerged, reverse engineers typically operated in a straightforward C landscape — standard Win32 APIs, no massive runtimes, and clear code paths. Today, the landscape has fundamentally shifted. The natural progression to C++ introduced object-oriented hurdles like virtual function tables and standard template library bloat, laying the groundwork for the complexities we see in today's modern ecosystem. In this episode of Behind the Binary, we sit down with Jae Young Kim from the FLARE team to discuss navigating this evolution and what it actually takes to reverse engineer modern compiled languages like Go and Rust.
Jae walks us through his journey of diving head-first into the Go compiler architecture and source code to build a comprehensive internals reference for the FLARE Learning Hub. We discuss why understanding language quirks from the inside out is essential for professional analysts, look at the reality of recovering symbols from "stripped" Go binaries, and explore why traditional workflows like Time Travel Debugging (TTD) often get buried under runtime cruft. Finally, we look at the immediate future of the trade: how LLMs are already excelling at high-level decompilation and what languages he thinks are going to play a more significant role (hint - .NET AOT and Nim came up).
THE SESSION:
- The Modern Language Shift: How the transition from C and C++ to sprawling, modern compiled runtimes has altered the day-to-day workflow of threat researchers and steepened the learning curve for beginners.
- Demystifying Go Internals: Jae’s perspective on why Go's compact design philosophy can actually make it a highly systematic, and occasionally pleasant, reversing experience once you master its unique quirks and calling conventions.
- The Myth of the "Stripped" Go Binary: A look at how tools like goReSym leverage intact compilation metadata to programmatically restore original function names and type definitions.
- AI and the Future Decompiler: An honest assessment of how current LLMs handle assembly-to-source reconstruction, where hallucination verification still requires a human in the loop, and how automated tooling will reshape the analysis pipeline.
- Emerging Blind Spots: A primer on the next operational hurdles for threat researchers, including the rising frequency of native ahead-of-time (.NET AOT) compilations and wildcard languages like Nim.
References:
Join the Community
- Research Hub: Threat research, training events and news:
https://cloud.google.com/security/flare - The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com
FOLLOW THE SHOW:
- Subscribe: Apple Podcasts | Spotify | YouTube