Analyzing Rust Binaries

[anzosasuke]

Have anyone ever tried analyzing rust binaries???? I tried a simple hello world program,, and man it's a disaster. First of all, too many functions. The binary is bloated. Does anybody has ever tried to analyze these binary? Is it worth it or even possible ? Please share some insights on this. Thank you!

[ryanmkurtz]

Issue #141 deals with adding better Rust support.

[recvfrom]

I used Ghidra to analyze a Windows DLL written in Rust recently and it worked pretty well. I did had a related question, though - in that DLL, Ghidra didn't automatically make functions out of the exported functions it found.

Here are some examples:

                             0x8780  1  xxxx_xxxxxx_xxx
                             Ordinal_1                                       XREF[3]:     Entry Point(*), 18038a630(*),
                             xxxx_xxxxxx_xxxx                                             1803f3e68(*)
       180008780 55              PUSH       RBP
       180008781 41 57           PUSH       R15
       180008783 41 56           PUSH       R14
       180008785 41 54           PUSH       R12
       180008787 56              PUSH       RSI
       180008788 57              PUSH       RDI
       180008789 53              PUSH       RBX
       18000878a 48 81 ec        SUB        RSP,0xd0
                 d0 00 00 00
       180008791 48 8d ac        LEA        RBP,[RSP + 0x80]
                 24 80 00
                 00 00
       180008799 48 c7 45        MOV        qword ptr [RBP + 0x48],-0x2
       ... <truncated> ...

                             0x89f0  2  xxxx_xxxxxx_xxxx_xxxx
                             Ordinal_2                                       XREF[3]:     Entry Point(*), 18038a6a8(*),
                             xxxx_xxxxxx_xxxx_xxxx                                        1803f3e6c(*)
       1800089f0 55              PUSH       RBP
       1800089f1 56              PUSH       RSI
       1800089f2 48 83 ec 38     SUB        RSP,0x38
       1800089f6 48 8d 6c        LEA        RBP,[RSP + 0x30]
                 24 30
       1800089fb 48 c7 45        MOV        qword ptr [RBP],-0x2
                 00 fe ff
                 ff ff
       180008a03 48 85 c9        TEST       RCX,RCX
       ... <truncated> ...

                             0x9d80  14  xxxx_xxx_xxx_xxxx_xxxx
                             Ordinal_14                                      XREF[2]:     Entry Point(*), 1803f3e9c(*)
                             xxxx_xxx_xxx_xxxx_xxxx
       180009d80 48 85 c9        TEST       RCX,RCX
       180009d83 74 10           JZ         LAB_180009d95
       ... <truncated> ...

                             0xd9d0  8  xxxx_xxxxxxx_xxxx
                             Ordinal_8                                       XREF[3]:     Entry Point(*), 18038bdc4(*),
                             xxxx_xxxxxxx_xxxx                                            1803f3e84(*)
       18000d9d0 55              PUSH       RBP
       18000d9d1 56              PUSH       RSI
       18000d9d2 57              PUSH       RDI
       18000d9d3 48 83 ec 60     SUB        RSP,0x60
       18000d9d7 48 8d 6c        LEA        RBP,[RSP + 0x60]
                 24 60
       18000d9dc 48 c7 45        MOV        qword ptr [RBP + -0x8],-0x2
                 f8 fe ff
                 ff ff
       ... <truncated> ...

                             0xdb40  3  xxxx_xxxxx_xxxxxxxxxxx
                             Ordinal_3                                       XREF[2]:     Entry Point(*), 1803f3e70(*)
                             xxxx_xxxxx_xxxxxxxxxxx
       18000db40 56              PUSH       RSI
       18000db41 48 83 ec 50     SUB        RSP,0x50
       18000db45 48 89 4c        MOV        qword ptr [RSP + 0x20],RCX
                 24 20
       18000db4a 48 89 54        MOV        qword ptr [RSP + 0x28],RDX
                 24 28
       18000db4f 4d 85 c0        TEST       R8,R8
       ... <truncated> ...

From briefly investigating why this might be the case, is it because the function prologues don't seem to match any of the patterns defined in https://github.com/NationalSecurityAgency/ghidra/tree/master/Ghidra/Processors/x86/data/patterns ?

[astrelsky]

Yes that is why. However I would expect whatever marked them as exported functions to create them too.

[recvfrom]

@astrelsky that was my initial thought as well... From looking at the PE header, though, there doesn't seem to be anything that directly identifies whether a given export
symbol corresponds to an exported variable or exported function. In a C++ test executable I made with Visual Studio 2019, an exported variable was named ?variable@@3HA and an exported function was named ?function@YAHXZ, so maybe the extra data there are type hints that could get used? That metadata wasn't present in the Rust executable, though.

I wonder if it'd be sufficiently safe for Ghidra to look at the address that each export corresponds to and try disassembly / function creation if the address maps to a section with execute permissions?