►
From YouTube: Building Safe and Secure Systems in Rust. Mingshen Sun
Description
Mingshen Sun is a senior security researcher of Baidu X-Lab at Baidu USA. He received his Ph.D. degree in Computer Science and Engineering from The Chinese University of Hong Kong. His interests lie in solving real-world security problems related to system, mobile, IoT devices and cars. He maintains and actively contributes to several open source projects in Rust such as the MesaLock Linux project, MesaPy, and YogCrypt.
Rust is designed to be a system programming language which is fast and guarantees memory safety. However, building safe and secure systems is not simply using Rust to rewrite existing code. Still, there are many challenges such as the Rust language, unsafe Rust, foreign function interface (FFI), and designing systems with a hybrid memory model. In this talk, we will discuss some challenges in the view of security. We will demonstrate the challenges and lesson learned by using some real-world case studies. Finally, we will raise some open questions, initial ideas, and possible solutions.
B
The
security
researcher
in
by
2x
live
in
California,
USA
and
basically
I'm
doing
some
research
on
system
security,
mobile
security,
IOT
security
and
a
car
hacking
I'm,
enhanced,
open
source
project
like
master,
lock,
Linux
mess
apart
entered
and
passed
for
iOS
so
and-
and
you
can
check
out
that
repository
in
the
my
kid
hub
and
my
website
and
the
brief
introduction
about
by
2x,
live
and
the
bad
bad
wax
lab.
Is
research
lab
in
California
and
we
do.
B
We
have
a
lot
of
people
like
200
of
our
people,
but
we
are
for
the
research
lab.
Is
there
about
20
people,
most
of
them
from
the
academia
gap
background?
So
we
do
some
system
research
in
like
fuzzing
testing
and
the
autonomous
driving
security
of
autonomous
driving
car
and
the
memory
safe
programming,
language
and
program.
Analysis
like
dynamic
analysis
and
static
analysis.
B
Ok,
and
we
have
a
lot
open
source
project.
I
will
talk
about
that
later.
So
the
outline
of
today
is,
we
know
that
Rus
providers
safe
and
secure
building
programming
language
and
when
we
used
R
Us
to
build
this
system.
There
are
some
challenges
and
lessons
learned
and
some
open
questions.
You
are
raised.
This
challenge
license
and
open
questions.
B
You
know
security,
researchers,
perspective
and
all
from
the
one
paper,
it
is
called
eternal
war
in
memory
as
in
published
in
2013,
and
the
the
figure
may
be
too
small,
but
I
will
point
out
is
all
of
the
memory
issues
is
beginning
from
the
first
one
is
making
our
pointer
go.
Autobahn
and
second,
the
makeup
only
become
dangling.
So
what
a
rush
I
want
to
solve.
Is
this
whole
issues,
which
is
memory
safety
for
the
years?
B
B
So
right
now,
in
the
current
this
decades
we
have
go
and
rest
others
safe
programming,
languages
and
the
save
the
basically
means
memory
safety
and
for
in
this
talk,
I
mean
a
safe
building,
a
safe
and
a
secure
system
in
rust,
a
safe
means,
memory,
safe
access
and
the
safe
concurrency
for
security.
I
mean
our
lives,
one
abilities
and
a
reduced
attack
surface.
So
we
want
to
build
a
system
with
safe
memory,
safety
and
reduce
attack
services.
So
how
what
what
what
we
have
done?
B
We
have
operating
system
like
tacos,
Redux
or
a
street
near
us
and
the
rest
compiler
written
in
rust,
and
the
last
like
networking
services,
d-nice
deal
and
TRS
library
and
some
web
server
and
database
and
the
browser
like
servo
and
the
CSS
engine
and
the
for
bi
do
bi
do
did
a
lot
working
last.
We
have
like
one
two,
three,
four
five
projects:
written
rust.
Why
is
the
master
lock
Linux
as
a
memory
safe,
Linux
distribution?
We
actually
write
out
the
user
space
to
box
like
a
busy
provided
as
a
basic
box
in
rust.
