Ruby: Unmasking Unsafe Rust in Stripped Binaries via Machine Learning

Rust, as an emerging system programming language, introduces textttunsafe to allow developers to bypass safety checks during compilation. As a result, memory safety bugs are typically confined to the textttunsafe regions, which have been the primary focus of Rust bug-finding tools. However, such tools rely on the presence of the textttunsafe keyword in Rust source code; there are no tools available that can examine Rust binaries to pinpoint textttunsafe areas. Therefore, we propose textttRuby, the first tool that unmasks textttunsafe regions in Rust binaries using machine learning. By capturing the subtle differences in the binary instructions, textttRuby can identify 91.75% of the total textttunsafe regions with a false positive rate of 6.16%, beating SOTA LLM models including GPT-5.2, Claude-4.5 and Gemini-3. We further applied textttRuby to guide symbolic execution and fuzzing, showing a speed-up of 57.95% and 21.26%, with five bugs confirmed and patched by Google in Android library fuzzing.