search

DMaroo / GhidRust

GhidRust: Rust decompiler plugin for Ghidra
MIT License
229 stars 12 forks source link

Fix up contiguous rust strings #9

Open copumpkin opened 9 months ago

copumpkin commented 9 months ago

Hi! I was wondering if you had any plans to get this plugin to detect and fix up the contiguous string data in rust binaries.

DMaroo commented 9 months ago

Hi, I think it would be a good idea to implement this, but in the meanwhile I suggest you try out nccgroup/ghostrings. They detect strings in Go binaries by analyzing the P-code. Since the structure of Rust strings and Go strings is very similar, and ghostrings works at the P-code level, I believe that ghostrings may be effective for Rust binaries as well.

As for adding it in GhidRust, I think the priority for now is likely going to be migrating the decompilation to use ClangTokens rather than parsing the decompiled C output.