fd4a68dfff
Unit + integration coverage for the session's work: incremental project graph/index, pcode encoder, unreachable/dead-branch, equiv/cross-TU, div-by-zero/sign-conversion/int-truncation, use-after-free, quality-precision, scan-router profile, source TU runner, detector plan, and the eval fixtures.
233 lines
6.9 KiB
JSON
233 lines
6.9 KiB
JSON
{
|
|
"findings": [
|
|
{
|
|
"confidence": "syntactic",
|
|
"evidence": {
|
|
"backend": "binary",
|
|
"bail_reasons": [],
|
|
"binary": {
|
|
"matched_string": "",
|
|
"offset": null,
|
|
"section": ".plt",
|
|
"vaddr": 17136144,
|
|
"xref_function": "",
|
|
"xref_vaddr": null
|
|
},
|
|
"correlated_binary_vaddr": null,
|
|
"correlation_kind": "",
|
|
"detector_name": "dangerous-import",
|
|
"has_cross_tu_corroboration": false,
|
|
"has_source_binary_corroboration": false,
|
|
"is_summary_backed": false,
|
|
"latent": false,
|
|
"latent_reason": "",
|
|
"precondition_required": false,
|
|
"proof_mode": "syntactic",
|
|
"required_preconditions": [],
|
|
"z3_queries": null,
|
|
"z3_time_ms": null
|
|
},
|
|
"id": "binary.dangerous-import.515f934f3d807562.3",
|
|
"kind": "deprecated-banned",
|
|
"locations": [
|
|
{
|
|
"column": 0,
|
|
"file": "tests/fixtures/binary/cwe/cwe121_bof.elf",
|
|
"function": "<import>",
|
|
"line": 17136144
|
|
}
|
|
],
|
|
"message": "Dangerous import 'imp.strcpy' detected in binary",
|
|
"score": 0.9
|
|
},
|
|
{
|
|
"confidence": "syntactic",
|
|
"evidence": {
|
|
"backend": "binary",
|
|
"bail_reasons": [],
|
|
"binary": {
|
|
"matched_string": "",
|
|
"offset": null,
|
|
"section": ".plt",
|
|
"vaddr": 17136464,
|
|
"xref_function": "",
|
|
"xref_vaddr": null
|
|
},
|
|
"correlated_binary_vaddr": null,
|
|
"correlation_kind": "",
|
|
"detector_name": "dangerous-import",
|
|
"has_cross_tu_corroboration": false,
|
|
"has_source_binary_corroboration": false,
|
|
"is_summary_backed": false,
|
|
"latent": false,
|
|
"latent_reason": "",
|
|
"precondition_required": false,
|
|
"proof_mode": "syntactic",
|
|
"required_preconditions": [],
|
|
"z3_queries": null,
|
|
"z3_time_ms": null
|
|
},
|
|
"id": "binary.dangerous-import.7770cf586ee6abfb.4",
|
|
"kind": "deprecated-banned",
|
|
"locations": [
|
|
{
|
|
"column": 0,
|
|
"file": "tests/fixtures/binary/cwe/cwe121_bof.elf",
|
|
"function": "<import>",
|
|
"line": 17136464
|
|
}
|
|
],
|
|
"message": "Dangerous import 'imp.execve' detected in binary",
|
|
"score": 0.9
|
|
},
|
|
{
|
|
"confidence": "syntactic",
|
|
"evidence": {
|
|
"backend": "binary",
|
|
"bail_reasons": [],
|
|
"binary": {
|
|
"matched_string": "tests/fixtures/binary/cwe/cwe121_bof",
|
|
"offset": 6970,
|
|
"section": ".rodata",
|
|
"vaddr": 16784186,
|
|
"xref_function": "",
|
|
"xref_vaddr": null
|
|
},
|
|
"correlated_binary_vaddr": null,
|
|
"correlation_kind": "",
|
|
"detector_name": "hardcoded-string",
|
|
"has_cross_tu_corroboration": false,
|
|
"has_source_binary_corroboration": false,
|
|
"is_summary_backed": false,
|
|
"latent": false,
|
|
"latent_reason": "",
|
|
"precondition_required": false,
|
|
"proof_mode": "syntactic",
|
|
"required_preconditions": [],
|
|
"z3_queries": null,
|
|
"z3_time_ms": null
|
|
},
|
|
"id": "binary.hardcoded-string.15841df10e7b9306.5",
|
|
"kind": "hardcoded-credential",
|
|
"locations": [