B
It's
called
master
box
is
a
collection
of
system,
utility,
rittany,
rust
and
master
link
is
a
memory
civ
and
the
OpenSSL
compatible
a
TRS
library
and
the
evening.
I
already
have
a
talk
in
rust,
faster
this
year
two
web
months
ago,
and
the
master
pile
security
and
fast
pison
based
on
pipe
high
and
the
way
rip.
We
replace
some
say
encode
to
rust
and
glue
rust
and
the
pipe
hi.
The
last
one
is
rustic.
B
Stx
SDK,
as
GX
is
Intel
feature
to
provide
a
secure
execution
environment
trusted
a
high
security
environment,
and
we
modify
our
last
standard
library
and
put
it
into
the
Intel
SGX,
so
that
I
can
write.
I
see
actually
include
in
rust,
and
there
are
many
more
project
will
be
open
source
next
year.
Okay,
let
me
talk
the
challenges,
lesson,
learn
and
open
questions.
Okay,
when
way
to
this
project,
we
faced
many
challenges.
B
You
know
Russ
language
involved
pretty
fast
and
we
need
to
keep
track
of
the
RFC.
The
nightly
rest,
the
whole
ecosystem
right,
there's
a
lot
of
create
new
created
on
the
Chris
IO
and
sometimes
of
worry,
stable
and
very
popular,
create,
there's,
suddenly,
no
one
maintain
it
and
the
the
author
is
is
I,
don't
know
some
crazy
author
is
lost
and
also
the
answer
frost
for
the
high-level
development.
We
don't
care,
we
don't
use
as
if
right.
B
But
if
you
do
some
system
programming
eventually,
you
will
use
as
say
for
us
to
do
to
get
better
performance
to
talk
about
the
tech
drivers
that,
like
the
memory
directly,
so
you
need
to
use,
I,
see,
frost
and
the
third.
Why
is
the
foreign
function?
Interface?
Ffi
right?
If
you
want
to
build
a
very
big
system,
you
have
to
use
many
programming
language,
not
just
rust
itself.
You
have
to
see
simple
parts
of
hyacinth
and
rust,
so
the
interface
between
the
difference
between
different
languages,
the
a
big
problem.
B
You
need
to
keep
the
memory
safety
between
the
scope
of
the
different
languages
and
the
last
one
is
what
I
mean
the
challenges
in
hybrid
memory
model.
That
means
different
language
have
different
memory
model.
Like
say,
you
need
to
manually
chop
some
memory,
but
in
rust,
there's
there's
no
cabbage
tractor
and
in
Java
in
tiesm,
there's
a
global
lock
to
cabbage
correction.
B
So
there
are
many
challenges
in
the
hybrid
memory
model,
but
in
this
talk
and
many
folk
song
and
see
frost
so
I
said
what
is
unsafe,
rust
and
when
you
read
the
document,
there's
one
chapter
in
the
other
one
of
the
ones
the
features,
and
it
is
as
if
rust,
what
is
unsafe
roster.
Now
we
know
that
all
the
code
we
discussed
about
the
memory
safety
concurrence
saved
concurrently
is
guaranteed
by
safe,
rust
and,
however,
rust
has
a
second
language
hiding
inside
it.
B
It
is
called
as
we
fast
it
doesn't
enforce
this
memory
safety
guarantees,
and
if
this
works
just
like
regular
rust,
but
gives
you
extra
powers,
there
are
four
extra
powers.
We
will
look
at
it
first.
Why
is
the
reference
or
raw
point
her?
So
that's
where
dangerous?
Second,
one
access,
modifier
multiple
static
variables,
so
you
know
there's
some
concurrency
issues.
If
you
do
the
second
one.
Third
Cohen
NC
functional,
measured
force,
employment
and
safe
treat.
So
let's
see
the
first
one
differ
at
first,
the
reference,
the
raw
pointer.
So
this
is
an
simple
example.
B
You
can
do
reference
one
two,
three,
four
in
the
memory
and
get
the
value
of
the
memory.
So
in
this
case
you
can
read
and
write
arbitrary
memory
address
right.
So
that's
the
big
security
issues
for
icy
Frost.
The
second
way
is
access
to
modify
multiple
static
variable.
So
for
this
case
you
can
use
like
the
unsafe
to
print
the
counter
and
to
increase
the
counter.
The
country
is
actually
a
static
global
variable,
so
this
will
cause
it
erases.
The
third
way
is,
you
can
call
the
ANSI
function
or
method.
B
For
this
case
you
have
what
internals
as
a
function
and
in
the
main
function,
you
can
call
the
dangerous
function
as
a
function,
so
this
is
answer
if
calling
an
unsafe
function
may
cause
and
defined
behavior.
If
the,
if
and
say,
function
is
not
properly
implemented
right,
the
third
one
is
is
to
call
I,
say:
functional
method
like
external
function,
so
we'll
use
some
FFI
to
call
C
code
to
use
C
API
to
call
sick,
zip
access
code
called
pison.
B
Sometimes
you
need
to
use
unsafe,
so
calling
external
function
may
cause
and
defense
behavior
right,
because
you
are
in
rust,
you'll
call
some
sicko.
The
C
code
can
do
anything
they
want.
They
can
manipulate
the
memory
they
want,
so
it
will
cause
some
identify
behaviors.
So
so
what
I
want
mention
is
that
some
developers
may
say
it's.
Okay,
at
least
you
explicitly
type
the
as
if
keyword
in
the
source
code
right
and
you
can
search
and
see
if
in
the
source
code,
to
see
whether
it
is
safe
or
not.
B
B
So
it's
difficult
to
review.
Also,
a
zip
code,
so
that's
what
had
been
asked
if
it's
organ
or
stick
for
developers.
So
this
is
an
example.
If
we
have
a
library
have
a
dangerous
function,
which
is
to
dereference
a
memory
pointer
and
actually
we
provide
this
as
if
dangerous
function
as
a
safe
function.
We
provide
this
API
to
developers,
so
developer
uses
safe
function
to
call
some.
They
think
it
is
safe,
but
actually
is
not
safe
it.
It
may
have
some
undefined
behavior
here.
B
So
that's
what
I
mean
and
as
if
it's
an
agnostic,
so
some
libraries
include
stana
libraries,
I,
rap
and
safe,
cold
and
sweet
spot
is
a
functions.
So
it's
difficult
to.
If
you'll
find
a
bug
in
your
code,
it's
difficult
to
debug
it
right
because
the
as
if
the
anti
fight
behavior
is
origin
from
some
deep,
very
deep
or
create
insider
dependency.
So
one
case
study
is
I'll,
show
I'm
sure
is
a
modern
shell
and
the
written
in
last-
and
this
is
inter
that
is
the
introduction
of
iron
shell
in
their
in
their
documentation.
B
It
is
writing
entirely
in
rust,
which
is
greatly
increased
overall
in
quality
and
security
of
the
show.
Yes,
it
is
true,
it
is
written
entirely
in
rust,
but
actually,
when
you
are
analyzed,
dependency
is
not
true,
so
you
can
use
caco3
and
to
print
out
all
the
dependency.
This
is
root.
Node
is
the
iron
shot
and
a
diamond
some
deep
sea,
so
every
rise
to
create.
If
you
want
to
run
on
Linux,
it
is.
B
If
you
want
to
use
standard
library,
it
depends
on
deep
sleep
eventually
and
also
there
is
a
creek
called
decimal,
and
this
decimal
is
also
a
sea
library
and
is
where
rapid
eyes
rest
api
to
iron
shop,
and
you
may
look
at
there.
Some
batteries,
sis
and
leap
loading,
so
leap,
loading,
hello,
some
external
library,
dynamically
in
the
memory
space
and
the
call
to
count
the
unassembled
Cal
symbol
and
called
a
CC
function.
B
So
this
creates
our
dangerous,
is
not
written
in
rust
and
it
will
introduce
some
may
introduce
some
and
and
if
I
behavior,
so
how
to
find
out
this
create.
You
can
use
color
creed
to
print
dependent
ministry
tree
and
the
review
of
them,
and
you
can
also
print
out
verbose.
They
print
out
the
compelling
compilation
process
and
you
can
see
here,
it'll
link,
it
first
compiled
the
decimal
64
dossier
and
the
link
8
later,
although
the
I
did
find
some
bugs
in
decimal
64
Dorsey.
B
Corruption
issue
in
rust,
SQL
library,
which
why
we
tried
CVE
2017
to
set
69
and
one
is
a
type
confusion
bug
in
SQLite,
and
we
can
easily
figure
this
bug
in
our
SQL
because
it
depends
on
this
library
right,
and
so
you
can
simply
write
this
kind
of
code
in
rust
and
the
right
it
will
have
a
segmentation
fault.
So
it's
already
patched
because
the
mainstream
secured
light
already
fix
this
bug
and
but
the
last
rescue
point
out
pointing
to
a
world
version
of
secure
lat
and
they
upgrade
the
secure
line
right
now.
B
Okay,
we
do
some
static
statistic.
Analysis
reflect
all
the
create
libraries
increase
at
all
this
year
in
the
beginning
of
this
series
about
ten
ten
thousand
thousand
raster
libraries
and
total
200
million
public
downloads,
and
we
do
two
studies
first
way
is
you
read,
use
usage
of
external
C&S,
a
practice
library.
We
want
to
see
how
many
cnc
prepare
every
is
used
in
discrete
and
the
second
one
is.
B
We
want
to
find
out
the
usage
of
the
rest
keywords:
okay,
let's
see
the
first
one,
we
we
try
our
best
to
compile
all
the
crease
and
dump
the
compilation
logs
and
to
see
whether
it
links
like
some
external
libraries.
This
is
a
result,
the
most
popular
mode,
the
two
popular
external
library,
is
sleep
crypto
and
the
device
itself.
So
because
we
don't
have
a
rest,
we
have
a
rusty
ice
library
called
Russell's,
but
I.
B
Don't
know
why
a
lot
of
rustic
read
only
use
open
SSL
for
that
gesture
is
connection
and
for
others,
the
batteries
rink
or
enhanced,
open
stream
and
the
mini
see
see.
Helper
D
is
a
dynamic
library
and
helpers
curl,
and
they,
when
you
look
at
this
leverage,
a
lot
of
the
crypto
libraries
and
some
of
them,
zip
libraries,
minis,
aces,
zip
libraries
of
them
see
and.
B
Some
of
the
libraries
like
open
SSL.
There
are
some
haste
that
history
in
years
ago,
heartbleed
bugs
in
open
SSL.
So
when
you
use
rust
crate
you
need
to.
If
you
care
about
security,
you
have
to
look
at
the
external
libraries
okay.
So
how
many
a
zip
code
is
just
three
thousand
out
of
ten
rust
libraries,
condense
and
safe
code,
and
there
are
14
fouls
in
total
contents
and
safe
code
and
there's
600
thousand
lines
of
code
and
contains
a
zip
code
and
know
what
happens.
B
We
have
learned,
we,
we
use
some
create
and
we've
found
some
bugs
in
some
some
some
of
our
external
libraries.
This
park
is
called
accosted
by
the
unsafe
code
and
I
see
the
first
one.
The
first
one
is
not
one
fun
than
us,
but
it's
a
zip
code
in
an
XML
library.
This
library
is
called
as
XD
document
and
you
can
see
from
the
title.
It
is
used
after
three
when
passing
the
XML
document,
so
this
back
is
from
the
PI
or
faster.
B
It
will
randomly
generate
some
XML
code
and
feed
through
the
XML
parser
written
in
rust
and
suddenly
the
car
you
said
free.
So
when
you
look
at
this
issue,
it's
a
old
Israel
all
the
issue
about
two
years
ago,
and
it
is
SL
water
and
safe
code
and
the
second
one
is
the
popular
series
in
western
libraries.
So
there
are
two:
there
are
actually
three
a
CBE
in
rust
itself.
Two
of
them
is
standard
library.
B
The
first
one
is
a
buffer
overflow
herbal
tea
in
Senna
library,
back
DQ
and
for
this
function,
and
you
look
at
the
poor
request
issue
and
the
fix
you
may
find
out.
The
the
cost
of
this
issue
is
a
line
of
and
safe
code,
but
the
fix
is
not
inside
the
unsafe
code.
So
what
we
learn
is
that
and
not
the
the
as,
if
is
not
customized
as
you
code
itself,
it
will
propagate
to
other
safe
code
because
there's
something
data
dependency
between
the
safe
code
and
unsafe
code.
B
So
eventually,
if
you
don't,
if
you
don't
carefully
implement
some
unsafe
code,
the
ice
safety
will
propagate
with
some
safe,
zip
code.
So
the
second
back
is
the
standard
library
string
repeat
contents
and
so-called
relight
song
Pro
pre-allocated
vector
having
the
capacity
calculated
earlier.
So
this
issue
is
pretty
complicated
and
I
would
say
it's
not
easy
to
stand
out,
fix
and
defend
out
the
reason
of
this
back.
But
when
you
look
at
this
bag
we
eventually
found
out.
It
is
a
cost.
Buyer,
a
zip
code.
B
So
this
the
lessons
we
learn
in
civvy
in
Rastan
the
library
another
one
is
answering
at
Arctic's
octaves
is
a
web
framework
and
it's
very
popular.
But
when
you
look
at
it
we'll
check
the
issue
we
will
find.
This
issue
is
very
interesting.
It's
a
hands-on
user
of,
as
if
in
AP
is
so
I
highlight
this
issue
here
right
now,
the
artist
swipe
call
contains
hundreds
plus
uses
of
unsafe.
B
Presumably
this
is
order
of
achieved
to
best
possible
performance
in
Hall
Pass
in
the
code,
but
can
be
reduced
and
safe,
but
remain
the
performance
gains
and
seen
hey
come
up
and
look
at
the
a
zip
code
and
said
I
suspect
most
of
this
code
can
be
made
safe.
There's
no
performance
guarantee
just
we
risk
constructing
same
things,
so
scene
reveal
all
the
acid
lies
and
the
reconstructed
code
and
remove
most
of
the
unsafe.
B
So
at
last
the
last
it's
not
a
last
week
the
comments
in
the
issue
last
week,
artist
web
has
over
120
unsafe,
as
of
today
all
encounters
38.
Okay.
So
what
this
like?
What
is
a
case?
Tell
us?
Sometimes
you
carefully
design
your
auditor
structure.
You
can
avoid
the
ANSI
but
remain
remain
the
performance
guarantee.
B
So
when
you
want
to
use
as
if
to
work
from
some
compiler
compilation,
errors
think
carefully
cuz
we
will
we
may
even
to
do
some
unsafe
and
into
your
code,
and
maybe
if
what
you
want
to
gain
the
performance
is
not
it's
not
the
only
way
to
use
and
safe
code.
Ok,
so
the
last
one
is
FFI
foreign
language
interface.
You
know
a
library
called
minis,
a
oxidised
oq
time
for
this
library.
It
is
back
in
of
rust
back
in
of
flea,
and
there
are
two
backends.
B
The
first
way
is
many
say
mini,
say
is
written
in
c
and
someone
will
write
the
mini
z
and
called
mini
z.
Oxidized
library
and
this
library
is
also
used
to
buy
our
tyson
implementation,
so
I
found
out
that
the
there's
a
tab
confusion
in
the
capi
of
this
library.
This
means
this
means
that
when
you,
the
inflated
state
and
the
deflate,
come
compressor
state
constructor
not
consistent,
it
will
cause
a
tap
confusion.
B
Confusion
issue
when
calling
deflate
with
the
inflated
stream
using
the
capi
resulting
a
double
free
crash
for
this
case
is:
isn't
it's
different
because
for
this
library
not
just
to
provide
the
rest
api
to
rust
developer,
it
also
provides
c
compatible
api
for
C
developers,
so
the
the
they
also
want
to
provide
a
safe,
zip
library
for
not
just
a
rust
developer,
but
for
CNC
prefers
to
be
a
developer.
