Decoder Loop

Rust Reverse Engineering Training.

Modern programming languages require modern reverse engineers.

2026-01-20

๐Ÿ“† Are you looking to spend your training budget for 2026?
๐Ÿฆ€ Are you struggling with reversing Rust binaries, and not even sure where to get started?
๐Ÿ‡จ๐Ÿ‡ฆ Are you looking for high-quality technical training located in Canada?

Consider our 3-day training, "Deconstructing Rust Binaries", at @NorthSec from May 11-13 in Montrรฉal: nsec.io/training/2026-deconstr

This is the first comprehensive training course focused solely on reverse engineering Rust binaries. You will learn how to effectively triage Rust binaries, how to trace data flow through Rust binaries, and how to tackle common techniques found in the Rust malware ecosystem. Real Rust malware samples are used in the course, ensuring that you have the practical skills to tackle your next Rust sample.

Early bird pricing is available now until Feb. 28th! registrations.nsec.io/northsec

#rust #rustlang #ReverseEngineering #reversing #infosec #MalwareAnalysis #malware #InfosecTraining

2026-01-08

A new Rust DDoS Botnet family has been added to the Rust Malware Sample Gallery: github.com/decoderloop/rust-ma

This malware family is currently unnamed, but was analyzed in this 2025-11-30 article by Beelzebub: beelzebub.ai/blog/rust-ddos-bo

(h/t to @cydave ; I learned about the Beelzebub article from his link to it, in his article about setting up a honeypot: 0dave.ch/posts/flying-whales-i)

#rust #rustlang #malware #infosec #ReverseEngineering #MalwareAnalysis #reversing #botnet

2025-12-19

๐Ÿ“ฃ๐Ÿฆ€ We're very excited to announce TWO sessions for our flagship Rust reverse engineering course, Deconstructing Rust Binaries, coming to you in early 2026!

1) Deconstructing Rust Binaries at @ringzer0 COUNTERMEASURE, March 23-26 2026, 16 hours, Remote: ringzer0.training/countermeasu

2) Deconstructing Rust Binaries at @NorthSec, May 11-13 2026, 24 hours, Onsite in Montrรฉal, Canada and Remote: nsec.io/training/2026-deconstr

Deconstructing Rust Binaries is the first comprehensive training course focused _solely_ on reverse engineering Rust binaries. This course is for any reverse engineer who needs a rapid, practical upskill in your ability to analyze Rust binaries. You will learn how to effectively triage Rust binaries, how to trace data flow through Rust binaries, and how to tackle common techniques found in the Rust malware ecosystem.

This course is taught and written by an experienced malware reverse engineer, @cxiao, with extensive experience specifically in reversing Rust binaries. Want a preview of the technical expertise we offer? Check out the 120+ FREE slides on Rust reversing from our recent workshop, "Reversing a (Not-so-Simple) Rust Loader"! github.com/decoderloop/2025-11

A few key things about the course:

1) No previous experience with reversing Rust binaries, or writing Rust code, is required!
2) The course will use Binary Ninja as the primary reverse engineering tool. You will be provided a Binary Ninja student license as part of the course.
3) We're excited to offer flexibility in the training format and course depth. You have the choice of either taking:

a) A fully remote, 4 hour per day, shorter class at Ringzer0 (ringzer0.training/countermeasu)
b) A remote or onsite, 8 hour per day, comprehensive class at NorthSec (nsec.io/training/2026-deconstr)

We look forward to seeing you in 2026!

