From 2b7663d7e53c9a058cd4438b40120798019bb7a5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E3=82=AB=E3=82=A4=E3=83=80?= Date: Sat, 8 Mar 2025 12:37:18 +0900 Subject: [PATCH 1/2] Detect more rust binaries Some rust binaries do not contain the `rustc` or `RUST_BACKTRACE` strings. Also detect `RUST_MIN_STACK` which is in these binaries. --- .../app/plugin/core/analysis/rust/RustConstants.java | 1 + .../app/plugin/core/analysis/rust/RustUtilities.java | 9 ++++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/rust/RustConstants.java b/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/rust/RustConstants.java index 9743b67f4a..89d3a45e9c 100644 --- a/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/rust/RustConstants.java +++ b/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/rust/RustConstants.java @@ -21,6 +21,7 @@ public class RustConstants { public static final CategoryPath RUST_CATEGORYPATH = new CategoryPath("/rust"); public static final byte[] RUST_SIGNATURE_1 = "RUST_BACKTRACE".getBytes(); public static final byte[] RUST_SIGNATURE_2 = "/rustc/".getBytes(); + public static final byte[] RUST_SIGNATURE_3 = "RUST_MIN_STACK".getBytes(); public static final String RUST_EXTENSIONS_PATH = "extensions/rust/"; public static final String RUST_EXTENSIONS_UNIX = "unix"; public static final String RUST_EXTENSIONS_WINDOWS = "windows"; diff --git a/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/rust/RustUtilities.java b/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/rust/RustUtilities.java index 08e5e29f13..41b556e811 100644 --- a/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/rust/RustUtilities.java +++ b/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/rust/RustUtilities.java @@ -38,7 +38,11 @@ import ghidra.xml.XmlParseException; public class RustUtilities { /** * Checks if a given {@link MemoryBlock} contains a Rust signature - * + * + * This is used in the loader to determine if a program was compiled with rust. + * If the program is determined to be rust, then the compiler property is set to + * {@Link RustConstants.RUST_COMPILER}. + * * @param block The {@link MemoryBlock} to scan for Rust signatures * @return True if the given {@link MemoryBlock} is not null and contains a Rust signature; * otherwise, false @@ -55,6 +59,9 @@ public class RustUtilities { if (containsBytes(bytes, RustConstants.RUST_SIGNATURE_2)) { return true; } + if (containsBytes(bytes, RustConstants.RUST_SIGNATURE_3)) { + return true; + } return false; } From fa41bb3556cdd62336640573edaf3eafcdfff5bc Mon Sep 17 00:00:00 2001 From: Ryan Kurtz Date: Thu, 20 Mar 2025 13:27:23 -0400 Subject: [PATCH 2/2] GP-0: Certify --- .../app/plugin/core/analysis/rust/RustConstants.java | 4 ++-- .../app/plugin/core/analysis/rust/RustUtilities.java | 10 +++++----- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/rust/RustConstants.java b/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/rust/RustConstants.java index 89d3a45e9c..968f6f0c62 100644 --- a/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/rust/RustConstants.java +++ b/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/rust/RustConstants.java @@ -4,9 +4,9 @@ * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at - * + * * http://www.apache.org/licenses/LICENSE-2.0 - * + * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. diff --git a/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/rust/RustUtilities.java b/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/rust/RustUtilities.java index 41b556e811..0c44da5b48 100644 --- a/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/rust/RustUtilities.java +++ b/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/rust/RustUtilities.java @@ -4,9 +4,9 @@ * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at - * + * * http://www.apache.org/licenses/LICENSE-2.0 - * + * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. @@ -38,10 +38,10 @@ import ghidra.xml.XmlParseException; public class RustUtilities { /** * Checks if a given {@link MemoryBlock} contains a Rust signature - * - * This is used in the loader to determine if a program was compiled with rust. + *

+ * This may be used by loaders to determine if a program was compiled with rust. * If the program is determined to be rust, then the compiler property is set to - * {@Link RustConstants.RUST_COMPILER}. + * {@link RustConstants#RUST_COMPILER}. * * @param block The {@link MemoryBlock} to scan for Rust signatures * @return True if the given {@link MemoryBlock} is not null and contains a Rust signature;