rustify

Rustify

Rebuild software as maintainable Rust from its binary.

Rustify gives AI agents a workflow to reconstruct software from a binary in idiomatic Rust. It recovers product specifications, UX, architecture, evidence, and tests alongside the implementation. Rustify depends on REA for reverse engineering. The goal is software that you can inspect, build, and maintain without the original source.

Installation

The setup below uses Node.js 24.x (24.22.1 or later), npm, Python 3.12 or later with PyYAML, and Rust with Cargo. The Rustify helpers read and write YAML with PyYAML. You install it with python3 -m pip install pyyaml.

1. Set up REA

REA supplies binary analysis and runtime evidence through rustify-probe.

npx rea-agents setup

You select the agents that will use REA. You review the proposed configuration and approve the changes. Setup registers the MCP server and installs REA's matching workflow instructions. You restart the agents named in the completion message.

Native decompilation uses Hopper, Ghidra, or IDA. Setup can connect an existing Hopper or Ghidra installation. It can also install Hopper when you select that option. Other target types can use REA's built-in inspection tools. The REA setup reference provides additional provider settings and troubleshooting steps.

2. Install Rustify

You install Rustify as a Claude Code plugin or with the Skills CLI.

Claude Code plugin. You run these commands in Claude Code:

/plugin marketplace add SebastianElvis/rustify
/plugin install rustify@rustify

The plugin installs all eight Rustify skills for your user account.

Skills CLI. You run this command from your project folder:

npx skills add SebastianElvis/rustify --skill '*'

The Skills CLI installs all eight Rustify skills and prompts you to select your agents. The installation applies to the current project. The -g option makes the bundle available across your projects:

npx skills add SebastianElvis/rustify --skill '*' -g

Rustify follows the Agent Skills format. Compatible agents include Claude Code, Codex, Cursor, and OpenCode. Local and cloud agents use the same skill files. Their environment must provide REA, the target binary, its resources, and a compatible runtime. Desktop investigation also needs a GUI session.

3. Check the setup

This command checks the installed REA workflow:

npx rea-agents doctor --skill --json

Native analysis also needs a working provider. This example checks Hopper:

npx rea-agents doctor --provider hopper --json

You can replace hopper with ghidra or ida for your configured provider. Your agent must have access to REA through MCP or the CLI.

Usage

You invoke the main rustify skill with the binary path and the output folder:

/rustify /path/to/program ./reconstructed-program

You can add resources, documentation, and constraints in natural language:

/rustify /path/to/program ./reconstructed-program
The resources are in /path/to/resources. The manual is at https://example.com/manual.

Agents without slash commands accept the same request in a prompt. The Claude Code plugin uses /rustify:rustify in place of /rustify.

Rustify always reconstructs the full product. A missing feature stays an open gap until the agent completes it. The agent saves checkpoints and reopens affected phases when inputs change.

Output

The target project contains three folders:

The ledger recovered/model.yaml links each EARS requirement to evidence, tests, components, Rust modules, slices, and gaps. The agent produces diagrams and data models when the evidence supports them. The project format defines the output formats. The standards guide defines the writing rules, the terminology, and the requirement and architecture forms.

Workflow

1. Preparation: rustify records the target identity and the checkpoint state.
2. Characterization: rustify-probe captures the first scenarios and relevant binary evidence through REA.
3. Discovery: rustify-product, rustify-design, and rustify-architecture write EARS requirements, C4 components, and evidence in parallel when the agent supports parallel work.
4. Planning: rustify-plan maps each original component to one Rust module and plans a walking skeleton and risk-ordered slices.
5. Slices: rustify-implement builds one slice at a time with acceptance tests first. rustify-validate checks each slice before the next one.
6. Acceptance: rustify-validate requests fresh probes, runs the reflexion check and parity gate, and writes an assurance case.

The discovery, planning, implementation, and validation skills use rustify-probe for shared captures and execution traces. The agent runs discovery tasks sequentially when parallel execution is unavailable. The architecture guide includes the diagram's editable LaTeX source.

Design principles

• We strive for one-to-one mapping. Rustify maps the original product, UX, behavior, data, and architecture to the Rust implementation. Known differences remain open until a repair resolves them.
• Evidence and user experience guide reconstruction. Observed workflows, interface states, binary evidence, and tests support each mapping. Unit tests, E2E comparisons, independent expectations, and available upstream vectors challenge the result.
• Rust code follows Rust conventions. The implementation preserves original responsibilities and execution boundaries. The stack guide ties dependencies to those requirements.
• Reports keep gaps visible. Only a full-product pass establishes parity. Changed evidence invalidates stale results.
• Standards keep agents consistent. Requirements follow ISO/IEC/IEEE 29148 and EARS. Architecture follows ISO/IEC/IEEE 42010, C4, and arc42. Prose follows ASD-STE100.

Example

The rustify-doom repository holds the Rustify reconstruction of Doom. Rustify built it from a stripped doomgeneric binary and the Freedoom game data. Its compatibility report gives the measured parity and the open gaps.

Evaluation

The open-source tier covers GNU base64, BLAKE3 hashing, an HTTP client, native desktop dialogs, bzip2, Lua, SQLite, Ninja, and Doom. The closed-source tier covers the macOS tools iconutil and textutil. The bzip2, Lua, SQLite, Ninja, and Doom tracks use hardened -O3, LTO, and stripped reference builds. The benchmark paper explains the track selection and the scores. The contributing guide gives the test, evaluation, and diagram commands.

Responsible use

Use Rustify only on software that you have the right to analyze. Software licenses and local laws can limit reverse engineering. You are responsible for compliance with them.

Documentation

• Product and vision
• Architecture and diagram source
• Benchmark paper
• Evaluation commands
• Target-project format
• Standards and terminology
• Rust stack guide
• Contributing guide
• Security policy

License

Rustify uses the Apache License 2.0. Some evaluation files derive from upstream test suites. These files keep their upstream licenses. Each track README names the license.