Alaid TechThread

ghidraMCP is an Model Context Protocol server for allowing LLMs to autonomously reverse engineer applications. It exposes numerous tools from core Ghidra functionality to MCP clients. https://github.com/LaurieWired/GhidraMCP

Minimal LLM-based fuzz harness generator https://adalogics.com/blog/minimal-llm-based-fuzz-harness-generator

Exploit Development: Investigating Kernel Mode Shadow Stacks on Windows https://connormcgarr.github.io/km-shadow-stacks/

The plugin provides a custom navigation interface within IDA. It examines execution paths from entry points, breaks down the binary into clusters of related functions, and highlights downstream behaviors and artifacts for quicker insights. XRefer can incorporate external data (e.g., API traces, capa results, user-defined xrefs) and provides path graphs for richer context. It integrates with Google's Gemini model to produce natural language descriptions of code relationships and behaviors. Additionally, XRefer can provide cluster based labels for functions, aiming to accelerate the manual static analysis process.

https://github.com/mandiant/xrefer

Leveling Up Fuzzing: Finding more vulnerabilities with AI https://security.googleblog.com/2024/11/leveling-up-fuzzing-finding-more.html

Known Vulnerabilities of Open Source Projects: Where Are the Fixes? https://ieeexplore.ieee.org/document/10381645

Fuzzing for complex bugs across languages in JavaScript Engines https://powerofcommunity.net/poc2024/Carl%20Smith,%20Fuzzing%20for%20complex%20bugs%20across%20languages%20in%20JavaScript%20Engines.pdf

Pishi: Coverage guided macOS KEXT fuzzing https://r00tkitsmm.github.io/fuzzing/2024/11/08/Pishi.html

Google & Arm - Raising The Bar on GPU Security https://security.googleblog.com/2024/09/google-arm-raising-bar-on-gpu-security.html

Lessons from the buzz: What have we learned from fuzzing the eBPF verifier https://lpc.events/event/18/contributions/1946/attachments/1473/3119/Lessons%20from%20the%20buzz%20-%20LPC.pdf

FUZZING'24 Keynote: "Is 'AI' useful for fuzzing?" https://www.youtube.com/watch?v=4BPJXmrdmls

Introducing Java fuzz harness synthesis using LLMs https://blog.oss-fuzz.com/posts/introducing-java-auto-harnessing/

TROOPERS24: Fuzzing at Mach Speed: Uncovering IPC Vulnerabilities on MacOS https://www.youtube.com/watch?v=tZmollb8NXk

Top Score on the Wrong Exam: On Benchmarking in Machine Learning for Vulnerability Detection https://arxiv.org/pdf/2408.12986

Transferring Backdoors between Large Language Models by Knowledge Distillation https://arxiv.org/pdf/2408.09878