reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-rust-malware-internals/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: analyzing-rust-malware-internals
+description: 'Analyzes Rust-compiled malware by detecting the Rust toolchain signature, demangling
+  Rust v0/legacy symbol names, and identifying crate dependencies from embedded paths. Activates
+  for requests to analyze Rust malware, demangle Rust symbols, or identify a Rust binary build and
+  its crates.'
+domain: cybersecurity
+subdomain: reverse-engineering
+tags:
+  - reverse-engineering
+  - rust
+  - symbol-demangling
+  - crates
+  - stripped-binaries
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1027
+  - T1587.001
+  - T1059
+d3fend:
+  - D3-SDA
+  - D3-DA
+references:
+  - 'Rust symbol mangling (RFC 2603 v0 scheme) — https://rust-lang.github.io/rfcs/2603-rust-symbol-name-mangling-v0.html'
+  - 'MITRE ATT&CK T1027 Obfuscated Files or Information — https://attack.mitre.org/techniques/T1027/'
+---
+
+# Analyzing Rust Malware Internals
+
+## When to Use
+
+- You have a Rust-compiled binary and need to confirm the toolchain, demangle symbol names, and
+  enumerate crate dependencies.
+- Standard analysis is hampered by Rust's name mangling and large static linking.
+
+**Do not use** this for non-Rust binaries — confirm the Rust signature first. This skill reads the
+binary statically and executes nothing.
+
+## Prerequisites
+
+- The Rust binary (read inertly).
+
+## Safety & Handling
+
+- Read bytes statically; treat strings as untrusted.
+
+## Workflow
+
+### Step 1: Confirm Rust and toolchain
+
+```bash
+python scripts/analyst.py info sample.bin
+```
+
+Looks for `rustc`/`cargo` markers, the `rust` panic/unwind strings, and embedded source paths
+(`/rustc/<hash>/library/...`, `~/.cargo/registry/...`).
+
+### Step 2: Demangle symbol names
+
+Detects v0 (`_R...`) and legacy (`_ZN...17h<hash>E`) mangled symbols and demangles them to readable
+paths.
+
+### Step 3: Enumerate crates
+
+Extract crate names/versions from `.cargo/registry/src/.../<crate>-<ver>/` paths to fingerprint
+capabilities (e.g., `reqwest`, `tokio`, `aes`, `winapi`).
+
+### Step 4: Map and document
+
+Map notable crates to behavior and ATT&CK.
+
+## Validation
+
+- The Rust toolchain signature is confirmed before demangling.
+- Demangled names are readable module paths (not still-mangled).
+- Crate names/versions are plausible registry entries.
+
+## Pitfalls
+
+- Mixing v0 and legacy mangling in one binary — handle both.
+- Stripped binaries where only registry path strings remain.
+- Static crates inflating the symbol set; focus on the author's crate/`main`.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the analyzer/demangler.
+- Rust v0 mangling RFC and ATT&CK T1027 (linked in frontmatter).