JPCERT/CC Publishes Study on Reverse Engineering Rust Binaries
Summary
JPCERT/CC has published a study outlining reverse-engineering techniques for Rust binaries, with topics ranging from binary identification and memory layouts to Rust language features and library code, relevant to analyzing Rust malware.
Key points
- The study addresses a skills gap in reverse engineering Rust malware as Rust adoption grows.
- JPCERT/CC notes that Rust malware includes variants of SysJoker and BlackCat ransomware.
- Study topics include identifying Rust binaries, analyzing strings and mangled function names, and understanding exception and TLS directories.
- The report also examines how Rust features such as closures, enums, traits, iterators, and smart pointers appear in compiled code.
- The study used Rust and Cargo 1.82.0, IDA Pro 8.3, and binaries compiled in a Windows MSVC environment.
- The report includes sample programs for some study items, which readers can compile and analyze alongside the material.
Article Details
- Event Type
- Publication of a reverse-engineering study on Rust binaries
- Impact
- JPCERT/CC’s report documents methods for analyzing Rust binaries and Rust malware. The article says abuse of Rust by attackers is expected to increase, but reports no specific incident or direct impact.
People
Malware
BlackCatusing Rust (hereinafter referred to as "Rust malware"), such as Rust variants of SysJoker and the BlackCat ransomware, has also been increasing in recent years.SysJokermalware developed using Rust (hereinafter referred to as "Rust malware"), such as Rust variants of SysJoker and the BlackCat ransomware, has also been increasing in recent years.