reverse-engineering-rust-malware

逆向工程 Rust 恶意软件

概述

由于 Rust 具有交叉编译、内存安全保障，以及给逆向工程师带来的复杂性，它在恶意软件开发中日益流行。Rust 二进制文件会静态链接整个标准库，生成体积庞大、包含大量样板代码的二进制文件。主要挑战包括：非 null 结尾字符串（Rust 使用指针 + 长度的胖指针）、单态化生成重复的泛型代码、复杂的错误处理（Result/Option unwrap 链），以及不熟悉的调用约定。与 C/C++ 二进制文件相比，将 Rust 反编译为 C 会产生无用的输出。用于 crate 提取的 Ghidra 脚本等工具，以及针对 Rust 特有模式（2024-2025）的培训，有助于应对这些挑战。值得注意的 Rust 恶意软件包括 BlackCat/ALPHV 勒索软件、Hive 勒索软件变种和 Buer Loader。

何时使用

• 在执行涉及逆向工程 Rust 恶意软件的授权安全测试时
• 在受控环境中分析恶意软件样本或攻击产物时
• 在开展红队演练或渗透测试项目时
• 在基于攻击技术理解构建检测能力时

前提条件

• IDA Pro 8.0+ 或 Ghidra 11.0+
• 用于参考编译的 Rust 工具链
• 用于辅助脚本的 Python 3.9+
• 理解 Rust 内存模型（所有权、借用）
• 熟悉 Rust 字符串类型（String、&str、CString）

工作流

步骤 1：识别并解析 Rust 二进制文件元数据

#!/usr/bin/env python3
"""Analyze Rust malware binary metadata and extract crate dependencies."""
import re
import sys
import json


def identify_rust_binary(data):
    """Check if binary is Rust-compiled and extract version info."""
    indicators = {
        "rust_panic_strings": bool(re.search(rb'panicked at', data)),
        "rust_unwrap": bool(re.search(rb'called.*unwrap.*on.*None', data)),
        "core_panic": bool(re.search(rb'core::panicking', data)),
        "std_rt": bool(re.search(rb'std::rt::lang_start', data)),
        "cargo_path": bool(re.search(rb'\.cargo[/\\]registry', data)),
        "rustc_version": None,
    }

    version = re.search(rb'rustc\s+(\d+\.\d+\.\d+)', data)
    if version:
        indicators["rustc_version"] = version.group(1).decode()

    is_rust = sum(1 for v in indicators.values() if v) >= 2
    return is_rust, indicators


def extract_crates(data):
    """Extract Rust crate (dependency) names from binary strings."""
    crate_pattern = re.compile(
        rb'(?:crates\.io-[a-f0-9]+/|\.cargo/registry/src/[^/]+/)'
        rb'([\w-]+)-(\d+\.\d+\.\d+)'
    )
    crates = {}
    for match in crate_pattern.finditer(data):
        name = match.group(1).decode()
        version = match.group(2).decode()
        crates[name] = version

    # Also check for common malware-relevant crates
    suspicious_crates = {
        "reqwest": "HTTP client",
        "hyper": "HTTP library",
        "tokio": "Async runtime",
        "aes": "AES encryption",
        "chacha20": "ChaCha20 encryption",
        "rsa": "RSA encryption",
        "ring": "Crypto library",
        "base64": "Base64 encoding",
        "winapi": "Windows API bindings",
        "winreg": "Registry access",
        "sysinfo": "System information",
        "screenshots": "Screen capture",
        "clipboard": "Clipboard access",
        "keylogger": "Key logging",
    }

    capabilities = []
    for crate_name, description in suspicious_crates.items():
        if crate_name in crates:
            capabilities.append({
                "crate": crate_name,
                "version": crates[crate_name],
                "capability": description,
            })

    return crates, capabilities


def extract_rust_strings(data):
    """Extract strings handling Rust's non-null-terminated format."""
    # Rust strings are stored as pointer+length, but string literals
    # are often in .rodata as contiguous sequences
    strings = []
    ascii_pattern = re.compile(rb'[\x20-\x7e]{8,500}')
    for match in ascii_pattern.finditer(data):
        s = match.group().decode('ascii')
        # Filter for malware-relevant strings
        keywords = ['http', 'socket', 'encrypt', 'decrypt', 'shell',
                    'exec', 'cmd', 'upload', 'download', 'persist',
                    'registry', 'mutex', 'pipe', 'inject']
        if any(kw in s.lower() for kw in keywords):
            strings.append(s)

    return strings


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <rust_binary>")
        sys.exit(1)

    with open(sys.argv[1], 'rb') as f:
        data = f.read()

    is_rust, indicators = identify_rust_binary(data)
    print(f"[{'+'if is_rust else '-'}] Rust binary: {is_rust}")
    print(json.dumps(indicators, indent=2, default=str))

    crates, capabilities = extract_crates(data)
    print(f"\n[+] Crates ({len(crates)}):")
    for name, ver in sorted(crates.items()):
        print(f"  {name} v{ver}")

    if capabilities:
        print(f"\n[!] Suspicious capabilities:")
        for cap in capabilities:
            print(f"  {cap['crate']} -> {cap['capability']}")

    strings = extract_rust_strings(data)
    if strings:
        print(f"\n[+] Suspicious strings ({len(strings)}):")
        for s in strings[:20]:
            print(f"  {s}")

验证标准

• 正确识别二进制文件为 Rust 编译，并获取版本信息
• 提取 crate 依赖，揭示恶意软件能力
• Rust 特有的字符串提取能够处理胖指针格式
• 识别主入口点和核心逻辑函数
• 定位加密、网络和持久化代码

参考资料

• Binary Defense - Extracting Secrets from Rust Malware
• Ghidra Extension for Rust Analysis
• Fuzzing Labs - Reversing Modern Binaries
• Bishop Fox - Rust for Malware Development