Recently I was working through Cindy Xiao’s (Decoder Loop) workshop from Ringzer0 COUNTERMEASURE 2025: “Reversing a (not-so-) Simple Rust Loader”, and I struggled getting IDA to work nicely with Rust-style symbol names. Let me show you how to fix this.
In the workshop, Cindy shows us how to markup a to_vec routine, referencing the std::vec::Vec<u8> type:
However, under the default settings for IDA 9.2, the source parser doesn’t accept symbol names containing “<“ or “>” characters. So, while we can create types with these characters:
We can’t refer to them when assigning variable types or function prototypes:
I had always worked around this by using type names like Vec_u8, which are visual similar and enough to remind me of the type. I find this tends to work for a small number of types, but not in large programs where they may be lots of nested types (like Rust!).
But all is not lost!
I learned today that IDA does support parsing symbol names like this with the new Clang-based parser! This parser was introduced in 9.2 and is based on clang’s LibTooling llvm-20.1.0.
After I enabled it (via Options → Compiler→ Source parser), I could now create fairly beautiful pseudocode that reflects the Rust logic:
For more information, there’s existing tutorials on how to use IDAClang (the predecessor) IDAClang | Hex-Rays Docs as well as details in the IDA 9.2 release notes: IDA 9.2 | Hex-Rays Docs. Now that I know how this source parser is relevant to my malware analysis workflows, I’m looking forward to this to become the default.
In the meantime, I recommend updating your settings:
