Postmortem Program Analysis with Hardware-Enhanced Post-Crash Artifacts
summary
POMP reconstructs pre-crash dataflow by reverse-executing Intel PT traces merged into a core dump and then runs backward taint analysis to highlight the statements that actually cause a crash. An implementation for Linux x86-32 processes execution traces and pinpoints root causes for 31 real-world vulnerabilities, typically reducing manual inspection to a handful of instructions. Analysis runs range from seconds to hours; limitations include unresolved system-call-modified memory and very large traces. Source code is available.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:39Software Debugging
- 5:46Development
- 6:13Reverse Execution
- 6:53Direct Inversion
- 9:40Memory Alias
- 14:07Hypothesis Test
- 21:24Questions
related talks
48mDPTrace: Dual Purpose Trace for Exploitability Analysis of Program Crashes
24mTriaging Crashed With Backward Taint Analysis For Arm Architecture
16mHardTaint: Production-Run Dynamic Taint Analysis via Selective Hardware Tracing
30mBIN2TL: Visualizing Program Dynamics with Perfetto
28mCOFI break
42mContemporary Automatic Program Analysis
48mCapturing 0Day Exploits With Perfectly Placed Hardware Traps
43mThe Aftermath of a Fuzz Run: What to do about those Crashes?