iiinova — where your digital self keeps evolving

Decoder Loop @decoderloop.com · 10/09/2026

Yes!! I don't think I talk about the blog post explicitly during the presentation, but I wanted to link to it in the slides at least because it was a very useful reference for reverse engineering, and credit should be given 🙏

110

Decoder Loop @decoderloop.com · 08/09/2026

We'll be here the whole week, including the Workshop day (Tuesday) and the UnConference (Friday) - and of course, on the conference Discord as well! Looking forward to some great conversations about the Rust programming, security, and reverse engineering landscape.

010

Decoder Loop @decoderloop.com · 08/09/2026

We've arrived in Montréal for #RustConf! Come find us around the conference for one of these trait table layout reference cards, for all your Rust reversing needs. The best time is right after @cxiao.net's talk "Reverse Engineering Rust Malware in 2026", at 2pm EDT on Wednesday!

111

Decoder Loop @decoderloop.com · 27/08/2026

We'll be at @rustconf.com in 2 weeks! Come join @cxiao.net for her talk, "Reverse Engineering Rust Malware in 2026", on Wednesday September 9! Can't make it to Montreal? You can still get a virtual, pay-what-you-want ticket! Register here: bit.ly/4wwduG6 #rustconf #rustconf26 #rustlang

RustConf 2026
Hosted by the Rust Foundation

"Reverse Engineering Rust Malware in 2026"
Breakout Session - Sept. 09

Cindy Xiao
Security Researcher,
Decoder Loop

RustConf 2026 - Montreal + Online
rustconf.com

000

Decoder Loop @decoderloop.com · 24/08/2026

You can find Rust Metadata Carver on the Binary Ninja plugin manager (via Plugins > Manage Plugins). If you want to learn more about how panic metadata in Rust binaries works, our founder @cxiao.net's writeup from 2023 has the details: cxiao.net/posts/2023-1... Happy reversing!

000

Decoder Loop @decoderloop.com · 24/08/2026

🦀🥷 We've released a @binary.ninja plugin, Rust Metadata Carver, that extracts panic metadata from #Rust binaries: github.com/decoderloop/... Rust panic metadata reveals the libraries used, the version of Rust used, and code locations from the original Rust source, down to the line numbers!

110

Decoder Loop @decoderloop.com · 05/08/2026

We've just added these #RustLang #malware samples to the Rust Malware Sample Gallery: 1) JitterDropper 2) A Rust-based clipboard hijacker 3) #IronWorm, a Rust-based infostealer observed in several recent supply chain compromises 4) LabubaRAT github.com/decoderloop/... #infosec #reversing

github.com

GitHub - decoderloop/rust-malware-gallery: A collection of malware families and malware samples which use the Rust programming language.

A collection of malware families and malware samples which use the Rust programming language. - decoderloop/rust-malware-gallery

111

Decoder Loop @decoderloop.com · 14/07/2026

We're BACK this fall at Ringzer0 with another round of Deconstructing Rust Binaries! October 26-31, 16 hours of virtual training on reversing Rust binaries. Struggling with Rust malware? This is the course for you. Early bird prices before July 31st! ringzer0.training/countermeasu...

ringzer0.training

Deconstructing Rust Binaries

Deconstructing Rust Binaries is the first comprehensive training course focused solely on reverse engineering Rust binaries. This course is for any reverse engineer who needs a rapid, practical…

010

Reposted by Decoder Loop

RustConf @rustconf.com · 24/05/2026

Speaker Spotlight: Cindy Xiao, Security Researcher @ DecoderLoop Rust malware is rising & reverse engineers are scrambling. On Sept 9, Cindy surveys the '26 landscape: techniques, tooling gaps, & how to teach RE in a Rust world. Schedule: sched.co/2KHt7 Register: bit.ly/4eUTQ1g #rustconf

041

Decoder Loop @decoderloop.com · 10/04/2026

@cxiao.net will walk through the analysis of a Rust malware sample, look at the limitations of program analysis and decompilation tools, and discuss the challenges in teaching Rust reverse engineering to malware analysts. sched.co/2KHt7 #RustConf #RustConf26

110

Decoder Loop @decoderloop.com · 10/04/2026

📣 Our own @cxiao.net will be speaking at @rustconf.com this year, with the talk "Reverse Engineering Rust Malware in 2026"! sched.co/2KHt7 Rust is now a popular language not only for writing legitimate software, but also for writing malware. How are malware reversers dealing with this? #RustConf

142

Decoder Loop @decoderloop.com · 10/04/2026

Hello! Just a note that our training at @nsec.io this year, Deconstructing Rust Binaries from May 11-13, has been cancelled. @cxiao.net will still be attending NorthSec, so come say hi if you're there! Otherwise, we hope to see you soon at a future training event!

000

Decoder Loop @decoderloop.com · 31/03/2026

We just wrapped up Deconstructing Rust Binaries, our Rust reverse engineering course, at Ringzer0 last week! It was a real pleasure teaching an engaged class. Missed out? We're running Deconstructing Rust Binaries again at @nsec.io in Montreal, May 11-13, in a hybrid format: nsec.io/training/202...

