Triton

Triton is a dynamic binary analysis library. It provides internal components that allow you to build your program analysis tools, automate reverse engineering, perform software verification or just emulate code. Dynamic symbolic execution Dynamic taint analysis AST representation of the x86 ,...

toy-wasm-symbexp

toy-wasm-symbexp This is a toy WASM symbolic interpreter. It illustrates the following articles: Part 1 - Introduction Part 2 - Writing a concrete interpreter - browse code at this stage Part 3 - Writing a symbolic interpreter - browse code at this stage Part 4 - Writing a symbolic interpreter...

zeno

Zeno Framework Installation cd git clone https://github.com/Traxes/zeno --recursive sudo pip3 install termcolor tqdm git clone https://github.com/Z3Prover/z3 --recursive cd z3 python3 scripts/mkmake.py --python cd build make sudo make install cd /zeno Usage /zeno$ PYTHONPATH=$PYTHONPATH:$HOME/zen...

[SECURITY] Fedora 45 Update: z3-5.1.0-2.fc45

Z3 is a satisfiability modulo theories SMT solver; given a set of constraints with variables, it reports a set of values for those variables that would meet the constraints. The Z3 input format is an extension of the one defined by the SMT-LIB 2.0 standard. Z3 supports arithmetic, fixed-size...

Proof-Gated Signing: Solver-Checked Transaction Guards That Hold under State Drift for Onchain AI Agents

AI agents that control wallets read attacker-reachable content, so they can be steered into proposing harmful transactions. The usual last line of defense is a pre-signing check: a static allowlist, an LLM reviewer, or a transaction simulation. All three share a gap: the check describes the chain...

Access Control As Verified Parse Constraints

Commercial security gateways repeatedly ship implementation bugs in the code path between the network and the policy decision: hand-written enforcement logic that diverges from the policy author's intent, and ad-hoc request parsers at the network boundary that introduce memory-safety flaws of the...

NeuroLog: Reasoning You Can Audit -- Neuro-Symbolic Vulnerability Discovery Via LLM Facts, Datalog, and SMT

Vulnerability discovery on C/C++ source asks the analyst to choose between heavyweight static analysers, which need a working build before a single query runs, and free-form LLMs, which read source readily but invent details and lose track of cross-function dataflow on real codebases. We present...

solidity:solc_noopt_ossfuzz: Stack-use-after-return in solidity::smtutil::CHCSmtLib2Interface::querySolver

Project: https://github.com/ethereum/solidity.git Detailed Report: https://oss-fuzz.com/testcase?key=5750916210491392 Project: solidity Fuzzing Engine: afl Fuzz Target: solcnooptossfuzz Job Type: aflasansolidity Platform Id: linux Crash Type: Stack-use-after-return READ 8 Crash Address:...

Using symbolic execution to solve a tiny ASCII maze.

In this post we'll exercise the symbolic execution engine KLEE over a funny ASCII Maze yet another toy example! | VS. | Maze dimensions: 11x7 Player pos: 1x1 Iteration no. 0 Program the player moves with a sequence of 'w', 's', 'a' or 'd' Try to reach the prize! +-+---+---+ |X| || | | --+ | | | |...