ဧည္႔စရင္း


hit counter

Sunday, June 4, 2023

Reversing Rust String And Str Datatypes

Lets build an app that uses several data-types in order to see how is stored from a low level perspective.

Rust string data-types

The two first main objects are "str" and String, lets check also the constructors.




Imports and functions

Even such a basic program links several libraries and occupy 2,568Kb,  it's really not using the imports and expots the runtime functions even the main. 


Even a simple string operation needs 544 functions on rust:


Main function

If you expected see a clear main function I regret to say that rust doesn't seem a real low-level language In spite of having a full control of the memory.


Ghidra turns crazy when tries to do the recursive parsing of the rust code, and finally we have the libc _start function, the endless loop after main is the way Ghidra decompiles the HLT instruction.


If we jump to main, we see a function call, the first parameter is rust_main as I named it below:



If we search "hello world" on the Defined Strings sections, matches at the end of a large string


After doing "clear code bytes" we can see the string and the reference:


We can see that the literal is stored in an non null terminated string, or most likely an array of bytes. we have a bunch of byte arrays and pointed from the code to the beginning.
Let's follow the ref.  [ctrl]+[shift]+[f] and we got the references that points to the rust main function.


After several naming thanks to the Ghidra comments that identify the rust runtime functions, the rust main looks more understandable.
See below the ref to "hello world" that is passed to the string allocated hard-coding the size, because is non-null terminated string and there is no way to size this, this also helps to the rust performance, and avoid the c/c++ problems when you forgot the write the null byte for example miscalculating the size on a memcpy.


Regarding the string object, the allocator internals will reveal the structure in static.
alloc_string function call a function that calls a function that calls a function and so on, so this is the stack (also on static using the Ghidra code comments)

1. _$LT$alloc..string..String$u20$as$u20$core..convert..From$LT$$RF$str$GT$$GT$::from::h752d6ce1f15e4125
2. alloc::str::_$LT$impl$u20$alloc..borrow..ToOwned$u20$for$u20$str$GT$::to_owned::h649c495e0f441934
3. alloc::slice::_$LT$impl$u20$alloc..borrow..ToOwned$u20$for$u20$$u5b$T$u5d$$GT$::to_owned::h1eac45d28
4. alloc::slice::_$LT$impl$u20$$u5b$T$u5d$$GT$::to_vec::h25257986b8057640
5. alloc::slice::hack::to_vec::h37a40daa915357ad
6. core::slice::_$LT$impl$u20$$u5b$T$u5d$$GT$::len::h2af5e6c76291f524
7. alloc::vec::Vec$LT$T$GT$::extend_from_slice::h190290413e8e57a2
8. _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$alloc..vec..SpecExtend$LT$$RF$T$C$core..slice..Iter$LT$T$GT$$GT$$GT$::spec_extend::h451c2f92a49f9caa
...


Well I'm not gonna talk about the performance impact on stack but really to program well reusing code grants the maintainability and its good, and I'm sure that the rust developed had measured that and don't compensate to hardcode directly every constructor.

At this point we have two options, check the rust source code, or try to figure out the string object in dynamic with gdb.

Source code

Let's explain this group of substructures having rust source code in the hand.
The string object is defined at string.rs and it's simply an u8 type vector.



And the definition of vector can be found at vec.rs  and is composed by a raw vector an the len which is the usize datatype.



The RawVector is a struct that helds the pointer to the null terminated string stored on an Unique object, and also contains the allocation pointer, here raw_vec.rs definition.



The cap field is the capacity of the allocation and a is the allocator:



Finally the Unique object structure contains a pointer to the null terminated string, and also a one byte marker core::marker::PhantomData



Dynamic analysis

The first parameter of the constructor is the interesting one, and in x64 arch is on RDI register, the extrange sequence RDI,RSI,RDX,RCX it sounds like ACDC with a bit of imagination (di-si-d-c)

So the RDI parámeter is the pointer to the string object:



So RDI contains the stack address pointer that points the the heap address 0x5578f030.
Remember to disable ASLR to correlate the addresses with Ghidra, there is also a plugin to do the synchronization.

Having symbols we can do:
p mystring

and we get the following structure:

String::String {
  vec: alloc::vec::Vec {
    buf: alloc::raw_vec::RawVec {
      ptr: core::ptr::unique::Unique {
        pointer: 0x555555790130 "hello world\000",
        _marker: core::marker::PhantomData
     },
     cap: 11,
     a: alloc::alloc::Global
   },
   len: 11
  }
}

If the binary was compiled with symbols we can walk the substructures in this way:

(gdb) p mystring.vec.buf.ptr
$6 = core::ptr::unique::Unique {pointer: 0x555555790130 "hello world\000", _marker: core::marker::PhantomData}

(gdb) p mystring.vec.len

$8 = 11

If we try to get the pointer of each substructure we would find out that the the pointer is the same:


If we look at this pointer, we have two dwords that are the pointer to the null terminated string, and also 0xb which is the size, this structure is a vector.


