Hackfest - Level UP

EnglishFrançais • 
login

Rust Reversing for All: Extracting Metadata From Rust Binaries
Language: English

Rust reversing can, at times, prove quite painful. The compiler and standard library are updated every 6 weeks, there is no stable ABI, it has many exotic types, macros, etc. Fortunately for any reverser, there exists a common solution to this mess, that being strings! Participants will get a quick look at:
- The various forms of metadata that Rust packs into binaries;
- How to leverage this metadata to extract project structure, dependencies, the build process;
- Available tools to make Rust reversing easier and;
- Present and future outlook on the Rust reversing scene.

The talk will contain the following sections:

  1. Describe (at a very basic level) how Rust compiles binaries, and how certain build flags (particularly nightly flags) modify the final output.
    • Compilation steps will be glossed over fairly quickly since a focus will be pinned on the behaviour of build flags for final outputs.
  2. Describe what metadata is stored in the latest Rust binaries.
    • Rust commit hash and version string
    • rustup toolchain,
    • cargo build dependencies (for vendored and non-vendored builds)
    • Build directories
    • Imported/used libraries,
    • Panic locations.
  3. Describe how this metadata can be leveraged, using rustbintriage, aka rbt.
    • Show various examples of rbt's output against real Rust malware across varying Rust versions and major operating systems (Windows, macOS, Linux).
    • Show various examples of rbt's output against binaries compiled with particular build flags.
    • Quickly go over the future and present outlook of Rust reversing, particularly with regards to existing tooling available to reverse engineers.
  4. Q&A

Each section should take 5 minutes max to fill the allotted 20 minute slot. Though we may take up more time with the first 3 sections and leave questions as something to handle after the talk, in the event we run out of time.

The speaker's profile picture
Mourad Sherif

Hello! I'm a second year university student pursuing computer engineering at the University of Guelph. I am part of the Guelph Cybersecurity Society as a technical helper as well. I began my journey through cybersecurity in Fall 2024 and have remained obsessed with malware analysis, DFIR, and lately, CTI. I specialize more towards Rust reverse engineering given its developing state. In my spare time, I write up many of my analysis and thoughts on my blog.