Welcome Back & Remarks & Code Aware Services in the Service of Vulnerability Detection
summary
System captures build actions with a low‑overhead build-awareness kernel tracer (ftrace module) and parses C with a clang AST processor to produce per‑module JSON databases. Claims: AOSP source (~1M files) reduces to <200k files for a product, common kernel 80k→~25% used; vmlinux JSON is a few GB. Tracer adds ≈5% build time. Uses: 10× fewer code‑search results, near‑perfect IDE indexing, auto‑generate fuzzing protobufs and off‑target harnesses; crash reached 100M→3M executions with structure‑aware mutator.
AI-written summary · about
chapters (26)
- 0:00Start
- 12:09System overview BAS
- 12:29Problem introduction
- 15:22Approach to build tracing Intercepting low-level Os primitives in the least Intrusive manner possible
- 17:30BAS Architecture Acquiring build Information
- 18:44Code search improvements
- 19:51IDE indexing improvements
- 21:16Custom makefile generation
- 22:38Build Awareness service
- 25:17Code review automation
- 25:51Parsing the source code
- 26:35Extending clang compiler
- 27:29Abstract Syntax Tree (AST) Main features
- 28:57Creation of the FTDB Function/Type B on module basis
- 30:30Function information
- 32:42Type information
- 33:28Function ptr initialization
- 34:59Security code review support
- 36:44Generating dictionaries for fuzzers
- 36:58Structure aware fuzzing support
- 39:06Automatic Off-Target Automatic off-carget generation for unit-like testing of a complex system
- 39:30On-Target vs Off-Target Example testing message parser in the modem
- 41:46Overview of the process Extracting parts of the source from one target to another
- 42:27AOT: Automatic Off-Target Overview
- 43:22C/C++ Legacy Example of Ubuntu 20.04 standard apt repository
- 44:11Conclusion
related talks
35mLinux Tracing updates
42mKernel ABI Monitoring a...
28mImproving Build Time SBoMs
29mSecuring C code that seems to work just fine
19m"ClangBuiltLinux: What's Next?"
05mLightning Talk: Pruning the Kernel CVEs With Code Reachability Analysis
24mTriaging Crashed With Backward Taint Analysis For Arm Architecture
35mbpftrace: Evolution from a command line tool to a complex observability framework