ptn1411 Rust Binary Analyzer
Purpose
Rust compiles to native code with no bytecode/IL to decompile, but leaves rich metadata in the binary: mangled symbol names, panic strings with source paths, and framework-specific signatures. This skill extracts and organises that metadata to give the reverse engineer a high-level map of the application before opening IDA or Ghidra.
Workflow
┌────────────┐ ┌──────────────┐ ┌───────────────────┐
│ target.exe │────▶│ analyze_rust │────▶│ rust_analysis.json │
└────────────┘ └──────────────┘ └───────────────────┘
│
├─ Demangle symbols (_RN… / _ZN…)
├─ Extract panic paths → module tree
├─ Detect framework (Tauri, Actix, …)
├─ Find license-related functions
└─ Identify linked crates
Usage
python rust-binary-analyzer/scripts/analyze_rust.py target.exe --out output/rust-analysis
python rust-binary-analyzer/scripts/analyze_rust.py target.exe --json output/rust_info.json
Outputs
| File | Content |
|---|---|
rust_info.json |
Full analysis: symbols, panic paths, framework, license targets |
demangled_symbols.txt |
All demangled Rust symbols |
module_tree.txt |
Reconstructed source module hierarchy |
license_targets.txt |
Functions likely related to licensing |
When to use
binary-identifierreports Rust language- Target contains
.rs:panic strings or_RN/_ZNmangled symbols - Tauri desktop app (chains into
tauri-unpacker)
Anti-patterns
| Mistake | Fix |
|---|---|
| Trying to decompile Rust to source | Rust → native; use IDA/Ghidra for code, this skill for metadata |
| Ignoring panic strings | Panic paths reveal the full source tree — always extract first |
| Skipping symbol demangling | Mangled names are unreadable; demangling reveals crate::module::function |
| Missing Tauri frontend | If framework=Tauri, chain tauri-unpacker to get the JS/HTML |