40 lines
1.3 KiB
Markdown
40 lines
1.3 KiB
Markdown
# API Reference: Analyzing Rust Malware Internals
|
|
|
|
## Overview
|
|
|
|
`scripts/analyst.py` confirms a Rust build (rustc/cargo markers, `/rustc/<hash>/library/` paths,
|
|
panic strings), heuristically demangles legacy `_ZN...E` symbols, detects v0 `_R` symbols, and
|
|
extracts crate name/version pairs from `.cargo/registry` paths, mapping notable crates to
|
|
capabilities. It reads bytes statically and executes nothing.
|
|
|
|
## Dependencies
|
|
|
|
| Package | Version | Purpose |
|
|
|---------|---------|---------|
|
|
| (stdlib) | — | regex, JSON, file IO |
|
|
|
|
## Core functions
|
|
|
|
### `info(path)`
|
|
Returns Rust detection, legacy-demangled names, v0 symbols present, crates, and capabilities.
|
|
|
|
### `_demangle_legacy(sym)`
|
|
Decodes the length-prefixed segments of a legacy `_ZN...17h<hash>E` symbol into `a::b::c`.
|
|
|
|
## Notes
|
|
|
|
- v0 (`_R`) symbols are detected; full v0 demangling is delegated to a dedicated tool
|
|
(e.g., `rustfilt`).
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
python scripts/analyst.py info sample.bin
|
|
```
|
|
|
|
## Sources
|
|
|
|
- Rust symbol mangling v0 (RFC 2603) — https://rust-lang.github.io/rfcs/2603-rust-symbol-name-mangling-v0.html
|
|
- Legacy `_ZN`/Itanium-style length-prefixed mangling (public Rust ABI docs)
|
|
- Cargo registry path layout (`registry/src/<index>/<crate>-<ver>`) from Cargo documentation
|