Lighting the Way in the Dark: Binary-Only Race Detection in Go with Zorya-Volos

No ratings

Presented at BSides Joburg 2026 by

Keith Makan

"How do I find race conditions in a Go binary without being a wizard? Do any tools actually cater to real-world, off-the-shelf binaries?" When source code is unavailable, Go’s runtime acts as a dark, impenetrable black box where traditional scanners fail. Given the prevalence of Go in critical cloud infrastructure and high-stakes cryptocurrency environments, these "invisible" vulnerabilities represent a significant and under-addressed security risk. To address this, we present Zorya-Volos, a specialized framework that lights the way into the obscured depths of Go runtime internals and concurrent behavior, bridging the gap between theoretical research and practical, in-depth security assessment. Zorya-Volos is built by leveraging Ghidra’s P-Code intermediate representation, processed through an internally developed translation layer that interfaces directly with the Z3 SMT solver to model binary execution paths with mathematical rigor. Zorya-Volos differentiates itself from other approaches by (i) being rigorously tested on COTS binaries, (ii) fielding a hybrid race detection algorithm developed through deep binary analysis to identify both lock inconsistencies and race-able memory access, and (iii) utilizing symbolic execution for the comprehensive modelling of execution paths. Expanding on our Black Hat Asia presentation, we demonstrate how this engine maps runtime scheduler behavior to state-changing operations within the binary. We will explore the technical challenges of symbolic execution at scale, showcasing how our approach successfully identifies critical concurrency flaws and null pointer dereferences that current industry tooling and automated scanners consistently overlook in production environments.