SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
analyzing-rust-malware-internals
0
Analyzes Rust-compiled malware by detecting the Rust toolchain signature, demangling Rust v0/legacy symbol names, and identifying crate dependencies from embedded paths. Activates for requests to analyze Rust malware, demangle Rust symbols, or identify a Rust binary build and its crates.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Analyzing Rust Malware Internals ## When to Use - You have a Rust-compiled binary and need to confirm the toolchain, demangle symbol names, and enumerate crate dependencies. - Standard analysis is hampered by Rust's name mangling and large static linking. **Do not use** this for non-Rust binaries — confirm the Rust signature first. This skill reads the binary statically and executes nothing. ## Prerequisites - The Rust binary (read inertly). ## Safety & Handling - Read bytes statically; treat strings as untrusted. ## Workflow ### Step 1: Confirm Rust and toolchain ```bash python scripts/analyst.py info sample.bin ``` Looks for `rustc`/`cargo` markers, the `rust` panic/unwind strings, and embedded source paths (`/rustc/<hash>/library/...`, `~/.cargo/registry/...`). ### Step 2: Demangle symbol names Detects v0 (`_R...`) and legacy (`_ZN...17h<hash>E`) mangled symbols and demangles them to readable paths. ### Step 3: Enumerate crates Extract crate names/versions from `.cargo/registry/src/.../<crate>-<ver>/` paths to fingerprint capabilities (e.g., `reqwest`, `tokio`, `aes`, `winapi`). ### Step 4: Map and document Map notable crates to behavior and ATT&CK. ## Validation - The Rust toolchain signature is confirmed before demangling. - Demangled names are readable module paths (not still-mangled). - Crate names/versions are plausible registry entries. ## Pitfalls - Mixing v0 and legacy mangling in one binary — handle both. - Stripped binaries where only registry path strings remain. - Static crates inflating the symbol set; focus on the author's crate/`main`. ## References - See [`references/api-reference.md`](references/api-reference.md) for the analyzer/demangler. - Rust v0 mangling RFC and ATT&CK T1027 (linked in frontmatter).