PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

gosentry brings LibAFL-grade fuzzing to Go's native interface

blog.trailofbits.com | blog | #appsec | #fuzzing | #go | #tool-release | #libafl | #gosentry | #coverage-guided | #integer-overflow
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

gosentry is a Trail of Bits fork of the Go toolchain that keeps the standard testing.F harness while running go test -fuzz on LibAFL, adding struct-aware, grammar-based fuzzing and new bug detections.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Detect Go’s silent arithmetic bugs with go-panikint
go-panikint, a modified Go compiler from Trail of Bits, turns silent integer overflows into explicit panics; it uncovered a real overflow in Cosmos SDK RPC pagination, closing a fuzzing blind spot.
blog · blog.trailofbits.com
Introducing Ruzzy, a coverage-guided Ruby fuzzer
Trail of Bits released Ruzzy, a coverage-guided fuzzer for pure Ruby and Ruby C extensions, built on libFuzzer with Atheris inspiration and ASan/UBSan support to find DoS and memory corruption bugs.
research · blog.trailofbits.com
Extending Ruzzy with LibAFL
Trail of Bits added LibAFL support to Ruzzy, its coverage-guided fuzzer for Ruby and Ruby C extensions, via LibAFL's libFuzzer compatibility layer—no changes needed to existing harnesses.
blog · blog.trailofbits.com
Mutation testing for the agentic era
Trail of Bits releases MuTON and mewt, mutation testing tools optimized for agentic workflows: MuTON supports TON languages, while mewt is a language-agnostic core for Solidity, Rust and Go.
blog · blog.trailofbits.com
Try our new dimensional analysis Claude plugin
Trail of Bits released a Claude plugin using LLMs to annotate code with dimensional types and mechanically flag mismatches, reaching 93% recall vs 50% for baseline prompts on real audit findings.
blog · blog.trailofbits.com
mquire: Linux memory forensics without external dependencies
Trail of Bits open-sourced mquire, which analyzes Linux memory dumps without external debug symbols by extracting BTF type information and symbol addresses directly from the dump itself.
Back