Reversing Rust String And Str Datatypes
Lets build an app that uses several data-types in order to see how is stored from a low level perspective.
Rust string data-types
The two first main objects are "str" and String, lets check also the constructors.Imports and functions
Even such a basic program links several libraries and occupy 2,568Kb, it's really not using the imports and expots the runtime functions even the main.
Even a simple string operation needs 544 functions on rust:
Main function
If you expected see a clear main function I regret to say that rust doesn't seem a real low-level language In spite of having a full control of the memory.Ghidra turns crazy when tries to do the recursive parsing of the rust code, and finally we have the libc _start function, the endless loop after main is the way Ghidra decompiles the HLT instruction.
If we jump to main, we see a function call, the first parameter is rust_main as I named it below:
If we search "hello world" on the Defined Strings sections, matches at the end of a large string
After doing "clear code bytes" we can see the string and the reference:
We can see that the literal is stored in an non null terminated string, or most likely an array of bytes. we have a bunch of byte arrays and pointed from the code to the beginning.
Let's follow the ref. [ctrl]+[shift]+[f] and we got the references that points to the rust main function.
After several naming thanks to the Ghidra comments that identify the rust runtime functions, the rust main looks more understandable.
See below the ref to "hello world" that is passed to the string allocated hard-coding the size, because is non-null terminated string and there is no way to size this, this also helps to the rust performance, and avoid the c/c++ problems when you forgot the write the null byte for example miscalculating the size on a memcpy.
Regarding the string object, the allocator internals will reveal the structure in static.
alloc_string function call a function that calls a function that calls a function and so on, so this is the stack (also on static using the Ghidra code comments)
1. _$LT$alloc..string..String$u20$as$u20$core..convert..From$LT$$RF$str$GT$$GT$::from::h752d6ce1f15e4125
2. alloc::str::_$LT$impl$u20$alloc..borrow..ToOwned$u20$for$u20$str$GT$::to_owned::h649c495e0f441934
3. alloc::slice::_$LT$impl$u20$alloc..borrow..ToOwned$u20$for$u20$$u5b$T$u5d$$GT$::to_owned::h1eac45d28
4. alloc::slice::_$LT$impl$u20$$u5b$T$u5d$$GT$::to_vec::h25257986b8057640
5. alloc::slice::hack::to_vec::h37a40daa915357ad
6. core::slice::_$LT$impl$u20$$u5b$T$u5d$$GT$::len::h2af5e6c76291f524
7. alloc::vec::Vec$LT$T$GT$::extend_from_slice::h190290413e8e57a2
8. _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$alloc..vec..SpecExtend$LT$$RF$T$C$core..slice..Iter$LT$T$GT$$GT$$GT$::spec_extend::h451c2f92a49f9caa
...
Well I'm not gonna talk about the performance impact on stack but really to program well reusing code grants the maintainability and its good, and I'm sure that the rust developed had measured that and don't compensate to hardcode directly every constructor.
At this point we have two options, check the rust source code, or try to figure out the string object in dynamic with gdb.
Source code
The string object is defined at string.rs and it's simply an u8 type vector.
And the definition of vector can be found at vec.rs and is composed by a raw vector an the len which is the usize datatype.
The RawVector is a struct that helds the pointer to the null terminated string stored on an Unique object, and also contains the allocation pointer, here raw_vec.rs definition.
The cap field is the capacity of the allocation and a is the allocator:
Finally the Unique object structure contains a pointer to the null terminated string, and also a one byte marker core::marker::PhantomData
Dynamic analysis
The first parameter of the constructor is the interesting one, and in x64 arch is on RDI register, the extrange sequence RDI,RSI,RDX,RCX it sounds like ACDC with a bit of imagination (di-si-d-c)So the RDI parámeter is the pointer to the string object:
So RDI contains the stack address pointer that points the the heap address 0x5578f030.
Remember to disable ASLR to correlate the addresses with Ghidra, there is also a plugin to do the synchronization.
Having symbols we can do:
p mystring
and we get the following structure:
String::String {
vec: alloc::vec::Vec
buf: alloc::raw_vec::RawVec
ptr: core::ptr::unique::Unique
pointer: 0x555555790130 "hello world\000",
_marker: core::marker::PhantomData
},
cap: 11,
a: alloc::alloc::Global
},
len: 11
}
}
If the binary was compiled with symbols we can walk the substructures in this way:
(gdb) p mystring.vec.buf.ptr
$6 = core::ptr::unique::Unique
(gdb) p mystring.vec.len
$8 = 11
If we try to get the pointer of each substructure we would find out that the the pointer is the same:
If we look at this pointer, we have two dwords that are the pointer to the null terminated string, and also 0xb which is the size, this structure is a vector.
The pionter to the c string is 0x555555790130
This seems the c++ string but, let's look a bit deeper:
RawVector
Vector:
(gdb) x/wx 0x7fffffffdf50
0x7fffffffdf50: 0x55790130 -> low dword c string pointer
0x7fffffffdf54: 0x00005555 -> hight dword c string pointer
0x7fffffffdf58: 0x0000000b -> len
0x7fffffffdf5c: 0x00000000
0x7fffffffdf60: 0x0000000b -> low cap (capacity)
0x7fffffffdf64: 0x00000000 -> hight cap
0x7fffffffdf68: 0xf722fe27 -> low a (allocator)
0x7fffffffdf6c: 0x00007fff -> hight a
0x7fffffffdf70: 0x00000005
So in this case the whole object is in stack except the null-terminated string.
