Where Rust actually is in Windows 11

A detailed census of Rust in a single Windows 11 Home x64 25H2 installation (build 26200.9168) inspects every .dll, .exe and .sys under C:\Windows (13,988 live files and 44,889 component-store files), using a one-line grep for Rust markers, a commercial PE viewer for manual review, and Microsoft public symbols plus llvm-pdbutil to count how many bytes each contributing object file came from rustc. The methodology treats rust-origin strings and rustc object names as strong indicators but uses the linker’s PDB attribution (rcgu.o objects) to measure Rust code bytes because link-time optimisation folds most Rust into internal objects and public symbol names undercount Rust. All Rust markers were hand-classified and full evidence files and commands are provided so the counts can be reproduced; the report notes that markers imply presence, not necessarily runtime execution.

Findings include two servicing DLLs - CloudRecoveryDownloadTool.dll and UdiApiClient.dll - attributed 96.6% and 96.2% Rust by the linker, DWriteCore measured at 57.9% Rust while System32\DWrite.dll shows zero Rust, and NarratorMCAT.dll identified as the open-source MathCAT crate compiled by Microsoft’s internal toolchain with 26 third‑party crates and no first‑party crate paths. A compiler channel named stable-utc (inferred as UTC backend) produced a MathCAT build about 14% smaller than an llvm-built counterpart. The announced kernel driver win32kbase_rs.sys is present (≈155,648 bytes, 21 .rs path strings) but its runtime feature gate lives in the C++ host; 83 other driver-like binaries flagged by strings are explained as NVIDIA/Intel shader-compiler artifacts.