|
|
{
|
|
"column": 0,
|
|
"file": "tests/fixtures/binary/cwe/cwe121_bof.elf",
|
|
"function": "<binary-string>",
|
|
"line": 16784186
|
|
}
|
|
],
|
|
"message": "Hardcoded base64-blob in binary string: tests/fixtures/binary/cwe/cwe121_bof",
|
|
"score": 0.65
|
|
},
|
|
{
|
|
"confidence": "syntactic",
|
|
"evidence": {
|
|
"backend": "binary",
|
|
"bail_reasons": [],
|
|
"binary": {
|
|
"matched_string": "/opt/homebrew/Cellar/zig/0",
|
|
"offset": 7344,
|
|
"section": ".rodata",
|
|
"vaddr": 16784560,
|
|
"xref_function": "",
|
|
"xref_vaddr": null
|
|
},
|
|
"correlated_binary_vaddr": null,
|
|
"correlation_kind": "",
|
|
"detector_name": "hardcoded-string",
|
|
"has_cross_tu_corroboration": false,
|
|
"has_source_binary_corroboration": false,
|
|
"is_summary_backed": false,
|
|
"latent": false,
|
|
"latent_reason": "",
|
|
"precondition_required": false,
|
|
"proof_mode": "syntactic",
|
|
"required_preconditions": [],
|
|
"z3_queries": null,
|
|
"z3_time_ms": null
|
|
},
|
|
"id": "binary.hardcoded-string.62527725c8108ce2.6",
|
|
"kind": "hardcoded-credential",
|
|
"locations": [
|
|
{
|
|
"column": 0,
|
|
"file": "tests/fixtures/binary/cwe/cwe121_bof.elf",
|
|
"function": "<binary-string>",
|
|
"line": 16784560
|
|
}
|
|
],
|
|
"message": "Hardcoded base64-blob in binary string: /opt/homebrew/Cellar/zig/0",
|
|
"score": 0.65
|
|
},
|
|
{
|
|
"confidence": "heuristic",
|
|
"evidence": {
|
|
"backend": "binary",
|
|
"bail_reasons": [],
|
|
"correlated_binary_vaddr": null,
|
|
"correlation_kind": "",
|
|
"detector_name": "binary-security",
|
|
"has_cross_tu_corroboration": false,
|
|
"has_source_binary_corroboration": false,
|
|
"is_summary_backed": false,
|
|
"latent": false,
|
|
"latent_reason": "",
|
|
"precondition_required": false,
|
|
"proof_mode": "heuristic",
|
|
"required_preconditions": [],
|
|
"z3_queries": null,
|
|
"z3_time_ms": null
|
|
},
|
|
"id": "binary.binary-security.d7ba046093b9da47.0",
|
|
"kind": "taint-track",
|
|
"locations": [
|
|
{
|
|
"column": 0,
|
|
"file": "tests/fixtures/binary/cwe/cwe121_bof.elf",
|
|
"function": "fcn.01017790",
|
|
"line": 16873360
|
|
}
|
|
],
|
|
"message": "Function calls potentially unsafe routine 'call sym.imp.strcpy'",
|
|
"score": 0.82
|
|
},
|
|
{
|
|
"confidence": "heuristic",
|
|
"evidence": {
|
|
"backend": "binary",
|
|
"bail_reasons": [],
|
|
"correlated_binary_vaddr": null,
|
|
"correlation_kind": "cross-detector:binary-security",
|
|
"detector_name": "binary-security",
|
|
"has_cross_tu_corroboration": false,
|
|
"has_source_binary_corroboration": false,
|
|
"is_summary_backed": false,
|
|
"latent": false,
|
|
"latent_reason": "",
|
|
"precondition_required": false,
|
|
"proof_mode": "heuristic",
|
|
"required_preconditions": [],
|
|
"z3_queries": null,
|
|
"z3_time_ms": null
|
|
},
|
|
"id": "binary.binary-security.2e99f62736193e77.1",
|
|
"kind": "taint-track",
|
|
"locations": [
|
|
{
|
|
"column": 0,
|
|
"file": "tests/fixtures/binary/cwe/cwe121_bof.elf",
|
|
"function": "fcn.0102c270",
|
|
"line": 16958064
|
|
}
|
|
],
|
|
"message": "Function calls potentially unsafe routine 'call sym.imp.malloc'",
|
|
"score": 0.82
|
|
}
|
|
],
|
|
"output_version": 1,
|
|
"tool": {
|
|
"name": "fold",
|
|
"version": "0.1.0+61ee0b5f4f79.dirty"
|
|
}
|
|
}
|