Related news
- Pentest Tools For Android
- Blackhat Hacker Tools
- Github Hacking Tools
- Hacking Tools
- Computer Hacker
- Nsa Hacker Tools
- World No 1 Hacker Software
- Hak5 Tools
- Github Hacking Tools
- Termux Hacking Tools 2019
- Pentest Reporting Tools
- Hack Tools For Games
- Hacking Tools For Windows
- Hacking Tools Windows
- Pentest Recon Tools
- Hack Tools 2019
- Hack Rom Tools
- Hack Tools Github
- Hacking Tools Pc
- Hacker Tools Github
- Hacker Tools List
- Hacking Tools For Games
- Pentest Tools Nmap
- Hacker Tools For Mac
- Hacker Tool Kit
- Growth Hacker Tools
- Hacking Tools And Software
- Hacker Tools For Pc
- Hacking Tools Usb
- Hak5 Tools
- Hack Tools For Pc
- Hack Tools
- Wifi Hacker Tools For Windows
- Hacking Tools 2019
- Hackers Toolbox
- Hacking Tools For Games
- Tools 4 Hack
- Usb Pentest Tools
- Hack Rom Tools
- Hack Tools 2019
- Hacking Tools Name
- Hacker Tools For Pc
- Hacking Tools Kit
- Hacker Tools For Ios
- Hacker Tools Linux
- Hacking Tools Free Download
- Pentest Recon Tools
- Hacking Tools Download
- Hacking Tools For Kali Linux
- Pentest Tools Alternative
- Hacker Techniques Tools And Incident Handling
- Hacker Tools Hardware
- Hacking Tools And Software
- Pentest Tools Port Scanner
- Blackhat Hacker Tools
- Free Pentest Tools For Windows
- Hacker
- Kik Hack Tools
- Hacker Tools Github
- Termux Hacking Tools 2019
- Best Hacking Tools 2019
- Pentest Tools Url Fuzzer
- Hack Tools Online
- Hacker Tools Free
- Hacking Tools For Games
- Hack Tools Download
- Pentest Tools
- Hack Tools Pc
- Hacking Tools Software
- Hack App
- Hack Tools
- Pentest Tools Online
- Hacking Tools For Kali Linux
- Hack Tool Apk No Root
- Hacking Tools Free Download
- Nsa Hacker Tools
- Hack Tools 2019
- Hak5 Tools
- Hack Tools
- Hacking Tools Kit
- Pentest Tools Github
- Hack App
- Hacking Tools Name
- Nsa Hack Tools
- Hacker Tools Free
- Growth Hacker Tools
- Computer Hacker
- Nsa Hacker Tools
- Hackrf Tools
- Hacker Tools Free Download
- Hacker Tools Software
- Pentest Tools Open Source
- Hacker Tools Windows
- What Is Hacking Tools
- Easy Hack Tools
- Hacking Tools Usb
- Hacker Tools Apk Download
- Hacking Tools Windows
- Hack Tool Apk
- Pentest Tools Website Vulnerability
- Wifi Hacker Tools For Windows
- Best Hacking Tools 2019
- Hacking Tools Mac
- Github Hacking Tools
- Pentest Tools Github
- Hacker Tools For Windows
- Hacker Tools Software
- Hacking Tools Windows
- Hacker Tools For Pc
- Nsa Hacker Tools
- Hacking Tools For Windows
- Pentest Tools Online
- Tools Used For Hacking
- How To Hack
- Hacking Tools For Beginners
- Hacking Tools For Mac
- Hacker Tools Software
- Pentest Box Tools Download
- Tools Used For Hacking
- Hack And Tools
- Hacker Tools Github
- Hacker Tools
- Black Hat Hacker Tools
- Hacking Tools Kit
- Hack Tools For Windows
- Hack Tools 2019
- Pentest Tools Subdomain
- Hack And Tools
- Hack Tool Apk
- Pentest Tools Online
- Pentest Tools Alternative
- Pentest Tools Kali Linux
- Blackhat Hacker Tools
- Hack Tool Apk No Root
- Tools Used For Hacking
- Hacking Tools For Windows 7
- Pentest Tools For Android
- Hacking Tools Pc
- Tools Used For Hacking
- Pentest Tools Github
- Android Hack Tools Github
- Hacking Tools Windows 10
- Pentest Tools Apk
- Hacking Tools Free Download
- New Hacker Tools
- Hacker Tools For Windows
- Hacking Tools For Games
- Hack Tools For Pc
- Hacking App
- Hack App
- Hack Tools For Ubuntu
- Pentest Tools Find Subdomains
- Hacking Tools Github
- Hack Tools Mac
- Tools For Hacker
- Hacker Search Tools
- Best Hacking Tools 2019
- Hacker Tools Software
- Hacker Tools Online
- Install Pentest Tools Ubuntu
- Pentest Recon Tools
- Wifi Hacker Tools For Windows
- Hacker Tools For Pc
- Hackers Toolbox
- Hacker Tools Software
- Hacking Tools Name
- Pentest Tools Nmap
- Pentest Tools For Mac
- Pentest Tools Review
- Kik Hack Tools
- Hacker Tools Free Download
- Hacking Tools Github
- Pentest Tools Alternative
- Hackrf Tools
- Hacking Tools Github
- Hack Tools
0 Comments:
Post a Comment
Subscribe to Post Comments [Atom]
<< Home