Project 0xA11C: Deoxidizing the Rust Malware Ecosystem

## Overview Oliver from Sentinel One presents Project 0xA11C, an effort to improve reverse engineering of Rust malware binaries. The talk addresses why modern compiled languages—particularly Rust—present severe challenges for security researchers and how increased tool sophistication is essential as malware developers adopt these languages.

## Key Topics The presentation establishes context by discussing general issues with reverse engineering modern languages: massive statically-linked binaries, unconventional calling conventions, inadequate string handling in decompilers, poor type recovery, and inability to handle multiple return values. Oliver compares this to the Go reversing problem tackled previously through AlphaGolang, explaining why Rust presents fundamentally different challenges.

Rust's appeal to malware developers stems from its safety features, cross-platform compilation, active development, and the resulting difficulty analysts face when reversing it. The talk documents observed malware (Rust Bucket) and rewritten variants of previous Go/C malware now compiled to Rust.

## Technical Details The project identifies several recoverable information sources in Rust binaries:

**Binary Identification & Metadata**: YARA rules identify Rust binaries. Rust version and commit hashes remain visible even in stripped binaries. Cargo dependency manager paths reveal library versions used during compilation.

**String and Slice Handling**: The team defines structures for immutable/mutable strings and slices (32/64-bit variants). Rust strings are sized and capacity-tracked rather than null-terminated, causing decompiler issues. Longer strings use XMM registers (sometimes reversed in hex representation), requiring script-based recovery.

**P Data Section Analysis (Windows)**: Symbols in P data organize by module/library with trait implementations and type functions. Exception handling information via unwinding structures indicates library functions (malware developers rarely implement exception handling, allowing user-defined function isolation from thousands of library functions). This reduces analysis scope from thousands to approximately 10-20 user functions.

**Panic Information Extraction**: Rust macros embed panic metadata (file paths, line numbers, column numbers) connecting binary offsets to source locations, providing sparse maps for identifying code relationships.

**Calling Conventions**: The problem space here involves IDA's inability to determine argument order and count when functions use arbitrary or custom calling conventions.

**Feature Proof Middleware**: A new library abstracting IDA Python implementation details across versions (6.8 through 9), preventing scripts from breaking with version updates. Community implementation in Binja and potential Ghidra support discussed.

**FLIRT Signatures**: Hex-Rays' approach in IDA 9 creates signatures for Rust versions and dependencies, allowing brute-force matching to recover library functions, traits, and generics.

## Takeaways The project is on an extended timeline (originally 6 months, now 9+ months, likely 12+). Key conclusions: (1) Decompilers themselves require fundamental improvements for Rust beyond current tool capabilities; (2) Information recovery through binary analysis and script automation can reduce reversing scope but doesn't solve underlying decompiler problems; (3) Binary Ninja shows more promise than IDA Pro due to its intermediate abstraction architecture; (4) A community approach is essential, with multiple researchers attacking the same problems across different platforms; (5) Vast quantities of unanalyzed Rust malware exist because analysts avoid the difficulty; (6) VirusTotal integration enables large-scale Rust binary collection for heuristic development.