But
the
problem
is
that
you
cannot
control
the
data
provided
by
say,
side
right.
You
can
provide
the
malicious
memories
memory
space
to
the
rest.
B
For
this
one
is
it's
a
popular
pattern
for
in
C
you
use
the
API
to
create
memory
and
like
OpenSSL,
meaning
they
they
do
the
same.
You
call
first
called
api
called
initialize.
The
initialized
api
will
give
you
a
memory
and
the
second
you
use
this
memory
memory
as
a
context
and
the
second
api,
for
example,
zip.
It
will
provide
this
context,
memory
to
that
api
to
do
some
zip
and
unzip
at
last.
You
need
to
end.
B
You
need
to
deallocate
the
context,
but
for
this
case
it's
not
that
easy
to
handle
in
rust,
because
rust
maintained
their
own
memory
allocation
de-allocation.
If
we
want
to
provide
the
memory,
even
if
we
want
to
allocate
the
memory
inside
russ
and
gave
this
memory
to
outside.
To
see
and
later
the
allocated
is
memory
inside
the
rust,
it's
pretty
difficult
design,
our
safe
capi,
because
sometimes
you
there's
something
wrong
in
Seaside
and
there
will
be
a
malicious
structure
provided
to
you.
B
There
are
many
discussion
with
the
officer.
We
just
found
a
good
solution
to
solve
this
issue,
but
it's
quite
difficult
to
read
this
kind
of
API.
Okay.
This
is
a
four
lessons,
so
for
the
rest
community,
do
we
care
about
security?
Yes
right!
It's
not
about
raster
programming,
language
itself.
It's
about
the
rest
code,
for
example
in
the
latest.
The
website
there's
a
rad
security
policy
and
it
defines
how
to
report
backs
of
rust
and
a
library
and
rust
compiler
and
the
whole
process.
B
The
hope
policy
and
the
second
is
a
google
group
called
roster
security
announcement,
and
there
are
only
several
civilian
Osment
in
this
group
right
now
and
the
third
one
called
rust
ii
would
add
weather
advisory
database
for
this
database.
It
contains
some
like
memory
issue
backs
of
crease
and
later
you
can
use
cargo
audit
audit
all
your
dependencies
if
this
dependency
contains
some
security
issue
inside
the
database.
So
if
you
find
out
some
crash
and
like
double
free
and
the
tab,
confusion
so
and
so
forth,
this
kind
of
back,
please
report
to
drastic
advisory
database.
B
The
last
way,
rustic-y
called
the
working
group
and
this
working
group
when
they
focus
on
how
to
improve
the
security,
secure
code
and
also
there
are
a
project
called
the
rust
fast
project
and
fast
fast,
is
a
good
tool
for
testing
and
the
ACS
out
also
good
to
to
fund
some
security
or
world
bilities.
We
would
talk
about
later,
so
there
are
certain
open
questions
we
after
talking
about
this
lessons
and
one
questions
is,
can
be
translated,
say
to
rust
automatically,
and
currently
there
are
one
project
called
c2.
B
Rust
is
successfully
can
successfully
translate,
say
to
rust,
but
all
the
rust
is,
as
if
rust
you
can.
The
question
is:
can
we
use
some
static
analysis
method
to
reduce
sensitive
rust
and
the
second
one
is
safety
and
security
in
rust,
compiler
and
the
standard
library
for
this
open
questions
is,
is
about
the
compiler
itself.
When
you
look
at
the
issue
of
compiler,
there's
a
label
called
and
soundness
and
there's
a
bomb
emoji
beside
on
Sundays.
So
so
there's
a
problem
of
rust,
compiler
in,
for
example,
in
nightly
someone
introduced
new
syntax.
B
B
So
there
are
a
lot
of
code
analysis
tools,
method
from
industry
and
academia
and
how
to
do
this
code
analysis
is
is
I
would
say
it
is
simpler
than
doing
code
analysis
in
C
and
C
practice
right
because
for
us
there
is
no
aliasing
problem.
