Mirrors_Framework/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-05-25 00:37:33 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Detect more rust binaries

Browse Source 
Some rust binaries do not contain the `rustc` or `RUST_BACKTRACE` strings. Also detect `RUST_MIN_STACK` which is in these binaries.
This commit is contained in:
カイダ
2025-03-08 12:37:18 +09:00
parent 2896551d68
commit 2b7663d7e5
2 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/rust/RustConstants.java
+1
View File
@@ -21,6 +21,7 @@ public class RustConstants {
public static final CategoryPath RUST_CATEGORYPATH = new CategoryPath("/rust");
public static final byte[] RUST_SIGNATURE_1 = "RUST_BACKTRACE".getBytes();
public static final byte[] RUST_SIGNATURE_2 = "/rustc/".getBytes();
public static final byte[] RUST_SIGNATURE_3 = "RUST_MIN_STACK".getBytes();
public static final String RUST_EXTENSIONS_PATH = "extensions/rust/";
public static final String RUST_EXTENSIONS_UNIX = "unix";
public static final String RUST_EXTENSIONS_WINDOWS = "windows";
Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/rust/RustUtilities.java
+8 -1
View File
@@ -38,7 +38,11 @@ import ghidra.xml.XmlParseException;
public class RustUtilities {
/**
* Checks if a given {@link MemoryBlock} contains a Rust signature
*
*
* This is used in the loader to determine if a program was compiled with rust.
* If the program is determined to be rust, then the compiler property is set to
* {@Link RustConstants.RUST_COMPILER}.
*
* @param block The {@link MemoryBlock} to scan for Rust signatures
* @return True if the given {@link MemoryBlock} is not null and contains a Rust signature;
* otherwise, false
@@ -55,6 +59,9 @@ public class RustUtilities {
if (containsBytes(bytes, RustConstants.RUST_SIGNATURE_2)) {
return true;
}
if (containsBytes(bytes, RustConstants.RUST_SIGNATURE_3)) {
return true;
}
return false;
}