Assembling HeavyThing into Rust
May 13, 2026 • Carly Levinsohn • 4 min read
A library with modular exponentiation that's 15% faster than OpenSSL, HeavyThing is an x86_64 assembler library designed for Linux. The core motivation behind using assembly stems back to maximizing speed and performing specific hardware manipulations.
Often described as a high-level library with minimal overhead, HeavyThing competes with and sometimes outperforms optimized C implementations for components like networking and security, data handling, and cryptography to provide proven, reliable implementations and minimize vulnerabilities.
Although assembly can drive performance improvements, developing in the language comes with significant risks, spanning debugging and optimization. Refactoring HeavyThing into Rust minimizes these risks all while driving acceleration.
What Blitzy Built
Blitzy delivered the full Rust 2021 Cargo workspace, reaching 94% overall project completion. All five library subsystems are complete, and all three binary crates are functional:
heavything::crypto(13 modules, 17,262 LOC): AES-128/256 (CBC and GCM), SHA-1/256, MD5, HMAC, HMAC-DRBG per NIST SP 800-90A, PBKDF2, scrypt, arbitrary-precision BigInt, Diffie-Hellman, X.509 certificate parsing, and cryptographic RNG.heavything::net(16 modules, 40,168 LOC): the IoChain trait (preserving the original 7-method virtual dispatch abstraction), tokio runtime builder, async DNS, HTTP/1.1 server and client, TLS via rustls, SSH2 server, FastCGI client, IP blacklisting.heavything::tui(33 modules, 54,753 LOC): all 32 originaltui_*.incwidgets, including panel, label, textbox, button, form, authentication screen, datagrid, and statusbar.heavything::ds+heavything::util(27 modules, 17,347 LOC combined): list structures, string maps, buffer management, base64, JSON via serde_json, zlib via flate2, CRC32, RFC 1123 date formatting, syslog integration.
Test Suite & Code Quality
The test suite comprises 3,392 passing tests — zero failures:
| Test Type | Count |
|---|---|
| Unit tests | 2,887 |
| Integration tests | 159 |
| Binary tests | 268 |
| Doc tests | 78 |
The project carried 17 QA checkpoint reviews through the development cycle, with the final review (CP17) resolving a syslog duplicate datagram issue in multi-worker mode. Only 25 doc tests carry intentional ignores, consistent with standard Rust documentation conventions.
Unsafe Rust received careful treatment. The final workspace contains 27 production unsafe blocks, all inventoried in UNSAFE_AUDIT.md with safety invariants and references to the integration tests that verify each site. The project allowed up to 50 unsafe sites; Blitzy needed fewer than half that.
The build runs warning-clean under RUSTFLAGS="-D warnings" and passes cargo clippy --workspace --all-targets -- -D warnings without a single lint. All 125 source files carry the original GPLv3 license headers.
Performance Benchmarks
Benchmarks ran via Criterion, the standard Rust statistical benchmarking harness, on the same hardware as the FASM baseline.
| Metric | Result | vs. FASM Baseline |
|---|---|---|
| AES-128-CBC throughput | 1.22 GiB/s | ~1.00x (matched) |
| SHA-256 throughput | 1.18 GiB/s | 5.04x faster |
| HTTP round-trip (sequential) | 77.5 µs | — |
| HTTP round-trip (4 concurrent) | 111.2 µs | — |
The SHA-256 result is particularly noteworthy. The FASM implementation was hand-optimized assembly. The Rust port uses the ring cryptography library, which exploits hardware acceleration through the same AES-NI and SHA extension pathways. The lesson: modern Rust cryptography libraries have caught up to, and in some cases surpassed, hand-written implementations for standard primitives.
Live Integration Verification
Behavioral fidelity was confirmed through live integration testing:
- A real OpenSSH 9.6p1 client completed a full SSH handshake against
sshtalk: key exchange viadiffie-hellman-group-exchange-sha256, cipheraes256-cbc, MAChmac-sha2-256. - A real curl 8.5.0 request against the webserver returned HTTP 200 with the byte-identical
Server: HeavyThingheader. hnwatchconnected to the live HackerNews Firebase API over TLS, parsed the JSON feed via serde_json, and rendered 22 stories in the terminal datagrid.
Implications
Migrating HeavyThing from assembly to Rust is a deliberately extreme case. The library has limited documentation for thousands of lines of code. The source language (assembly) and the target language (Rust) share almost no syntactic or conceptual vocabulary. The behavioral fidelity requirements are strict enough that a packet capture would catch a regression. HeavyThing's attributes make this project especially interesting.
Blitzy's work on HeavyThing showcases that with even the most extreme migrations, our platform can maintain technical performance and in many cases strengthen metrics. The project supports the assertion that autonomous software development is capable of tackling even the most robust problems: migrating archaic frameworks, addressing precarious memory safety, all while maintaining (or improving) performance.
The platform does not require tradeoffs between risk management and speed; rather, enterprises can (and should) prioritize both. Blitzy empowers companies to do exactly that.
Interested in what autonomous software development could conquer in your codebase? Book a call with us.
