Viewing profile — pag

I implemented something like this! The Dr. Lojekyll [1] datalog system was built around the idea of inputs as receiving messages over time, and publishing outputs (also as messages…

These are great questions! We think our approaches are complimentary. We think that CIR, or ClangIR, can be a codegen target from a combination of our high-level IR and our medium-…

Can you explain how your offering compares with open-source alternatives, such as KLEE [1] and DeepState [2]? P.S. your logo is surprisingly similar to that of ForAllSecure [3], wh…

DeepState [1] is a tool that lets you write Google Test-style unit tests, as well as property tests, in either C or C++, and plug in fuzzers and symbolic executors. That is, DeepSt…

It sounds like what you want is Mishegos [1], described here [2]. In fact, this work shows that Capstone performs rather poorly compared to more permissively licensed open-source c…

And lets not forget that Rust's borrow checker is implemented with Datalog [1]. [1] https://smallcultfollowing.com/babysteps/blog/2018/04/27/an-...

Datalog also comes up in cluster management / provisioning. For example: Differential Datalog [1]. [1] https://github.com/vmware/differential-datalog

Datalog and variants of it come up a bunch in program analysis and software security. For example, GitHub/Microsoft acquired a company, Semmle [1], that has an object-oriented quer…

If you can modify the kernel, you could modify binfmt_elf.c in the case of the Linux kernel, and log out the load address to dmesg or something like that. Another alternative, whic…

If you're inside the process, as the LD_PRELOAD interceptor mentioned in the article is, then in theory you could try to get the address of the binary's main function or some other…

This is a really cool SQLite wrapper. One of these things this wrapper lets you do is bind C++ functions/lambdas to ones in SQLite. You can use that functionality in things like SQ…

Hopefully we'll have a Dockerfile soon that gets things all set up :-D

Nope :-P

By the way, did you know that DeepState is actually pure C, and that all the C++ is just window dressing on top? This means that you could feasibly integrate components of it in Ad…

There are a number of lifters. The McSema repo has a table detailing the features of most of them. Glad that DeepState had an impact on you :-D We continue to evolve DeepState, bot…

We at Trail of Bits are also working on "klee-native," a port of KLEE using Remill to dynamically lift and emulate binaries. This project is very early on, though.

I found an old paper I wrote about my first DBT, and it has a nice figure about how I implemented indirect branch resolution: https://imgur.com/a/dCpY7V2 . Feel free to ping me at …

Take a look at the various block chaining approaches of dynamic binary translators (DynamoRIO, PIN, etc.). There is a lot of work done in this space.

DeepState provides a Google Test-compatible interface to writing C++ unit tests; however, underneath it all, it is really a C unit testing framework. That is the reason for some of…

I think you could produce much better machine code by "templatizing" the stack allocations into function-specific pattern variables, passed to a single alloca-like function which u…

One unusual thing is that, at least for the curl example binary, the pre-built installable version is an x86 one and not an x86-64 one. From briefly looking at the assembly, it see…

The Remill [1] machine code to LLVM bitcode binary translator lifts procedural code into an SSA form (LLVM's) and abstracts over the modelled program's memory using small step sema…

Check out DeepState! https://github.com/trailofbits/deepstate

The Solidity language is deceptively low level, which partially stems from implementation details related to how the solc compiler chooses to implement language features. Developer…

If you're an everyday C/C++ programmer and can't imagine how Angr could fit into your workflow, then check out DeepState ( https://github.com/trailofbits/deepstate ). It is a Googl…