11–14 of 14 posts
I’d built an AI agent to accomplish this using Ghidra + GDB for dynamic analysis (tested it on crackmes) It worked surprisingly well Applied to YC with it, sadly no interview Was later told by some accepted friends/VCs that our application was good, but without pedigree we needed traction to de-risk / get accepted :(
If you think its good why wait on YC...just build it.
Much harder to bootstrap part-time w/ dependents
I'm suspicious of the effectiveness. Most people are doing symbolic execution to find bad pointer dereferences as bugs, whereas this tool is doing it to build the least constrained model and then checking the code against that same model. Wouldn't any code paths that are discovered as part of symbolic exploration and have out-of-bounds read/writes then be infered away as constraints, instead of bugs? Or being unable…
Thinking about it more, a lot of bugs come around downstream of your initial function inputs, and you'd still be able to catch things like "heap allocation and then out of bounds read from that allocation with an offset derived from input" just fine since your least-constrained model only infers for the inputs. That probably covers a lot of the normal use-cases for Angr plus automatically harnessing inputs to reach t…
Fundamentally, GREASE works quite similarly to UC-Crux, our tool for under-constrained symbolic execution of LLVM.
Essentially, GREASE analyzes each function in the target binary by running it on a slate of fully symbolic registers.
When errors occur (for example, if the program reads from uninitialized memory), GREASE uses heuristics to refine this initial symbolic precondition (e.g., by initializing some memory) and re-runs the target function. This process continues until GREASE finds a bug, or concludes that the function is safe under some reasonable precondition on its inputs. The blog post introducing UC-Crux [https://www.galois.com/articles/under-constrained-symbolic-e...] describes this algorithm in considerable detail."
Fascinating!
It's almost like the ability to run a given function inside of its own Virtual Machine / Virtual Environment and setting parameters/constraints for execution, that is, defining pre-conditions and post-conditions which determine successful (defined) or unsuccessful (undefined) behaviors!
Let me speculate that future programming languages -- might have abilities like this by default, that is, implicitly baked into them...
In short, I like the set of ideas espoused by this tool, and future compiler/language writers would do well to consider them when they write their future compilers/languages...
(Phrased another way, it would be like the ability to run any function of a program inside of its own custom Bochs [https://bochs.sourceforge.io/] environment, set pre and post constraints, run/test as many of these as needed, and return back to main program/environment reporting any constraint violations... or something like that...)
Anyway, an interesting set of ideas!