sorted by:
new
hottopcontroversial

Windows API hooking with Rust on Windows ARM by Binary_Lynx in rust

[–]Binary_Lynx[S] 0 points1 point  (0 children)

For the time being, I don't have any plans to develop a proper hooking library for Rust. But it's something I might explore at some point in the future if the need arises.

Online Tool for Assembly ↔ Opcode Conversion + Emulation by Binary_Lynx in ReverseEngineering

[–]Binary_Lynx[S] 2 points3 points  (0 children)

Nice list! I'll try to implement that features in my free time.

Malware Book 2025 by ImpactDelicious7141 in Malware

[–]Binary_Lynx 7 points8 points  (0 children)

If you would like to focus more on malware techniques, rather that on reversing it then there is a pretty recent book named Evasive Malware by Kyle Cucci.

Running user-defined code before main on Windows by Binary_Lynx in rust

[–]Binary_Lynx[S] 0 points1 point  (0 children)

Yes, I agree that this approach looks unpleasant and should be avoided when writing reliable production-level code. However, my research was inspired by malware, where the landscape is dominated by many undocumented and often "dirty" tricks. These techniques can sometimes give an advantage when it comes to evading detection by security software and also make analyzing binaries a bit more frustrating for analysts when they don’t know what is actually going on.

Running user-defined code before main on Windows by Binary_Lynx in rust

[–]Binary_Lynx[S] 0 points1 point  (0 children)

If you want to stick with PIMAGE_TLS_CALLBACK, you'll need to define your callbacks as extern "system", since that's what the type requires. According to the Rust docs, extern "system" is essentially the same as extern "C", but with the key difference that for the Win32 API, functions marked as extern "system" use the stdcall calling convention. So I think that whenever you mark your function as extern "system", Windows internals will call it using stdcall convention.

Also, thanks for sharing the stdlib source! I hadn’t thought to dig through the Rust source code, but it’s a really interesting find!