Evidence at a glance
Based on the linked sources. The author's reported result and independent confirmation are separate checks.
- AI involvement
- Reported models: Claude Opus 5.5. Tools: Unicorn, Ghidra, Z3, FLOSS, Frida. The writeup below describes the work attributed to AI.
- Reported result
- Works. This is the directory's source-based outcome classification.
- Independent confirmation
- Not reported.
- Human work and limitations
- The author (VAHPEM) frames this as defensive malware analysis and uses synthetic samples in the main demo. The benchmark numbers in RESULTS.md are the author's own, and this directory has not run the tool.
Original sources
What was done
rust-deobf decodes hidden strings, C2 addresses, mutexes and registry keys from obfuscated Rust binaries by emulating decoder functions. All of the last 60 commits carry a Claude Opus 5.5 trailer.
rust-deobf targets compiled Rust binaries in ELF, PE and Mach-O formats for x86-64, ARM64 and x86 that hide their indicators. The README's demo builds a stripped Rust program the way malware ships (size optimization, fat LTO, abort on panic) with eight indicators encrypted by the obfstr crate. Running strings on it finds none of them, while rust-deobf recovers all eight, including an IP and port, a file path, a user agent, a registry key and a mutex, from the program's decoder functions by static analysis and emulation with Unicorn, without ever running the sample. In the demo run it recovered 8 strings in about 6.8 seconds.
Beyond strings, the README lists static unpacking of UPX-style stubs, which it says was cross-checked against a live Frida dump at 99 percent identical, hash-obfuscated API resolution, control-flow-flattening detection and reconstruction, MBA and opaque-predicate simplification with Z3, Rust vtable recovery, and recovery of println and panic format strings, with annotations written back into Ghidra. A FLOSS-compatible export and batch mode are included, and the repository has an agent-facing usage section.
All 60 commits in the window carry a Claude Opus 5.5 trailer, and the repository has a CLAUDE.md. The core is Apache-2.0, while some premium components use AGPL-3.0 or a commercial license.
Reproduce it
Install from PyPI or the repository, then run scripts/recover.py on a binary; the README's quick start shows the demo with a bundled synthetic sample. Real malware should only be analysed in a safe environment.
Community
Ask a question, share what worked, or follow the next milestone.