A slide for the course Deconstructing Rust Binaries, specifically Part 1: Triage. It is presented by Cindy Xiao, of Decoder Loop, on March 23, 2026.

111

Decoder Loop @decoderloop.com · 17/03/2026

Want to learn how to reverse these? Last chance to sign up for our "Deconstructing Rust Binaries" training, at Ringzer0 next week! ringzer0.training/countermeasu... We're also offering the "Deconstructing Rust Binaries" training at @nsec.io, as a hybrid training in May! nsec.io/training/202...

ringzer0.training

Deconstructing Rust Binaries

Deconstructing Rust Binaries is the first comprehensive training course focused solely on reverse engineering Rust binaries. This course is for any reverse engineer who needs a rapid, practical…

011

Decoder Loop @decoderloop.com · 17/03/2026

... 4) RustyWater 5) An unnamed Rust-based loader, mimicking a GoToMeeting DLL 6) Marabu Ransomware 7) An unnamed Rust-based keylogger used by SloppyLemming 8) The VENON banker RAT All samples are freely available for download: github.com/decoderloop/...

github.com

GitHub - decoderloop/rust-malware-gallery: A collection of malware families and malware samples which use the Rust programming language.

A collection of malware families and malware samples which use the Rust programming language. - decoderloop/rust-malware-gallery

101

Decoder Loop @decoderloop.com · 17/03/2026

Looking for #RustLang samples to practice your reverse engineering skills on? Just since January, we've added samples from 8 different #malware families to the Rust Malware Sample Gallery: github.com/decoderloop/... 1) KCVY OSLOCK Ransomware 2) An unnamed Rust DDoS botnet 3) FunkSec Ransomware 🧵

github.com

GitHub - decoderloop/rust-malware-gallery: A collection of malware families and malware samples which use the Rust programming language.

A collection of malware families and malware samples which use the Rust programming language. - decoderloop/rust-malware-gallery

122

Decoder Loop @decoderloop.com · 07/03/2026

Last day before prices go up for Deconstructing Rust Binaries at Ringzer0, March 23-26! If you've been thinking about this fully remote, 16-hour Rust reverse engineering training: now is the time to book! ringzer0.training/countermeasu... #infosec #ReverseEngineering #rustlang #MalwareAnalysis

ringzer0.training

Deconstructing Rust Binaries

Deconstructing Rust Binaries is the first comprehensive training course focused solely on reverse engineering Rust binaries. This course is for any reverse engineer who needs a rapid, practical…

043

Decoder Loop @decoderloop.com · 25/02/2026

Just a few weeks left until our training, Deconstructing Rust Binaries, starting March 23 at Ringzer0! This course is for any reverse engineer who needs real techniques for reversing Rust binaries. ringzer0.training/countermeasu... #MalwareAnalysis #RustLang #ReverseEngineering #Reversing

ringzer0.training

Deconstructing Rust Binaries

Deconstructing Rust Binaries is the first comprehensive training course focused solely on reverse engineering Rust binaries. This course is for any reverse engineer who needs a rapid, practical…

101

Decoder Loop @decoderloop.com · 09/02/2026

Come check out our Deconstructing Rust Binaries training at NorthSec (or remote) this year! Three whole days of Rust reversing.

000

Decoder Loop @decoderloop.com · 19/12/2025

To keep up to date with all of our training dates and events, visit our website: decoderloop.com#upcoming-tra... We look forward to seeing you in 2026!

decoderloop.com

Decoder Loop | Reverse Engineering Training

000

Decoder Loop @decoderloop.com · 19/12/2025

We're also excited to offer flexibility in the training format and course depth. You have the choice of either: 1) A remote or onsite, 8 hour / day, comprehensive class at NorthSec: nsec.io/training/202... 2) A fully remote, 4 hour / day, shorter class at Ringzer0: ringzer0.training/countermeasu...

nsec.io

Deconstructing Rust Binaries

100

Decoder Loop @decoderloop.com · 19/12/2025

A few key things about Deconstructing Rust Binaries: 1) No previous experience with reversing Rust binaries, or writing Rust code, is required! 2) The course will use Binary Ninja as the primary reverse engineering tool. You will be provided a Binary Ninja student license as part of the course!

100

Decoder Loop @decoderloop.com · 19/12/2025

Deconstructing Rust Binaries is the first comprehensive course focused *solely* on reverse engineering Rust binaries. You will learn how to effectively triage Rust binaries, how to trace data flow through Rust binaries, and how to tackle common techniques found in the Rust malware ecosystem.

