# Rust Reversing Basics

## Main Function Identification

- Characteristics

- “main“ string
*`Fig.1 Malware stripped version of std::rt::lang_start_internal`*

This would be the entry point recognized by IDA Pro, but it is not the true main function in the rust binary.

- std::rt::lang_start_internal runtime function
*`Fig.2 Fully symbol version of std::rt::lang_start_internal`*

You may observe the difference between the fully symbol version and the stripped version. They’re the same function, but most of the time, the true main function would be compiled into std::rt::lang_start_internal function in the malware stripped version due to the optimization.

- main function address would be passed as parameter
*`Fig.3 hello::main (true main function) is passed as parameter`*
*`Fig.4 sub_40751D (true main function) is passed as parameter`*

The true main function in the rust binary would be passed as parameter into the runtime function. Thus, we can easily recognize the true main function in the malware stripped version.

## Structs

- If the program is writing data to stack only to apparently never use it again, you’re probably dealing with a struct

- If the program is conversely reading data from the stack that apparently had not been written to before, you’re probably dealing with a struct
*`Fig.5 Struct in assembly`*
*`Fig.6 Struct in decompiled code`*

Structs in the rust binary is a difficult problem being solved. We usually define **`*ptr = malloc(sizeof(someStruct))`** to manage the structs in C/C++. However, rust uses stack to store the structs instead of heap. This mechanism may lead to a problem when we’re trying to fix the struct’s size and define the start address of the struct. The auto script analysis of identifying structs in the rust binary is unstable due to the problem. For the efficient analysis, we can only identify the structs by human for now (I think so).

## Std & Core Crate

Rust uses “Crate” to call the modules. Std & Core crate are automatically compiled into the rust binary. The strings will not miss during the “normal“ compile time. Thus, we can identify some default crates through the existing strings in the rust binary.

- Std & Core crate are just like stdio.h or stdint.h in C/C++

- Function table would be compiled into .pdata segment, something like vtable in C++

- That means some inner functions can be recovered by comparing the code similarity
*`Fig.7 Core strings in the malware stripped version`*
*`Fig.8 .pdata function table in the fully symbol version`*
*`Fig.9 .pdata function table in the malware stripped version`*

## Identifiable Crate

As we introduced crate above, rust will not wipe the strings during the normal compile time. Thus we can identify some custom crate through the strings.

- Information from the strings

- E.g. “TOKIO_WORKER_THREADS”, “Client::new()“

- Some code segment can be ignored once we identified it
*`Fig.10 Code segment about TOKIO_WORKER_THREADS crate`*
*`Fig.11 Code segment about Client::new() crate (reqwest)`*

## Tools

Please read the [README.md](https://github.com/r3dhun9/IDARustler) in the repository to get the usage of the tools.

Github link: https://github.com/r3dhun9/IDARustler
*`Fig.12 True main function is fixed with a long name`*
*`Fig.13 Function name being fixed the longer the suspicious`*