rust-ida-analyzer

name	Rust IDA Analyzer
description	Use Rust IDA Analyzer and RIFT from IDAPython before analyzing Rust binaries
tags	["ida","rust","reverse-engineering","rift","oxidizer"]
triggers	["rust","rust-analyze","rust_analyze","oxidizer","rift"]
allowed_tools	["execute_python"]
author	Rust IDA Analyzer
version	1

Task: Analyze a Rust binary in IDA using the Rust IDA Analyzer plugin.

You must control Rust IDA Analyzer through IDAPython. Do not rely on mouse clicks, menu actions, or manual UI interaction. Use the execute_python tool for all plugin actions.

Rikugan's execute_python sandbox does not provide Python's __import__ builtin. Never write import ... in the code sent to execute_python. Use the IDA modules already exposed by Rikugan (idaapi, ida_kernwin, ida_funcs, etc.) and load extra modules with idaapi.require("module_name"). Do not assign the return value of idaapi.require(...); it returns None in IDA. After calling it, retrieve modules through idaapi.sys.modules.

Execution Discipline

• Use the reference snippets exactly. Do not invent diagnostic scripts, inspect plugin source files, call open(), use inspect, probe sys.path, or search the filesystem to understand the plugin.
• Do not write import ... under any circumstance, including apparently harmless modules such as os, sys, inspect, types, or idautils.
• Run each workflow snippet once and wait for its result. Do not submit the same execute_python command repeatedly unless the previous output explicitly asks you to retry.
• If panel._rift_running=True, only poll RIFT. Do not inspect imports, strings, functions, xrefs, or make behavior claims until RIFT has completed and its signatures have been applied.
• If panel._bridge_running=True, only poll the Oxidizer bridge. Do not apply Hex-Rays enrichment or analyze the function until the bridge is complete.
• During mandatory preparation, do not use non-execute_python tools and do not call save_memory.
• Source-path strings, imports, and library names are leads, not proof. Do not classify the binary as malicious or benign until the preparation workflow is complete and the relevant procedures have gone through the full per-function Rust decompile, enrichment, and full pseudocode reading workflow.
• If the bootstrap snippet reports plugin_ready=false, stop and report that exact output. Do not try to recreate the plugin behavior manually.

Mandatory Preparation Workflow

Before analyzing the binary as a whole:

0. Run the Rust IDA Analyzer bootstrap snippet from the IDA reference. If it reports plugin_ready=false, stop and report the exact error.
1. Run Rust IDA Analyzer Rust Scan.
   • Answer No to the Rust calling convention spoils prompt during this first scan.
2. Run Analyze RIFT.
   • Wait until the RIFT worker is complete.
   • Apply the RIFT signature results to the IDB completely.
3. Run Rust Scan again.
   • Answer Yes to apply Rust calling convention _spoils globally.
   • Verify the result summary has applied > 0 unless the IDB has no functions.

Do not proceed with global binary analysis until the preparation workflow is done or you can clearly report why it failed.

Before giving a final verdict about malware behavior, process the relevant entry points, exported routines, command dispatchers, network handlers, install or persistence routines, and suspicious API callers with the Mandatory Function Workflow. If there is not enough time or context to cover all of them, clearly state which functions were and were not processed.

Mandatory Function Workflow

Whenever you analyze a procedure/function:

1. Jump to the procedure start.
2. Run Rust IDA Analyzer Decompile.
3. Wait until the Oxidizer bridge worker is complete.
4. Run Apply Hex-Rays Enrichment.
5. Retrieve and read the full Rust+IDA pseudocode for the function.
6. Only then analyze that procedure and continue with cross-references, callers, callees, strings, or data-flow.

You must consider the complete pseudocode, even if it is very large. Do not summarize from only the first lines, only the visible viewport, or only the tail. If the pseudocode is too large for one response, read it in deterministic line chunks and continue until all chunks were inspected.

IDAPython Safety Rules

• Use short IDAPython commands. Do not sleep or busy-wait in a script that runs on the IDA UI thread.
• Do not use import statements in execute_python snippets. They fail with ImportError: __import__ not found in Rikugan's guarded scripting sandbox.
• For asynchronous Rust IDA Analyzer actions, start the action in one execute_python call, then poll state in later calls.
• Always check panel._rift_running and panel._bridge_running before applying results.
• Never execute the target binary.
• Do not apply patches unless explicitly requested by the user.
• After applying RIFT or Hex-Rays enrichment, re-read pseudocode. Do not analyze stale pre-enrichment text.

Required Helpers

Use the IDA-specific reference snippets loaded with this skill. They provide safe wrappers for:

• locating the active Rust IDA Analyzer panel;
• running Rust Scan with a deterministic Yes/No prompt answer;
• running and polling Analyze RIFT;
• applying RIFT signatures;
• running and polling Decompile;
• applying Hex-Rays enrichment;
• reading full Rust+IDA pseudocode in chunks.

If a helper reports that the Rust IDA Analyzer plugin is not loaded, stop and ask the user to install/load the plugin rather than trying to recreate its behavior.