1.3 KiB
1.3 KiB
API Reference: Analyzing Rust Malware Internals
Overview
scripts/analyst.py confirms a Rust build (rustc/cargo markers, /rustc/<hash>/library/ paths,
panic strings), heuristically demangles legacy _ZN...E symbols, detects v0 _R symbols, and
extracts crate name/version pairs from .cargo/registry paths, mapping notable crates to
capabilities. It reads bytes statically and executes nothing.
Dependencies
| Package | Version | Purpose |
|---|---|---|
| (stdlib) | — | regex, JSON, file IO |
Core functions
info(path)
Returns Rust detection, legacy-demangled names, v0 symbols present, crates, and capabilities.
_demangle_legacy(sym)
Decodes the length-prefixed segments of a legacy _ZN...17h<hash>E symbol into a::b::c.
Notes
- v0 (
_R) symbols are detected; full v0 demangling is delegated to a dedicated tool (e.g.,rustfilt).
Usage
python scripts/analyst.py info sample.bin
Sources
- Rust symbol mangling v0 (RFC 2603) — https://rust-lang.github.io/rfcs/2603-rust-symbol-name-mangling-v0.html
- Legacy
_ZN/Itanium-style length-prefixed mangling (public Rust ABI docs) - Cargo registry path layout (
registry/src/<index>/<crate>-<ver>) from Cargo documentation