Yen Wang

0x10Work / Research

Stripped but not Silent

An early, exploratory comparison of how five reverse engineering tools handle library information in stripped Rust malware.

When Preprint, July 2026. Early-stage work Role First author, with Gaster, Renney and Legg Tools Ghidra, IDA Pro, Binary Ninja, radare2, OXIDIZER, Python
91
Rust malware samples from 65 families
3
platforms: 58 Windows, 19 Linux, 14 macOS
5
reverse engineering tools compared on the same samples
Preprint on SSRN ↗Comparison code ↗

This is early-stage, exploratory work. The sample is small and was not drawn to be representative, so the observations below describe these binaries only and should not be read as general results.

The question

Analysts often start a Rust sample from its symbols, and stripping removes them. I wanted to look at two things: what library information a stripped Rust binary still carries, and whether common tools use it.

What I did

I collected 91 Rust malware samples from 65 families (58 Windows, 19 Linux, 14 macOS) and ran five tools on the same files: Binary Ninja, Ghidra, radare2 and OXIDIZER, which rely on symbols, and IDA Pro, which can also match byte signatures. I then compared what each tool reported about the libraries in each binary.

What I observed

Rust panic sites compile a source file path into read-only data. For third-party code that path goes through the Cargo registry, so it often names the library and its version. In this set of samples, those strings were still present after stripping.

All five tools showed the strings to the analyst. None of them linked the strings back to a library. On the stripped binaries, the symbol-based tools reported little or no library information.

Limitations

  • The sample is small and opportunistic, so the observations may not hold for other Rust malware or for other tool versions.
  • The comparison is exploratory. It is not yet a controlled or fully validated method.
  • The preprint is a working version and may change.

Wang, Gaster, Renney and Legg, Stripped but not Silent: Rust Crate Identity Survives in Panic Metadata that Reverse Engineering Tools Display but Do Not Attribute. Preprint on SSRN, July 2026.