Reversing Modern Binaries: Practical Rust & Go Analysis

Day 1: Rust Reverse Engineering – Fundamentals and Tooling

Module 1: Introduction to Rust and Reverse Engineering

• History, philosophy, and features of Rust
• Why attackers use Rust for malware development
• Fundamentals of reverse engineering
• Setting up the reverse engineering environment (Ghidra, GDB, LLDB, Radare2)

Module 2: Rust Compilation and Runtime

• Compilation process: From source code to machine code (LLVM/MIR)
• Rust runtime (Linux and Windows)
• Rust’s calling conventions, memory management, symbol mangling/demangling

Module 3: Analyzing Rust Structures and Control Flow

• Understanding data structures (Option, Result enums, slices, structs)
• Analyzing control flow: Functions, methods, loops, conditionals
• Exercise: Reverse engineering a simple Rust program

Day 2: Advanced Rust Reversing and Malware Analysis

Module 4: Tools and Techniques for Rust Reverse Engineering

• Configuring Ghidra for Rust binaries
• Debugging with GDB/GEF and LLDB
• Practical exercises with Rust debugging and analysis

Module 5: Advanced Reverse Engineering and Obfuscation Techniques

• Tackling stripped binaries: Symbol recovery and function inlining
• Handling obfuscation techniques: String obfuscation, anti-debugging
• Exercise: Reverse engineering an obfuscated Rust binary

Module 6: Advanced Malware Reverse Engineering Techniques in Rust

• Analyzing process hollowing, API hooking, and DLL injection in Rust malware
• Understanding loader injection and packers in Rust binaries
• Practical exercises with Rust malware samples

Module 7: Rust Malware Analysis

• Case studies (e.g., Luca Stealer)
• Writing YARA rules for Rust binaries
• Exercise: Analyzing a Rust malware sample and crafting YARA rules