Skip to content

Protect Rust strings read by ELF early initializers - #4

Merged
moloch-- merged 1 commit into
mainfrom
fix/rust-preinit-string-safety
Oct 15, 2026
Merged

moloch-- merged 1 commit into
mainfrom
fix/rust-preinit-string-safety

Conversation

@moloch--

Copy link
Copy Markdown
Contributor

Summary

  • Keep Rust byte arrays plaintext when ELF .preinit_array callbacks, their subsections, or explicit priority-zero .init_array callbacks can read them before the string decoder runs.
  • Follow direct initializer callees and conservatively skip encoding when an early callback or entry cannot be resolved.
  • Add direct, indirect, and real Rust startup regressions while confirming unrelated later strings are still encoded.

Verification

  • Built opt and clang locally; formatting and git diff --check passed.
  • Full portable obfuscation suite passed, including the focused Rust string-data regression.
  • On Linux with Rust 1.99.0 at O0 and O2, baseline and transformed executables printed preinit=114 observed=114 later=114 and exited successfully. The early marker stayed in IR, object, and executable; the unrelated late marker disappeared from transformed artifacts.

@moloch--
moloch-- merged commit 50154ef into main Oct 15, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant