Select Bugs From Binary Where Pattern Like CVE-1337-Days
summary
A custom binary pattern-search engine named Leviathan pattern search tool uses Python plus IDA/Hex-Rays APIs and offers SQL+script modes to match call/flow/expression patterns, propagate taint and follow cross-refs. It scans workspaces of binaries (example: 637 elevated-service modules) and returns precise hits — 32 results from 637 binaries for an ACL race pattern, found 5 confirmed CVEs for integer-overflow variants — and discovers three distinct RDP kernel pool-spray primitives, showing the tool reliably finds real vulnerabilities and exploitation primitives.
AI-written summary · about
chapters (19)
- 0:00Intro
- 1:26Background for Static Code Analysis
- 2:21Challenges for Static Code Analysis
- 5:39What is Workspace, Exactly?
- 7:27Workflow - Run Query
- 11:54Query Mode Limitation
- 12:55Example SQL Query Running Script Mode
- 13:50Leviathan Utility & Pattern Search Primitives
- 18:58File Hijacking Pattern: Seed Vulnerabilities
- 19:51File Hijacking Pattern: Vulnerability Modeling
- 20:16File Hijacking Pattern Extraction
- 22:29Reparse Point Pattern: Seed Vulnerability
- 23:25Reparse Point Pattern: Vulnerability Modeling
- 24:58Reparse Point Pattern: Code Query Construction
- 28:41ACL Overwritten Pattern: Seed Vulnerability
- 32:45RDP Pool Spray Primitive Pattern Extraction
- 33:54Pool Spray Pattern: Find Data Copy With Memcpy
- 34:33Connect RDP PDU To Data Copy With Memcpy
- 37:02Summary
related talks
24mUsing Python to Detect Vulnerabilities in Binaries
21mState of Attack Surface Elimination in a World Plagued by Vulnerable Software
33mWhere is my Code Vulnerable: Matching CVEs and Source Code
34mHow To Find And Prevent Entire Classes Of Security Vulnerabilities
45mFinding Vulnerabilities through Static Analysis and Scripting
26mConfig Based CVE Matching for Linux Kernel
28mAdversarial Intelligence: Redefining Application Security Through the Eyes of an Attacker
30mEnhancing CTI Processes with Code Search Technology