Langue: English
Rust reversing can, at times, prove quite painful. The compiler and standard library are updated every 6 weeks, there is no stable ABI, it has many exotic types, macros, etc. Fortunately for any reverser, there exists a common solution to this mess, that being strings! Participants will get a quick look at:
- The various forms of metadata that Rust packs into binaries;
- How to leverage this metadata to extract project structure, dependencies, the build process;
- Available tools to make Rust reversing easier and;
- Present and future outlook on the Rust reversing scene.
The talk will contain the following sections:
- Describe (at a very basic level) how Rust compiles binaries, and how certain build flags (particularly nightly flags) modify the final output.
- Compilation steps will be glossed over fairly quickly since a focus will be pinned on the behaviour of build flags for final outputs.
- Describe what metadata is stored in the latest Rust binaries.
- Rust commit hash and version string
rustuptoolchain,cargobuild dependencies (for vendored and non-vendored builds)- Build directories
- Imported/used libraries,
- Panic locations.
- Describe how this metadata can be leveraged, using rustbintriage, aka
rbt.- Show various examples of
rbt's output against real Rust malware across varying Rust versions and major operating systems (Windows, macOS, Linux). - Show various examples of
rbt's output against binaries compiled with particular build flags. - Quickly go over the future and present outlook of Rust reversing, particularly with regards to existing tooling available to reverse engineers.
- Show various examples of
- Q&A
Each section should take 5 minutes max to fill the allotted 20 minute slot. Though we may take up more time with the first 3 sections and leave questions as something to handle after the talk, in the event we run out of time.
Hello! I'm a second year university student pursuing computer engineering at the University of Guelph. I am part of the Guelph Cybersecurity Society as a technical helper as well. I began my journey through cybersecurity in Fall 2024 and have remained obsessed with malware analysis, DFIR, and lately, CTI. I specialize more towards Rust reverse engineering given its developing state. In my spare time, I write up many of my analysis and thoughts on my blog.