The pionter to the c string is 0x555555790130




This seems the c++ string but, let's look a bit deeper:

RawVector
  Vector:
  (gdb) x/wx 0x7fffffffdf50
  0x7fffffffdf50: 0x55790130  -> low dword c string pointer
  0x7fffffffdf54: 0x00005555  -> hight dword c string pointer
  0x7fffffffdf58: 0x0000000b  -> len

0x7fffffffdf5c: 0x00000000
0x7fffffffdf60: 0x0000000b  -> low cap (capacity)
0x7fffffffdf64: 0x00000000  -> hight cap
0x7fffffffdf68: 0xf722fe27  -> low a  (allocator)
0x7fffffffdf6c: 0x00007fff  -> hight a
0x7fffffffdf70: 0x00000005 

So in this case the whole object is in stack except the null-terminated string.




More information


  1. Hacking Tools 2019
  2. Hack App
  3. Pentest Automation Tools
  4. Pentest Tools Download
  5. Tools For Hacker
  6. Hacker Tools Apk Download
  7. Hacking Tools 2019
  8. Growth Hacker Tools
  9. Hacking Tools For Windows 7
  10. Hacker Tool Kit
  11. Hacking Tools For Beginners
  12. Pentest Tools Nmap
  13. Hack Tools For Ubuntu
  14. Hacker Tools Free Download
  15. Pentest Tools Android
  16. Hacking Tools Mac
  17. Best Hacking Tools 2020
  18. Hacking Tools Software
  19. Nsa Hack Tools
  20. Github Hacking Tools
  21. Github Hacking Tools
  22. Hacker Tools Apk
  23. Nsa Hacker Tools
  24. Pentest Tools For Mac
  25. Hack Tools 2019
  26. Hacking Tools Name
  27. Android Hack Tools Github
  28. Hack Apps
  29. Pentest Box Tools Download
  30. Hacking Tools Pc
  31. What Is Hacking Tools
  32. Pentest Reporting Tools
  33. Nsa Hacker Tools
  34. Hacking Tools Pc
  35. Pentest Recon Tools
  36. Game Hacking
  37. Hacking Tools For Games
  38. Hacking Tools 2020
  39. Hacking Tools For Windows 7
  40. Game Hacking
  41. Hack Tools Github
  42. World No 1 Hacker Software
  43. Hacking Tools For Windows Free Download
  44. Underground Hacker Sites
  45. Hacker Tools List
  46. Hacker
  47. Top Pentest Tools
  48. Hacker Tools Github
  49. Best Hacking Tools 2020
  50. New Hack Tools
  51. Hacker Tools 2019
  52. Hacking Tools Download
  53. Beginner Hacker Tools
  54. Hack Tool Apk
  55. Hacking Tools Name
  56. Wifi Hacker Tools For Windows
  57. Hack Tools Online
  58. Tools For Hacker
  59. Hack Tools For Mac
  60. Hacking Tools 2019
  61. Pentest Tools List
  62. Hacking Tools For Pc
  63. Hacking Tools Windows
  64. What Is Hacking Tools
  65. Wifi Hacker Tools For Windows
  66. Hack Tools Github
  67. Tools For Hacker
  68. Blackhat Hacker Tools
  69. Hackers Toolbox
  70. Hacker Tools 2019
  71. Hacker Tools For Mac
  72. Hacking Tools For Windows
  73. Tools 4 Hack
  74. Hacking Tools For Beginners
  75. Black Hat Hacker Tools
  76. Hacker Tools 2020
  77. Pentest Recon Tools
  78. Black Hat Hacker Tools
  79. Hack Tool Apk
  80. Hack And Tools
  81. Best Hacking Tools 2019
  82. Pentest Tools Windows
  83. Hacking Tools 2020
  84. Hack App
  85. Pentest Tools Alternative
  86. Pentest Tools Framework
  87. Underground Hacker Sites
  88. Physical Pentest Tools
  89. Hacker Tools Apk Download
  90. Hacking Tools Windows 10
  91. Underground Hacker Sites
  92. Hack Tools For Games
  93. Pentest Tools Download
  94. Hacker Tools Mac
  95. Github Hacking Tools
  96. Hacking Tools
  97. Kik Hack Tools
  98. Nsa Hack Tools
  99. Pentest Tools
  100. Hack Tools For Pc
  101. Pentest Tools Download
  102. Hacker Tools For Ios
  103. Pentest Tools Github
  104. Best Hacking Tools 2019
  105. Pentest Tools Linux
  106. Pentest Tools List
  107. Hacking Tools Usb
  108. Pentest Tools Find Subdomains
  109. Pentest Tools Alternative
  110. Hack Tool Apk
  111. Beginner Hacker Tools
  112. Hack Apps
  113. How To Make Hacking Tools
  114. Hacking Tools For Windows Free Download
  115. Hack And Tools
  116. Hacker Tools Linux
  117. Top Pentest Tools
  118. Hackrf Tools
  119. Nsa Hack Tools Download
  120. Pentest Tools Free
  121. Hack Tools For Mac
  122. Android Hack Tools Github
  123. Pentest Tools Bluekeep
  124. Pentest Tools For Windows
  125. Hacker Tools Windows
  126. Hacking Tools
  127. Pentest Reporting Tools
  128. Hacking Tools For Beginners
  129. Hacker Tools Free Download
  130. Hack Tools For Mac
  131. Hack Apps
  132. What Are Hacking Tools
  133. Pentest Tools Android
  134. Hack Tools For Mac
  135. Hackers Toolbox
  136. Hacker Techniques Tools And Incident Handling

No comments: