Ruby: Unmasking Unsafe Rust in Stripped Binaries via Machine Learning

Abstract

Rust, as an emerging system programming language, introduces $\text{unsafe}$ to allow developers to bypass safety checks during compilation. As a result, memory safety bugs are typically confined to the $\text{unsafe}$ regions, which have been the primary focus of Rust bug-finding tools. However, such tools rely on the presence of the $\text{unsafe}$ keyword in Rust source code; there are no tools available that can examine Rust binaries to pinpoint $\text{unsafe}$ areas. Therefore, we propose $\text{Ruby}$, the first tool that unmasks $\text{unsafe}$ regions in Rust binaries using machine learning. By capturing the subtle differences in the binary instructions, $\text{Ruby}$ can identify 91.75% of the total $\text{unsafe}$ regions with a false positive rate of 6.16%, beating SOTA LLM models including GPT-5.2, Claude-4.5 and Gemini-3. We further applied $\text{Ruby}$ to guide symbolic execution and fuzzing, showing a speed-up of 57.95% and 21.26%, with five bugs confirmed and patched by Google in Android library fuzzing.

Accepted to DSN 2026