{"slug": "obfuscated-rust-binaries-malware-analysis-rust-deobf-recovering-c2-addresses", "title": "Obfuscated Rust binaries (malware analysis): rust-deobf: recovering C2 addresses from obfuscated Rust binaries without running them", "summary": "A tool called rust-deobf recovers hidden strings, command-and-control addresses, mutexes and registry keys from obfuscated Rust binaries by emulating their decoder functions with Unicorn, without executing the samples, according to the project's README. In the README's demo, a stripped Rust program built with size optimization, fat LTO and abort-on-panic and hiding eight indicators via the obfstr crate yielded all eight indicators — including an IP and port, a file path, a user agent, a registry key and a mutex — in about 6.8 seconds, while strings found none. The author, VAHPEM, frames the work as defensive malware analysis using synthetic samples, and all 60 commits in the window carry a Claude Opus 5.5 trailer; the core is Apache-2.0 while some premium components use AGPL-3.0 or a commercial license, and no independent confirmation of the results is reported.", "body_md": "## Evidence at a glance\n\nBased on the linked sources. The author's reported result and independent confirmation are separate checks.\n\n- AI involvement\n- Reported models: Claude Opus 5.5. Tools: Unicorn, Ghidra, Z3, FLOSS, Frida. The writeup below describes the work attributed to AI.\n- Reported result\n- Works. This is the directory's source-based outcome classification.\n- Independent confirmation\n- Not reported.\n- Human work and limitations\n- The author (VAHPEM) frames this as defensive malware analysis and uses synthetic samples in the main demo. The benchmark numbers in RESULTS.md are the author's own, and this directory has not run the tool.\n\n### Original sources\n\n## What was done\n\nrust-deobf decodes hidden strings, C2 addresses, mutexes and registry keys from obfuscated Rust binaries by emulating decoder functions. All of the last 60 commits carry a Claude Opus 5.5 trailer.\n\nrust-deobf targets compiled Rust binaries in ELF, PE and Mach-O formats for x86-64, ARM64 and x86 that hide their indicators. The README's demo builds a stripped Rust program the way malware ships (size optimization, fat LTO, abort on panic) with eight indicators encrypted by the obfstr crate. Running strings on it finds none of them, while rust-deobf recovers all eight, including an IP and port, a file path, a user agent, a registry key and a mutex, from the program's decoder functions by static analysis and emulation with Unicorn, without ever running the sample. In the demo run it recovered 8 strings in about 6.8 seconds.\n\nBeyond strings, the README lists static unpacking of UPX-style stubs, which it says was cross-checked against a live Frida dump at 99 percent identical, hash-obfuscated API resolution, control-flow-flattening detection and reconstruction, MBA and opaque-predicate simplification with Z3, Rust vtable recovery, and recovery of println and panic format strings, with annotations written back into Ghidra. A FLOSS-compatible export and batch mode are included, and the repository has an agent-facing usage section.\n\nAll 60 commits in the window carry a Claude Opus 5.5 trailer, and the repository has a CLAUDE.md. The core is Apache-2.0, while some premium components use AGPL-3.0 or a commercial license.\n\n## Reproduce it\n\nInstall from PyPI or the repository, then run scripts/recover.py on a binary; the README's quick start shows the demo with a bundled synthetic sample. Real malware should only be analysed in a safe environment.\n\n## Community\n\nAsk a question, share what worked, or follow the next milestone.\n\n[Your library](https://reversedwithai.com/library)", "url": "https://wpnews.pro/news/obfuscated-rust-binaries-malware-analysis-rust-deobf-recovering-c2-addresses", "canonical_source": "https://reversedwithai.com/p/rust-deobf-obfuscated-rust-malware-claude", "published_at": "2026-11-10 08:57:03+00:00", "updated_at": "2026-11-10 10:23:15.882516+00:00", "lang": "en", "topics": ["ai-tools", "artificial-intelligence", "ai-agents"], "entities": ["rust-deobf", "VAHPEM", "Claude Opus 5.5", "Unicorn", "Ghidra", "Z3", "FLOSS", "Frida"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/obfuscated-rust-binaries-malware-analysis-rust-deobf-recovering-c2-addresses", "markdown": "https://wpnews.pro/news/obfuscated-rust-binaries-malware-analysis-rust-deobf-recovering-c2-addresses.md", "text": "https://wpnews.pro/news/obfuscated-rust-binaries-malware-analysis-rust-deobf-recovering-c2-addresses.txt", "jsonld": "https://wpnews.pro/news/obfuscated-rust-binaries-malware-analysis-rust-deobf-recovering-c2-addresses.jsonld"}}