1

According to RUST documentation, strings are stored this way :

enter image description here

This is a statement I can verify while reversing rust binaries. The thing is that when I am reversing rust binaries, I likely encounter cases where capacity is lower than length of the string, eg :

[stack]:00007FFC8BE97218 str_ABCED dq offset ABCED               ; DATA XREF: XX
[stack]:00007FFC8BE97218                                         ; (len=10) ABCEDFGHIJ
[stack]:00007FFC8BE97220 dq 28h                                  ; String len: 40
[stack]:00007FFC8BE97228 cap_ABCED dq 25h                        ; String 'capacity'

How is such a thing possible? Do any resource exists explaining rust internals?

  • If you check the acrual string pointer, how much space is reserved there? – usr2564301 Aug 4 at 11:27
  • @usr2564301 not sure to understand what you mean, the actual string is 40 bytes long, as stated by the "string len" (0x00007FFC8BE97220) in memory – Qwark Aug 4 at 15:29
  • Can you paste the code you used to create this string because I am not able to reproduce this? – sudhackar Aug 5 at 11:59
1

have you considered the possibility that it might be using the str
instead of String which only has length and no capacity and
you are looking at a bogus third value ?

:\>cat main.rs
fn main() {
        let s1 = String::from("Hello, std::world!");
    println!("{}",s1);
        println!("{} {}",s1.capacity() , s1.len());
        let s2 = "Hello, std::world!o";
    println!("{}",s2);
        println!("{} {}",s2.capacity() , s2.len());
}
:\>cargo build
   Compiling hello_world v0.1.0 
error[E0599]: no method named `capacity` found for reference `&str` in the current scope
 --> main.rs:7:22
  |
7 |     println!("{} {}",s2.capacity() , s2.len());
  |                         ^^^^^^^^ method not found in `&str`

like shown below for the first string

0:000> dv /v 
00000064`f0cff920              s2 = struct str*
00000064`f0cff8c0              s1 = "Hello, std::world!"
0:000> dpa 00000064`f0cff920 l3
00000064`f0cff920  00007ff6`65cf2638 "Hello, std::world!o"
00000064`f0cff928  00000000`00000013
00000064`f0cff930  00000000`00000010  <<<<<<<  bogus garbage 
0:000> dpa 00000064`f0cff8c0 l3
00000064`f0cff8c0  00000174`116191f0 "Hello, std::world!.............................."
00000064`f0cff8c8  00000000`00000012
00000064`f0cff8d0  00000000`00000012  <<<<<<<<<<<<< correct
| improve this answer | |
  • This is probably it, missed that details in the doc ! Thanks ! – Qwark Aug 10 at 8:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.