analyzing-rust-binaries

Analyzing Rust Binaries

Rust binaries are large, statically linked, and full of inlined generic code — but they leak more than most people expect. Panic sites embed the source file path and line, symbols carry crate and module structure, and the standard library's formatting machinery is instantly recognizable. The job is knowing which parts are yours and which are the 90% that is core, alloc, and vendored crates.

When to Use

• strings shows rustc version, core::panicking, /rustc/<hash>/library/
• Symbols begin with _ZN...17h<hex>E (legacy) or _R (v0 mangling)
• A stripped binary is 3–30 MB with minimal dynamic imports
• Analyzing Rust malware, a Rust CLI, or a compiled Rust service

When NOT to Use

• Go binaries — use analyzing-go-binaries; symbol recovery differs entirely
• .NET or Unity — use the matching skill
• Suspected malware, before containment — use analyzing-malware first
• Source is available — use auditing-code-for-vulnerabilities, which has the Rust unsafe checklist

Confirm and Fingerprint

strings -n 8 target | rg -m8 'rustc version|/rustc/[0-9a-f]{40}|core::panicking|cargo/registry'

Two artifacts do most of the work before you disassemble anything:

Panic strings leak the source tree. Rust embeds the file path and line number of every panic!, unwrap(), and bounds check. That gives you the crate layout, the developer's directory structure, and often the project name.

strings -n 10 target | rg 'src/[a-z_/]+\.rs' | sort -u | head -40
# → src/main.rs, src/crypto/aes.rs, /home/dev/projects/implant/src/c2.rs

Registry paths name the dependencies. Vendored crates compiled in leave their ~/.cargo/registry/src/.../<crate>-<version>/ paths in panic sites, which is effectively a dependency list.

strings target | rg -o 'cargo/registry/src/[^/]+/([a-z0-9_-]+-[0-9.]+)' -r '$1' | sort -u

That combination — module layout plus dependency list — usually tells you what the binary does before a single instruction is read.