That's right; the ones I tested were 'ps' and 'top'.
I did try hooking __libc_start_main, but had difficulty using dl.Sym() with it. I wasn't sure if I converted the function signature to Go incorrectly or if it's a limitation of dl.Sym().
If you can manage to register a constructor function, you can get your code executing without the target code having to call anything. In GCC, adding __attribute__((constructor)) before a no-argument function returning void works. I don't have a specific suggesiton for how to make this work in Go, although if you can add arbitrary C-compatible attributes and use the platform linker, setting the constructor attribute should just work.
In C++, constructors on static global objects get run automatically (via this mechanism), so if Go has something similar, that would work. (Stable) Rust goes out of its way to make you not able to do this because it's an anti-pattern, but there's a stupid trick if you can assume GNU: https://github.com/geofft/redhook/blob/master/src/lib.rs#L34...
Alternatively, you can just write an __attribute__((constructor)) function in C that calls an exported Go function that in turn calls `go backdoor()`, and link them all together.
The 'backdoor' just refers to the fact that it starts a TCP server that will execute commands sent to it. That's not really the point; the novelty aspect is that it uses the new 'c-shared' buildmode supported by Go version 1.5.
I think it also demonstrates how easy it is to write something similar to Telnet in Go.
