Yen Wang

0x00Yen Wang · London, UK

I reverse-engineer Rust malware and study how analysis tools handle it.

I'm a PhD researcher in cyber security at UWE Bristol. I study what information stripped Rust binaries keep, how Ghidra, IDA Pro, Binary Ninja and radare2 handle it, and how memory-safety bugs behave once they are compiled.

Open to roles in malware analysis, reverse engineering and AI security.

Now building: Rust Insights Agentic System, an agentic AI system that detects Rust malware by recovering what compiled Rust code does, which today's reverse engineering tools miss.

See the work Read the writing
91
Rust malware samples from 65 families in my exploratory tool comparison
5
reverse engineering tools compared on the same stripped samples
32
automated checks behind my stack overflow study. 3 of my own claims failed them

Selected work

All work →
Research

Stripped but not Silent

An early, exploratory comparison of how five reverse engineering tools handle library information in stripped Rust malware.

91 samples · 5 tools compared · exploratory
 Malware reverse engineering

Akira v2, read from the binary

Akira's Rust rewrite, taken apart at byte level: struct layouts from drop glue, the real crypto stack, and the author's code inside 3,274 functions.

~12 author functions found in 3,274 · 32-byte struct recovered from drop glue
 Vulnerability research

A stack overflow that never reaches RIP

Root-causing a crash in a vulnerable C server under GDB, and finding it does not fail the way the textbook says.

Crash at 264 B, canary trips at 137 B · 32 checks, 3 of my claims failed
 Vulnerability research

Rust memory-safety bugs, reproduced and measured

Reproducing CVE-2021-25900 in smallvec under Miri, and measuring when an unsafe Rust bug is visible at all.

CVE-2021-25900 reproduced · unsafe out-of-bounds read exits 0 in release

Latest writing

All 10 posts →