analyzing-rust-malware-internals

Name: analyzing-rust-malware-internals
Author: meltedinhex

18stars5forks

How to install analyzing-rust-malware-internals?

meltedinhex/analyst-ai-pack/analyzing-rust-malware-internals

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-rust-malware-internals

Installs into the current project.

Summary

Analyzes Rust-compiled malware by detecting the Rust toolchain signature, demangling

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Rust Malware Internals
2
3	## When to Use
4
5	- You have a Rust-compiled binary and need to confirm the toolchain, demangle symbol names, and
6	enumerate crate dependencies.
7	- Standard analysis is hampered by Rust's name mangling and large static linking.
8
9	Do not use this for non-Rust binaries — confirm the Rust signature first. This skill reads the
10	binary statically and executes nothing.
11
12	## Prerequisites
13
14	- The Rust binary (read inertly).
15
16	## Safety & Handling
17
18	- Read bytes statically; treat strings as untrusted.
19
20	## Workflow
21
22	### Step 1: Confirm Rust and toolchain
23
24	```bash
25	python scripts/analyst.py info sample.bin
26	```
27
28	Looks for `rustc`/`cargo` markers, the `rust` panic/unwind strings, and embedded source paths
29	(`/rustc/<hash>/library/...`, `~/.cargo/registry/...`).
30
31	### Step 2: Demangle symbol names
32
33	Detects v0 (`_R...`) and legacy (`_ZN...17h<hash>E`) mangled symbols and demangles them to readable
34	paths.
35
36	### Step 3: Enumerate crates
37
38	Extract crate names/versions from `.cargo/registry/src/.../<crate>-<ver>/` paths to fingerprint
39	capabilities (e.g., `reqwest`, `tokio`, `aes`, `winapi`).
40
41	### Step 4: Map and document
42
43	Map notable crates to behavior and ATT&CK.
44
45	## Validation
46
47	- The Rust toolchain signature is confirmed before demangling.
48	- Demangled names are readable module paths (not still-mangled).
49	- Crate names/versions are plausible registry entries.
50
51	## Pitfalls
52
53	- Mixing v0 and legacy mangling in one binary — handle both.
54	- Stripped binaries where only registry path strings remain.
55	- Static crates inflating the symbol set; focus on the author's crate/`main`.
56
57	## References
58
59	- See [`references/api-reference.md`](references/api-reference.md) for the analyzer/demangler.
60	- Rust v0 mangling RFC and ATT&CK T1027 (linked in frontmatter).

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

analyzing-rust-malware-internals

18stars5forks

View on GitHub

How to install analyzing-rust-malware-internals?

meltedinhex/analyst-ai-pack/analyzing-rust-malware-internals

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-rust-malware-internals

Installs into the current project.

Summary

Analyzes Rust-compiled malware by detecting the Rust toolchain signature, demangling

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Rust Malware Internals
2
3	## When to Use
4
5	- You have a Rust-compiled binary and need to confirm the toolchain, demangle symbol names, and
6	enumerate crate dependencies.
7	- Standard analysis is hampered by Rust's name mangling and large static linking.
8
9	Do not use this for non-Rust binaries — confirm the Rust signature first. This skill reads the
10	binary statically and executes nothing.
11
12	## Prerequisites
13
14	- The Rust binary (read inertly).
15
16	## Safety & Handling
17
18	- Read bytes statically; treat strings as untrusted.
19
20	## Workflow
21
22	### Step 1: Confirm Rust and toolchain
23
24	```bash
25	python scripts/analyst.py info sample.bin
26	```
27
28	Looks for `rustc`/`cargo` markers, the `rust` panic/unwind strings, and embedded source paths
29	(`/rustc/<hash>/library/...`, `~/.cargo/registry/...`).
30
31	### Step 2: Demangle symbol names
32
33	Detects v0 (`_R...`) and legacy (`_ZN...17h<hash>E`) mangled symbols and demangles them to readable
34	paths.
35
36	### Step 3: Enumerate crates
37
38	Extract crate names/versions from `.cargo/registry/src/.../<crate>-<ver>/` paths to fingerprint
39	capabilities (e.g., `reqwest`, `tokio`, `aes`, `winapi`).
40
41	### Step 4: Map and document
42
43	Map notable crates to behavior and ATT&CK.
44
45	## Validation
46
47	- The Rust toolchain signature is confirmed before demangling.
48	- Demangled names are readable module paths (not still-mangled).
49	- Crate names/versions are plausible registry entries.
50
51	## Pitfalls
52
53	- Mixing v0 and legacy mangling in one binary — handle both.
54	- Stripped binaries where only registry path strings remain.
55	- Static crates inflating the symbol set; focus on the author's crate/`main`.
56
57	## References
58
59	- See [`references/api-reference.md`](references/api-reference.md) for the analyzer/demangler.
60	- Rust v0 mangling RFC and ATT&CK T1027 (linked in frontmatter).

People who liked this also viewed

6 picks

Type