2026-07-25 –, Track 2
"How do I find race conditions in a Go binary without being a wizard? Do any tools actually cater to real-world, off-the-shelf binaries?" When source code is unavailable, Go’s runtime acts as a dark, impenetrable black box where traditional scanners fail. Given the prevalence of Go in critical cloud infrastructure and high-stakes cryptocurrency environments, these "invisible" vulnerabilities represent a significant and under-addressed security risk.
To address this, we present Zorya-Volos, a specialized framework that lights the way into the obscured depths of Go runtime internals and concurrent behavior, bridging the gap between theoretical research and practical, in-depth security assessment. Zorya-Volos is built by leveraging Ghidra’s P-Code intermediate representation, processed through an internally developed translation layer that interfaces directly with the Z3 SMT solver to model binary execution paths with mathematical rigor. Zorya-Volos differentiates itself from other approaches by (i) being rigorously tested on COTS binaries, (ii) fielding a hybrid race detection algorithm developed through deep binary analysis to identify both lock inconsistencies and race-able memory access, and (iii) utilizing symbolic execution for the comprehensive modelling of execution paths.
Expanding on our Black Hat Asia presentation, we demonstrate how this engine maps runtime scheduler behavior to state-changing operations within the binary. We will explore the technical challenges of symbolic execution at scale, showcasing how our approach successfully identifies critical concurrency flaws and null pointer dereferences that current industry tooling and automated scanners consistently overlook in production environments.
Go’s concurrency model—built on the pillars of Goroutines and a sophisticated M:N scheduler—offers powerful performance but introduces complex, often non-deterministic, vulnerability surfaces. Because Go is the language of the cloud, powering critical infrastructure like Kubernetes and Docker, as well as high-stakes distributed systems and cryptocurrency utilities, these vulnerabilities are widespread. When source code is unavailable, identifying race conditions in Go binaries becomes a daunting challenge for security researchers navigating in the dark.
This talk introduces Zorya-Volos, a concolic execution framework built on Rust and Ghidra’s P-Code IR, designed specifically to tackle the challenges of binary-only analysis of concurrent Go programs. We will light the way into the black box of the Go runtime, examining how the scheduler orchestrates Goroutine execution and manages thread mapping under the hood.
Attendees will learn how Volos leverages advanced concolic execution to lift Go binaries, track execution paths without source code, and identify race conditions by modeling memory access patterns and lock states across threads. We will conclude with a comparative look at the current tooling landscape and demonstrate why our approach to in-depth manual vulnerability assessment remains essential for uncovering the race conditions that traditional scanners miss.
What attendees will learn:
- Go Runtime Internals: A deep dive into how Go binaries launch, how the scheduler distributes tasks across P, M, and G (Processor, Machine, and Goroutine) structures, and how to track the execution state of specific Goroutines.
- Source-less Analysis: How Zorya-Volos disassembles and lifts binary code to track execution paths and identify concurrency-impacting operations without needing access to the original Go source.
- Race Condition Detection: A technical breakdown of the Volos engine’s unique ability to correlate memory read/write operations with concurrency primitives to detect race conditions in compiled Go.
- Tooling Landscape: A comparison of current binary analysis tools for Go, highlighting the limitations of current solutions and the unique advantages of the Zorya-Volos methodology in securing production-grade cloud and crypto infrastructure.
Keith Makan is an experienced cybersecurity consultant and researcher with a strong history of helping clients around the world manage information security risks. He founded Keith Makan Security Consulting (KMSEC) (Pty) Ltd, a locally owned consultancy specialized in secure code review, penetration testing, training, and engineering support to help clients achieve an industry-best standard in security engineering and performance.
Keith is also a published author, having written "The Android Application Security Cookbook" and "Penetration Testing with the Bash Shell." His security research contributions include identifying vulnerabilities in widely used software like Google Chrome, and he recently presented his concolic execution framework, Zorya-Volos, at the Black Hat Asia 2026 Arsenal in Singapore. He holds an MSc in Computer Science, focusing on automated vulnerability analysis in binary formats, and is currently advancing this research as a PhD candidate at the University of the Western Cape.