Add Rust trait-object devirtualization#6608
Conversation
Codecov Report❌ Patch coverage is Additional details and impacted files
... and 15 files with indirect coverage changes Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
|
Will add more tests to improve coverage |
historicattle
requested review from
Rot127,
b1llow,
kazarmy,
notxvilka,
ret2libc,
thestr4ng3r and
wargio
as code owners
Recover Rust trait-object dispatch targets from demangled impl metadata, vtable layouts, and core::any::Any type_id methods. Track IL state in the current function, replay callers up to call sites to seed ABI argument registers, and use discovered vtable pointers to resolve virtual calls. Add recovered xrefs and comments for trait dispatch and Any downcast/type_id cases.
|
|
||
| #include "analysis_private.h" | ||
|
|
||
| #define RUST_VTABLE_HEADER_SLOTS 3 | ||
| #define RUST_MAX_TRAIT_METHOD_SLOTS 128 |
There was a problem hiding this comment.
if you have resource links (official docs, sources, etc..) for this, please add a comment to it!
There was a problem hiding this comment.
RUST_VTABLE_HEADER_SLOTS just refers to drop, size, align entries in the header
RUST_MAX_TRAIT_METHOD_SLOTS is a defensive bound i added, it is not a rust ABI limit.
Im sorry, i will remove this
There was a problem hiding this comment.
no, i wasnt talking about this.
i was actually talking to just add some references on how the rtti for rust works as a doxygen comment above those lines
| return !strcmp(section->name, ".rodata") || | ||
| !strcmp(section->name, ".rdata") || | ||
| !strcmp(section->name, ".data.rel.ro") || | ||
| !strcmp(section->name, ".data.rel.ro.local") || | ||
| rz_str_endswith(section->name, "__const"); |
There was a problem hiding this comment.
does this cover also win binaries?
There was a problem hiding this comment.
I havent tested it on PE
I will get back in a bit
wargio
left a comment
wargio
left a comment
There was a problem hiding this comment.
LGTM, but all the tests seems to be for x86. do you have anything for arm64 or riscv ?
|
No, i have only tested it on my local x86 as of now Edit: I get im looking into it |
2 participants
Your checklist for this pull request
RZ_APIfunction and struct this PR changes.RZ_API).Detailed description
This adds Rust trait-object RTTI recovery and devirtualization support.
Rust does not expose traditional style RTTI, instead, trait object vtables are plain structs in read-only data with a fixed header layout (drop, size, align) followed by function pointers. Class and trait metadata exists only in mangled symbol names (e.g. ::method). This PR recovers that metadata and uses it to resolve virtual dispatch.
Test plan
Adds tests in
cmd_acandcmd_avDCurrently a few tests are marked BROKEN since they are waiting on rizinorg/rizin-testbins#305
Closing issues
none