FLOSS for Gophers and Crabs: Extracting Strings from Go and Rust Executables

To support the static analysis of Go and Rust executables, FLOSS now extracts program strings using enhanced algorithms.
Where traditional extraction algorithms provide compound and confusing string output FLOSS recovers the individual Go and Rust strings as they are used in a program.
Analysts who have inspected Go or Rust samples know how confusing the traditional strings.
This problem arises because Rust and Go compilers do not NULL-terminate strings.
Using FLOSS to extract Go and Rust strings Figure 2 shows an example of running FLOSS version 3.0 on a Rust executable.
String deobfuscation may be inaccurate or take a long time for Go and Rust executables because they are often large and have many and/or complex functions to analyze.
To only focus on the static strings of Go and Rust programs you can use the -only/-no arguments to enable or disable the extraction of a string type, e.g., static or decoded.
Go and Rust strings are part of the static string extraction.
The language-specific strings are listed in a section named FLOSS GO STRINGS or FLOSS RUST STRINGS. This section follows the output of the regular ASCII and UTF16-LE encoded strings.
To identify Rust compilers FLOSS searches common Rust string patterns, including those related to error handling.
Extracting Strings from Go Binaries Go strings are generally UTF-8 encoded this isn't guaranteed.
In compiled Go binaries the most interesting strings for analysts are commonly stored without a NULL terminator.
Extracting Go Strings from Windows PE files FLOSS identifies String structures and code references in Go programs to extract individual strings with corresponding lengths.
Our algorithm relies on the Go linker storing strings in one consecutive range in length-sorted order, from shortest to longest.
Extracting Strings from Rust Binaries Strings in Rust are guaranteed to be valid UTF-8 sequences.
FLOSS focuses on these and doesn't specifically handle other string types which may contain non-UTF-8 characters such as OsStrings or byte strings.
For Windows PE files Rust strings commonly reside in the binary's.
Extracting Rust Strings from Windows PE files To extract strings from programs created using the Rust compiler, FLOSS reuses many of the ideas and functions used for the Go string extraction.
Conclusion The newest release of FLOSS extracts strings from Windows binaries written in Go and Rust.
To try out FLOSS' new functionality download a standalone binary from the Release page or use pip to install the tool from PyPI. You can then run the tool against any Windows PE Go or Rust sample to extract language-specific strings.


This Cyber News was published on www.mandiant.com. Publication date: Wed, 13 Dec 2023 21:43:04 +0000


Cyber News related to FLOSS for Gophers and Crabs: Extracting Strings from Go and Rust Executables

FLOSS for Gophers and Crabs: Extracting Strings from Go and Rust Executables - To support the static analysis of Go and Rust executables, FLOSS now extracts program strings using enhanced algorithms. Where traditional extraction algorithms provide compound and confusing string output FLOSS recovers the individual Go and Rust ...
1 year ago Mandiant.com
Critical Rust Flaw Poses Exploit Threat in Specific Windows Use Cases - The Rust Project has issued an update for its standard library, after a vulnerability researcher discovered a specific function used to execute batch files on Windows systems could be exploited using an injection flaw. The set of common functions ...
8 months ago Darkreading.com
Google Contributes $1 Million to Rust, Says It Prevented Hundreds of Android Vulnerabilities - Google today announced a grant of $1 million to the Rust Foundation, meant to help improve the interoperability between Rust and C++ code. The internet giant joined the Rust Foundation in 2021, for the same reason, and has adopted the memory-safe ...
10 months ago Securityweek.com
CVE-2019-16760 - Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rename dependencies in `Cargo.toml` is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and ...
5 years ago
Google throws $1m at Rust Foundation to build C++ bridges The Register - Google on Monday donated $1 million to the Rust Foundation specifically to improve interoperability between the language and C++. C++, a popular general purpose programming language, has arguably fallen out of fashion due to concerns over safety. ...
10 months ago Go.theregister.com
CVE-2023-30624 - Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state, such as tables and memories, contains LLVM-level undefined behavior. This undefined behavior ...
1 year ago
CVE-2018-5392 - mingw-w64 version 5.0.4 by default produces executables that opt in to ASLR, but are not compatible with ASLR. ASLR is an exploit mitigation technique used by modern Windows platforms. For ASLR to function, Windows executables must contain a ...
5 years ago
Hamas-Linked APT Wields New SysJoker Backdoor Against Israel - Attackers linked to the Palestinian militant group Hamas are using a revamped version of the SysJoker multi-platform backdoor to attack targets in Israel as the current conflict between the two continues despite a current pause in the fighting. An ...
1 year ago Darkreading.com
Google Pushes Software Security Via Rust, AI-Based Fuzzing - Google is making moves to help developers ensure that their code is secure. The IT giant this week said it is donating $1 million to the Rust Foundation to improve interoperability between the Rust programming language and legacy C++ codebase in ...
10 months ago Securityboulevard.com
Lazarus Group bang on trend with memory-safe Dlang malware The Register - Research into Lazarus Group's attacks using Log4Shell has revealed novel malware strains written in an atypical programming language. DLang is among the newer breed of memory-safe languages being endorsed by Western security agencies over the past ...
1 year ago Go.theregister.com
Multi-layer Malware Sold on The Dark Web - Threat actors make use of fast-evolving multi-layer malware for their complexity and sophistication, as they offer the ability to rapidly adapt and change their code. To make analysis and countermeasures more difficult, this sophisticated type of ...
1 year ago Cybersecuritynews.com
CVE-2023-40030 - Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by `cargo build --timings`. A malicious package ...
1 year ago
CVE-2024-47763 - Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a runtime crash in certain WebAssembly modules. The runtime crash may be undefined behavior if ...
2 months ago
CVE-2022-21658 - Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a ...
2 years ago
CVE-2022-36113 - Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the ~/.cargo folder on disk, making it available to the Rust projects it builds. To record when an extraction is ...
1 year ago
CVE-2023-38497 - Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user ...
1 year ago
Signing Executables With Azure DevOps - This signing tool is compatible with all major executable files and works impeccably with all OV and EV code signing certificates. It's mostly used with Azure DevOps due to the benefit of Azure Key Vault. Here, you will undergo the complete procedure ...
11 months ago Feeds.dzone.com
CVE-2024-24828 - pkg is tool design to bundle Node.js projects into an executables. Any native code packages built by `pkg` are written to a hardcoded directory. On unix systems, this is `/tmp/pkg/*` which is a shared directory for all users on the same local system. ...
10 months ago
CVE-2020-10733 - The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths. Executables in the directory where the installer loads or the current working directory take precedence over the intended ...
2 years ago
Operation RusticWeb Using PowerShell Commands to filtrate Doc - Hackers use PowerShell commands because they provide a powerful scripting environment on Windows systems, allowing them to stealthily execute malicious scripts and commands called Operation RusticWeb. The PowerShell's capabilities make it an ...
11 months ago Gbhackers.com
CVE-2024-24576 - Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly escape arguments when invoking batch files (with the `bat` and `cmd` extensions) on Windows using the ...
8 months ago Tenable.com
CVE-2022-36114 - Cargo is a package manager for the rust programming language. It was discovered that Cargo did not limit the amount of data extracted from compressed archives. An attacker could upload to an alternate registry a specially crafted package that ...
1 year ago
CVE-2021-20332 - Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentially ...
3 months ago
CVE-2023-50711 - vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 and prior to version 0.12.0, an issue in the `FamStructWrapper::deserialize` implementation provided by the ...
10 months ago
CVE-2022-46176 - Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) ...
1 year ago

Latest Cyber News


Cyber Trends (last 7 days)


Trending Cyber News (last 7 days)