#infosec #InfosecTraining #malware #MalwareAnalysis #ReverseEngineering #reversing #rust #rustlang #binaryninja #NorthSec #ringzer0 #Ringzer0Training

Decoder Loop boosted:
2025-12-18

๐Ÿ‹๐Ÿป ๐—ก๐—ผ๐—ฟ๐˜๐—ต๐—ฆ๐—ฒ๐—ฐ ๐Ÿฎ๐Ÿฌ๐Ÿฎ๐Ÿฒ: ๐Ÿญ๐Ÿฌ ๐˜€๐—ฒ๐˜€๐˜€๐—ถ๐—ผ๐—ป๐˜€ ๐—ฑ๐—ฒ ๐—ณ๐—ผ๐—ฟ๐—บ๐—ฎ๐˜๐—ถ๐—ผ๐—ป ๐—ฎ๐˜ƒ๐—ฎ๐—ป๐—ฐรฉ๐—ฒ ๐—ฑ๐—ผ๐—ป๐˜ ๐˜ƒ๐—ผ๐˜๐—ฟ๐—ฒ รฉ๐—พ๐˜‚๐—ถ๐—ฝ๐—ฒ ๐—ฑ๐—ฒ ๐˜€รฉ๐—ฐ๐˜‚๐—ฟ๐—ถ๐˜รฉ ๐—ฎ ๐—ฏ๐—ฒ๐˜€๐—ผ๐—ถ๐—ป โ€ข ๐Ÿญ๐Ÿฌ ๐—”๐—ฑ๐˜ƒ๐—ฎ๐—ป๐—ฐ๐—ฒ๐—ฑ ๐—ง๐—ฟ๐—ฎ๐—ถ๐—ป๐—ถ๐—ป๐—ด ๐—ฆ๐—ฒ๐˜€๐˜€๐—ถ๐—ผ๐—ป๐˜€ ๐—ฌ๐—ผ๐˜‚๐—ฟ ๐—ฆ๐—ฒ๐—ฐ๐˜‚๐—ฟ๐—ถ๐˜๐˜† ๐—ง๐—ฒ๐—ฎ๐—บ ๐—ก๐—ฒ๐—ฒ๐—ฑ๐˜€

Montez en compรฉtence votre รฉquipe de cybersรฉcuritรฉ avec des formations pratiques offertes par des experts de l'industrie! NorthSec 2026 compte 10 cours intensifs couvrant les compรฉtences les plus recherchรฉes!

Level up your cybersecurity team with hands-on training from industry-leading experts! NorthSec 2026 brings together 10 intensive courses covering the most in-demand skills!

โžก๏ธ Red Team Training
Charles F. Hamilton (Mr.Un1k0d3r)

โžก๏ธ Beyond Whiteboard Hacking: Master AI-Enhanced Threat Modeling
Steven Wierckx

โžก๏ธ Offensive Active Directory Operations Certification (OADOC)
Evan Hosinski (White Knight Labs)

โžก๏ธ Deconstructing Rust Binaries
@cxiao

โžก๏ธ Reverse, Bypass, Exploit: Mobile Hacking Workshop
David Baker & Steven Smiley (Corellium)

โžก๏ธ Offensive Development Practitioner Certification (ODPC)
Munaf Shariff (White Knight Labs)

โžก๏ธ Attacking & Securing CI/CD Pipeline Certification (ASCPC)
Raunak Parmar & Robert (Bobby) Schwass (White Knight Labs)

โžก๏ธ Advanced Detection Engineering in the Enterprise
FalconForce

โžก๏ธ Offensive GCP Operations & Tactics Certification (OGOTC)
Chirag Savla (White Knight Labs)

โžก๏ธ Practical AI Security - Go Beyond Theory: Build, Break, and Defend
Harish Ramadoss

๐Ÿ“… 11-13 mai/May 2026
๐Ÿ“ Montrรฉal, QC

๐Ÿ‘‰ Description complรจte des cours, rรฉductions pour รฉtudiant(e)s et informations sur l'inscription disponibles ร :
๐˜๐˜ถ๐˜ญ๐˜ญ ๐˜ค๐˜ฐ๐˜ถ๐˜ณ๐˜ด๐˜ฆ ๐˜ฅ๐˜ฆ๐˜ด๐˜ค๐˜ณ๐˜ช๐˜ฑ๐˜ต๐˜ช๐˜ฐ๐˜ฏ, ๐˜ด๐˜ต๐˜ถ๐˜ฅ๐˜ฆ๐˜ฏ๐˜ต ๐˜ฅ๐˜ช๐˜ด๐˜ค๐˜ฐ๐˜ถ๐˜ฏ๐˜ต๐˜ด, ๐˜ข๐˜ฏ๐˜ฅ ๐˜ณ๐˜ฆ๐˜จ๐˜ช๐˜ด๐˜ต๐˜ณ๐˜ข๐˜ต๐˜ช๐˜ฐ๐˜ฏ ๐˜ช๐˜ฏ๐˜ง๐˜ฐ ๐˜ข๐˜ต:

๐Ÿ”— nsec.io/training-sessions/

#trainings #cybersecurity #infosec #redteam #bluelteam #cloudsecurity

Flyer for NorthSec 2026 training sessions
2025-12-15

๐Ÿฆ€ Looking for Rust malware samples to practice analyzing? Our Rust Malware Sample Gallery just received a major update, with 20 new families added! github.com/decoderloop/rust-ma

The Sample Gallery collects links to articles about malware written in Rust, organizes them by malware family, and includes a download link to a publicly available sample for every malware family. This is a resource for any malware analyst who wants to get hands-on with real Rust malware.

The last time the Sample Gallery was updated was almost 2 years ago, in January 2024. Since then, there's been an explosive growth in new Rust malware, including all of the following families that are now in the Sample Gallery:

SPICA, KrustyLoader, RustDoor, SSLoad, Fickle Stealer, Cicada3301 Ransomware, RustyClaw, Embargo Ransomware, RustyAttr, Akira Ransomware (both the Akira_v2 and Megazord variants), Banshee (Rust variant), RALord Ransomware, RustoBot, Tetra Loader, EDDIESTEALER, Myth Stealer, Rustonotto, RustyPages, ChaosBot

This is nearly one new Rust malware family observed in the wild, every month. Rust as a programming language for malware is here to stay!

#rust #rustlang #malware #infosec #ReverseEngineering #MalwareAnalysis #reversing

2025-11-07

The slides and materials from @cxiao's "Reversing a (not-so-) Simple Rust Loader" workshop at Ringzer0 COUNTERMEASURE (@ringzer0) today are now available! github.com/decoderloop/2025-11

In addition to the slides, the materials include an annotated @binaryninja database file! Check out the Tags in the database for key locations in the binary, and the History in the database for a step-by-step walkthrough of how we marked up the binary.

#rustlang #ReverseEngineering #MalwareAnalysis #infosec #reversing #malware #binaryninja #COUNTERMEASURE25 #ringzer0

A screenshot of the Tags window in the software Binary Ninja, showing a list of bookmarked locations in a Rust binary.A screenshot of the History window in the software Binary Ninja, showing a step by step list of variable definition, variable rename, and comment annotations made in a binary.An annotation of a decompiled version of the Rust standard library std::sys::pal::windows::thread::Thread::new::thread_start function, showing an indirect call, via a virtual function table (vtable), to the function call_once.
2025-11-03

Thank you all for your interest in Decoder Loop and Rust reverse engineering training so far!

Our first event is coming up this Friday, November 7th, where @cxiao will be presenting the workshop "Reversing a (not-so-) Simple Rust Loader" at the Ringzer0 COUNTERMEASURE conference (@ringzer0), in Ottawa, Canada: ringzer0.training/countermeasu

By the end of this workshop, you should know where to get more information about Rust structures and types, know a few tricks for finding interesting landmarks in Rust binaries, and be much more confident in approaching Rust binaries! The workshop will be conducted with @binaryninja , so this is also a great chance to get familiar with Binary Ninja.

We hope to see you there! For more information about upcoming workshops and trainings, keep an eye on this account or sign up on our mailing list: decoderloop.com/contact/#train

#rustlang #ReverseEngineering #MalwareAnalysis #infosec #reversing #malware #binaryninja #COUNTERMEASURE25 #ringzer0

Client Info

Server: https://mastodon.social
Version: 2025.07
Repository: https://github.com/cyevgeniy/lmst