PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The Problem with Dynamic Program Analysis

blog.trailofbits.com | blog | #memory-safety | #use-after-free | #tools | #vulnerability-discovery | #static-analysis | #llvm | #program-analysis | #data-flow | #pointsto | #data-flow-analysis
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Dynamic tools like AddressSanitizer only check executed paths; Trail of Bits' PointsTo applies whole-program static data-flow analysis on LLVM bitcode to find use-after-free bugs at scale.
Published
Collected

Related coverage

blog · guysrd.github.io
The epoll uaf
Nicholas Carlini's epoll use-after-free in fs/eventpoll.c let RCU walkers race kfree() for a constrained write into a freed eventpoll; his Pixel 10 exploitation attempts fell short.
research · depthfirst.com
21 Zero-Days in FFmpeg
depthfirst's autonomous agent discovered 21 zero-day vulnerabilities in FFmpeg and produced reproducible PoC inputs at a fraction of typical cost; several bugs had lain latent for 15-20 years.
research · blog.quarkslab.com
SCAF - Source Code Analysis Framework based on Clang - Pre-alpha preview
A preview of SCAF, a Clang-based source code analysis framework: a Python API and GUI that store ASTs and metadata in a shared database, plus a make-process hook for accurate build context.
tool · github.com
Droid ASC: High-Performance On-Demand Android Decompiler Front-End for Mobile Security & AI Agents
Radically reduces Android reverse-engineering overhead from tens of minutes and gigabytes of memory to milliseconds and megabytes, providing an ideal, stateless code analysis primitive for autonomous security agents and vulnerability researchers.
blog · blog.trailofbits.com
Auditing in the age of (good enough) AI
Trail of Bits explains how agents built tooling and a Lean model for the Miden zkVM audit, finding a flaw enabling Falcon signature forgery and yielding 95 machine-checked proofs.
blog · blog.trailofbits.com
A “proof” of Fermat’s Last Theorem that fits the margin
Trail of Bits found a Lean ≤4.33.1 bug: String.Pos.Raw.extract returns a full string where its spec says empty — enough to 'prove' Fermat's Last Theorem. Not a soundness flaw; fixed in 4.34.0-rc1.
Back