# Ruby: Unmasking Unsafe Rust in Stripped Binaries via Machine Learning

arXiv: https://arxiv.org/abs/2211.00111 · HTML: https://mlsanity.com/paper/2211.00111/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 11 of its 80 references that are in the map.
- First posted on arXiv 31 Oct 2022.

## Builds on (most cited first, 11 of 11)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [RoBERTa: A Robustly Optimized BERT Pretraining Approach](https://mlsanity.com/paper/1907.11692/) (2019)
- [Malware Detection by Eating a Whole EXE](https://mlsanity.com/paper/1710.09435/) (2017)
- [DeepBugs: A Learning Approach to Name-based Bug Detection](https://mlsanity.com/paper/1805.11683/) (2018)
- [PAC Confidence Sets for Deep Neural Networks via Calibrated Prediction](https://mlsanity.com/paper/2001.00106/) (2019)
- [PAC Prediction Sets Under Covariate Shift](https://mlsanity.com/paper/2106.09848/) (2021)
- [How could Neural Networks understand Programs?](https://mlsanity.com/paper/2105.04297/) (2021)
- [Is Rust Used Safely by Software Developers?](https://mlsanity.com/paper/2007.00752/) (2020)
- [RULF: Rust Library Fuzzing via API Dependency Graph Traversal](https://mlsanity.com/paper/2104.12064/) (2021)
- [oo7: Low-overhead Defense against Spectre Attacks via Program Analysis](https://mlsanity.com/paper/1807.05843/) (2018)
- [SafeDrop: Detecting Memory Deallocation Bugs of Rust Programs via Static Data-Flow Analysis](https://mlsanity.com/paper/2103.15420/) (2021)

## Abstract (arXiv)

Rust, as an emerging system programming language, introduces textttunsafe to allow developers to bypass safety checks during compilation. As a result, memory safety bugs are typically confined to the textttunsafe regions, which have been the primary focus of Rust bug-finding tools. However, such tools rely on the presence of the textttunsafe keyword in Rust source code; there are no tools available that can examine Rust binaries to pinpoint textttunsafe areas. Therefore, we propose textttRuby, the first tool that unmasks textttunsafe regions in Rust binaries using machine learning. By capturing the subtle differences in the binary instructions, textttRuby can identify 91.75% of the total textttunsafe regions with a false positive rate of 6.16%, beating SOTA LLM models including GPT-5.2, Claude-4.5 and Gemini-3. We further applied textttRuby to guide symbolic execution and fuzzing, showing a speed-up of 57.95% and 21.26%, with five bugs confirmed and patched by Google in Android library fuzzing.