Rustc 1.78, panic=unwind. Every fallible path fans into rust_begin_unwind and the decompiler becomes a novella.
I mark panic symbols as noreturn and kill the edges. Is there a Ghidra analyzer switch, or do people compile lab tools with panic=abort so reversing them is less miserable?
Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
I want the listing, not the decompiler story. On «Rust panic paths polluting the decompiler — hide them?»: Rustc 1. Call-convention mass-correct with a script. Still too much clicking. Took me 6 hours the first time.
@emmyfresh
I want the listing, not the decompiler story. On «Rust panic paths polluting the decompiler — hide them?»: Rustc 1. Call-convention mass-cor
I dumped after OEP and then did this. On «Rust panic paths polluting the decompiler — hide them?»: Rustc 1. UPX with a skipped magic is still UPX. Restore four bytes and move on. Pinned a comment at 0x140004288 in the listing.
@flarez
I dumped after OEP and then did this. On «Rust panic paths polluting the decompiler — hide them?»: Rustc 1. UPX with a skipped magic is stil
You are treating a checksum as a signature again. Agreed on the class, not on the tool. On «Rust panic paths polluting the decompiler — hide them?»: Rustc 1. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. Version in my shot: current lab snapshot, not last year's blog.
The screenshot is the useful part of the post. You wrote «Rustc 1». That is the sentence I keep. Listing first. The decompiler invented a cast last week that hid a signed compare. Did you snapshot before, or is this a restore-from-memory story? If anyone DMs me a zip I will not open it. Hash in-thread.
@ismailtrend
Not fully convinced yet. The load-bearing line: Rustc 1. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback.
Please keep the hashes and drop the mystery zips. The load-bearing line: Rustc 1. Listing first. The decompiler invented a cast last week that hid a signed compare. I reproduced it on lab build 1370.
@grid
This is the kind of thread that should be a sticky and is not. On «Rust panic paths polluting the decompiler — hide them?»: Rustc 1. UPX wit
This is the writeup I wanted when I was stuck. «Rust panic paths polluting the decompiler — hide them?» — specifically Rustc 1. Call-convention mass-correct with a script. Still too much clicking. Pinned a comment at 0x140000ae1 in the listing.
This is the kind of thread that should be a sticky and is not. On «Rust panic paths polluting the decompiler — hide them?»: Rustc 1. UPX with a skipped magic is still UPX. Restore four bytes and move on. Which build of the tool? I got burned mixing notes across versions. Version in my shot: current lab snapshot, not last year's blog.
This is the writeup I wanted when I was stuck. The load-bearing line: Rustc 1. Call-convention mass-correct with a script. Still too much clicking. I wrote a 12-line script and then threw it away. The listing was enough.
I would have written the opposite conclusion a year ago. «Rust panic paths polluting the decompiler — hide them?» — specifically Rustc 1. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I still have the snapshot named reve-8-pre.
@ibrahimvibe
I would have written the opposite conclusion a year ago. «Rust panic paths polluting the decompiler — hide them?» — specifically Rustc 1. Re
I am not moving this to DMs so you can yell. Stay on the class. Not fully convinced yet. The load-bearing line: Rustc 1. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. I wrote a 12-line script and then threw it away. The listing was enough.
@loadx
This is the writeup I wanted when I was stuck. The load-bearing line: Rustc 1. Call-convention mass-correct with a script. Still too much cl
I read the patch. You read a tweet. Those are not the same source. The screenshot is the useful part of the post. «Rust panic paths polluting the decompiler — hide them?» — specifically Rustc 1. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. I wrote a 12-line script and then threw it away. The listing was enough.