100

Decoder Loop @decoderloop.com · 19/12/2025

📣🦀 Announcing: TWO 2026 sessions for our Rust reverse engineering course, Deconstructing Rust Binaries! 1) Ringzer0 COUNTERMEASURE, March 23-26, Remote: ringzer0.training/countermeasu... 2) NorthSec (@nsec.io), May 11-13, Montréal & Remote: nsec.io/training/202... #malware #infosec #rustlang

ringzer0.training

Deconstructing Rust Binaries

Deconstructing Rust Binaries is the first comprehensive training course focused solely on reverse engineering Rust binaries. This course is for any reverse engineer who needs a rapid, practical upskil...

151

Reposted by Decoder Loop

Cindʎ Xiao 🍉 @cxiao.net · 18/12/2025

Excited to bring Deconstructing Rust Binaries to NorthSec in March! Chat with me here or at @decoderloop.com if you have questions about the training. Take advantage of the early bird rate for the onsite option! Pricing is in CAD, take advantage of the exchange rate (: nsec.io/training/202...

nsec.io

Deconstructing Rust Binaries

053

Decoder Loop @decoderloop.com · 15/12/2025

...RustyAttr, Akira Ransomware (both Akira_v2 and Megazord), Banshee (Rust variant), RALord Ransomware, RustoBot, Tetra Loader, EDDIESTEALER, Myth Stealer, Rustonotto, RustyPages, ChaosBot This is ~1 new Rust malware family per month. Rust as a programming language for malware is here to stay!

110

Decoder Loop @decoderloop.com · 15/12/2025

The last time the Sample Gallery was updated was in January 2024 (~2 years ago). Since then, there's been an explosive growth in new Rust malware, including: SPICA, KrustyLoader, RustDoor, SSLoad, Fickle Stealer, Cicada3301 Ransomware, RustyClaw, Embargo Ransomware, (cont'd - there's too many!)

100

Decoder Loop @decoderloop.com · 15/12/2025

The Sample Gallery collects links to articles about malware written in Rust, organizes them by family, and includes a download link to a publicly available sample for every malware family. This is for any malware analyst who wants to get hands-on with real Rust malware. github.com/decoderloop/...

github.com

GitHub - decoderloop/rust-malware-gallery: A collection of malware families and malware samples which use the Rust programming language.

A collection of malware families and malware samples which use the Rust programming language. - decoderloop/rust-malware-gallery

100

Decoder Loop @decoderloop.com · 07/11/2025

In addition to the slides, the materials include an annotated @binary.ninja database file! Check out the Tags in the database for key locations in the binary, and the History in the database for a step-by-step walkthrough of how we marked up the binary. github.com/decoderloop/...

A screenshot of the Tags window in the software Binary Ninja, showing a list of bookmarked locations in a Rust binary.

A screenshot of the History window in the software Binary Ninja, showing a step by step list of variable definition, variable rename, and comment annotations made in a binary.

An annotation of a decompiled version of the Rust standard library std::sys::pal::windows::thread::Thread::new::thread_start function, showing an indirect call, via a virtual function table (vtable), to the function call_once.

000

Decoder Loop @decoderloop.com · 03/11/2025

The workshop will be conducted with @binaryninja.bsky.social, so this is also a great chance to get familiar with Binary Ninja! See you there! For more information about upcoming workshops and trainings, keep an eye on this account or sign up on our mailing list: decoderloop.com/contact/#tra...

decoderloop.com

Contact

Contact information for Decoder Loop

000

Decoder Loop @decoderloop.com · 03/11/2025

By the end of this workshop, you should know where to get more information about Rust structures and types, know a few tricks for finding interesting landmarks in Rust binaries, and be much more confident in approaching Rust binaries! #rustlang #MalwareAnalysis #ReverseEngineering #infosec

100

Decoder Loop @decoderloop.com · 03/11/2025

Thank you for your interest in Decoder Loop & #rustlang reverse engineering training so far! This Friday, November 7th, join us at Ringzer0 COUNTERMEASURE, in Ottawa, Canada, where @cxiao.net will present the workshop "Reversing a (not-so-) Simple Rust Loader": ringzer0.training/countermeasu...

ringzer0.training

WORKSHOP: Reversing a (not-so-) Simple Rust Loader // Cindy Xiao

Rust can be challenging for even experienced reverse engineers. We will reverse a simple Rust malware loader found in the wild with obfuscated strings and a decoy payload, making it a good example for...

123

Reposted by Decoder Loop

Cindʎ Xiao 🍉 @cxiao.net · 17/10/2025

🦀 I am starting a training firm, @decoderloop.com, focused on providing Rust Reverse Engineering training! decoderloop.com We hope to come to a conference near you next year. Stay notified on training dates: Follow us at @decoderloop.com, or join our mailing list: decoderloop.com/contact/#tra...

decoderloop.com

Decoder Loop | Reverse Engineering Training

175

Reposted by Decoder Loop

Jesko Hüttenhain @rattle.im · 17/10/2025

The amazing @cxiao.net is offering training at decoderloop.com for #Rust #Malware #ReverseEngineering 😱 Her insight is absolutely priceless, she's taught me all I know about this. If you are organizing an event: This is the state-of-the-art training you are looking for.

decoderloop.com

Decoder Loop | Reverse Engineering Training

163