GhidRust

GhidRust: Rust binary analysis extension

Status: Currently, the plugin is under extensive development. It is far from maturity. But a working prototype can be expected within a few weeks.

Features

Rust binary detection

The plugin can detect Rust binaries. To use the feature, click on GhidRust -> Check if Rust binary. It will show a popup indicating whether it's a Rust binary or not.

May not be a Rust binary	May be a Rust binary

Function ID

The plugin also consists of RustStdAnalyzer which analyzes Rust binaries and applies function signatures to the library functions (Rust's std) found in the binary. This is done using .fidb function ID database. A default database for x86-64 and Rust version 1.58.1 has been provided. This is useful when analyzing stripped Rust binaries.

Without Function ID	With Function ID

The analyzer is enabled by default for Rust binaries, and it's name in analyzer window is "Detect Rust libstd functions".

Decompilation

This is a work-in-progress feature as of now. It requires parsing the decompiled C code and then emitting the corresponding Rust code. Once that is done, Rust macro support will also be added in the future.

The decompiler panel can be accessed by clicking GhidRust -> Open decompiler. It looks as follows.

Building

There is a build script provided (build.sh) which can build and install the extension.

$ ./build.sh -h
        GhidRust install script
        Usage: build.sh [-i | --install] -g GHIDRA_PATH
        
                -i | --install           Install the extension
                -g | --ghidra            Path to Ghidra installation (usually /opt/ghidra)
                -h | --help              Show usage/help

You can build the extension using the following command.

$ ./build.sh -g <GHIDRA_INSTALL_DIR>

You can install it using the install flag as follows.

./build.sh -ig <GHIDRA_INSTALL_DIR>

Adding it to Ghidra

To add it to Ghidra, just click on File -> Install Extensions... and choose GhidRust there. Once installed, you will have a GhidRust entry in the Ghidra toolbar which can be used to invoke the plugin.

You might need to activate it from the File -> Configure... menu. Choose the Miscellaneous section, and click the checkbox beside RustDecPlugin.