reverse-skills-max/vendor-new/analyst-ai-pack/skills/analyzing-rust-malware-internals/references/api-reference.md

API Reference: Analyzing Rust Malware Internals

Overview

scripts/analyst.py confirms a Rust build (rustc/cargo markers, /rustc/<hash>/library/ paths, panic strings), heuristically demangles legacy _ZN...E symbols, detects v0 _R symbols, and extracts crate name/version pairs from .cargo/registry paths, mapping notable crates to capabilities. It reads bytes statically and executes nothing.

Dependencies

Package	Version	Purpose
(stdlib)	—	regex, JSON, file IO

Core functions

info(path)

Returns Rust detection, legacy-demangled names, v0 symbols present, crates, and capabilities.

_demangle_legacy(sym)

Decodes the length-prefixed segments of a legacy _ZN...17h<hash>E symbol into a::b::c.

Notes

• v0 (_R) symbols are detected; full v0 demangling is delegated to a dedicated tool (e.g., rustfilt).

Usage

python scripts/analyst.py info sample.bin

Sources

• Rust symbol mangling v0 (RFC 2603) — https://rust-lang.github.io/rfcs/2603-rust-symbol-name-mangling-v0.html
• Legacy _ZN/Itanium-style length-prefixed mangling (public Rust ABI docs)
• Cargo registry path layout (registry/src/<index>/<crate>-<ver>) from Cargo documentation