So
it's
easy
to
to
do
some
to
apply
some
simple
code:
analysis
algorithm
and
also
for
dynamic
analysis,
rust,
there's,
a
middle
middle
level.
Ir
and
someone
read
a
middle
level
are
executed
interpreter.
B
B
B
There
are
a
lot
of
tools
to
formally
verify
C
and
the
C
PAP
has,
and
can
we
do
it
in
rust,
last
ones,
memory
safety,
crossbow,
responder,
is,
for
example,
between
C
and
the
rest
between
Java
and
rest
and
personalized.
For
all
of
these
questions,
there's
a
lot
of
pre-work
mentioned
mentioned
in
the
academic.
So
there's
a
lot
of
papers
talking
about
like,
for
example,
memory
sift
across
the
web,
we're
sponsoring
a
lot
of
papers
are
doing
between
Java
and
C
is
called
gni,
how
to
ensure
the
jhene
aiko
days
safe
and
formal
verification.
B
There's
some
work
on
formally
verified
a
LVM
aha,
so
this
work
a
lot
work
from
academic.
There
are
some
existing
project.
I
want
to
introduce
to
you
for
the
formal
verification.
The
first
verification
to
of
rust
is
called
a
rasp
out,
and
you
can
use
caulk
to
formulate
verify
some
rastko
to
manually
write
in
some
precondition,
a
post
condition
and
also
there's
tool
called
if
there's
a
tool
to
formerly
worth
iris
program
use,
Mac
and
thus
Mac
is
formal
verification
framework
based
on
our
VM.
So
for
this
one
there's
a
paper
online.
B
B
So,
besides
from
replication
for
passing,
there
are
some
fastening
project
called
someone
and
have
already
bring
a
FL
home
fast,
a
family
professor
to
rust
project.
So
a
lot
of
rust
create
use,
rust,
protect
to
do
some
fasten
to
make
sure,
there's
no
and
intentionally
and
wrap
and
there's
no
memory
safety
issues.
So
there's
a
page
called
trophy
case
and
there's
a
big
table
list
that
the
backs
found
by
the
father
so
for
the
code
analysis,
there's
a
project
called
memory
memory,
so
is
a
interpreter
of
the
rest
middle
level
in
the
mini
presentation.
B
Mir
and
this
mirror
is
dynamic
code
analysis
tools.
It
can
find
out
about
memory,
access
and
use
are
free
and
it
have
fun.
Imagine
use
initialize
data
and
some
other
memory
city
issues.
But
for
this
to
is
dynamic
code
analysis
and
for
static
code
analysis,
I'd
I
haven't
heard
some
tools
to
do
that.
But
if
you
heard
come
and
talk
to
me
and
other
tools,
this
Y
is
called
cago
gagger
for
this
tool.
B
B
Okay,
so
speaking
about
the
academic
papers,
so
I'm
from
academic
and
I
read
a
lot
of
papers
of
programming,
language
code,
analysis
and
security.
So
actually
I
summarized
some
papers
about
rust
and
create
a
link.
If
you
are
interested
to
read
some
papers
in
academic,
so
you
can,
you
can
fend
off
and
some
papers
in
C
stink.
Okay,
to
conclude,
this
talk.
B
I
first
talked
up
briefly
talk
about
the
rust
and
how
do
you
start
to
build
safe
and
secure
system
and
also
I
I
want
to
raise
some
challenges
and
license
learned
and
open
questions,
so
the
melody
goes
office.
Talk
to
want
to
raise
one
to
raise
a
concern
of
the
security
researchers.
You
have
to
look
carefully
of
the
roster
code
and
I.
B
A
A
B
B
So
that's
one
solution
is
not
worried,
graceful
and
there
are
other
solutions
like
you
can
use
hash.
You
can
use
tagging
of
the
memory
and
actually,
in
optimally
so
memory
hacking.
You
can
use
this
method
to
tag
all
the
memory
from
rust
to
see,
and
you
can
check
the
tagging
of
that
memory
in
rust
and
to
see
whether
it
is
malicious
or
not.