Skip to main content
1
WitchcraftSolver
Automated0dayDiscoveryinStrippedBinaries
DEF CON 34
Las Vegas (Sin City), August 2026
Jonathan Brossard
endrazine@psirt.com
2
Agenda
Pride
Avarice
Envy
Wrath
Lust
Gluttony
Sloth
WhoAmI?
Pride
3
6
"Previously,onDEFCON"
WCC
7
8
AutomatedLibification:theWitchcraftLinker
URL: https://github.com/endrazine/wcc
License: MIT/BSD-2
9
WitchcraftShell:ProceduralDebugging
- Libify ELF executables
- Make ELF executables scriptable
- Call arbitrary functions
(procedural debugging)
URL: https://github.com/endrazine/wcc
License: MIT/BSD-2
10
WitchcraftCompiler:Unlinking+Relinking
wcc can unlink + relink apache2, nginx, sshd, proftpd.
Unlinking + static unlinking (statification): proven on
apache2
https://hub.docker.com/r/endrazine/wcc-unlinking
https://github.com/endrazine/wcc-tests-unlinking
https://github.com/endrazine/wcc-test-relinking
11
WitchcraftCompiler:Unlinking+Relinking
# i n c l u d e < s t d i o . h>
# i n c l u d e < s t d l i b . h>
# i n c l u d e < u n i s t d . h>
# i n c l u d e < s t r i n g . h>
char * ap parse log level ( const char * str , int * val ) ;
i n t main ( i n t a r g c , c h a r ** a r g v ) {
i n t i = 0;
char * r e t = 0;
i f ( argc < 2) {
p r i n t f ( ” Usage : %s <l o g l e v e l >n ” , argv [ 0 ] ) ;
e x i t ( EXIT SUCCESS ) ;
}
r e t = a p p a r s e l o g l e v e l ( a r g v [ 1 ] , &i ) ;
if (! ret ) {
p r i n t f ( ” l o g l e v e l : %d  n ” , i ) ;
} else {
p r i n t f (”% s  n ” , r e t ) ;
}
return 0;
}
New Release, on the DEF CON website
ZeitgeistversusEpistemology:TheoreticallimitsofAI
Avarice
12
13
Zeitgeist:IsAIGoingto"Solve"Security...?
"The models are very intelligent and capable, they are getting
better at a fast clip. I can cite measurable and impressive
progress over just the past five months on specific types of
problem I’ve asked them to look at. If there’s a ceiling out
there, I don’t yet see evidence of it."
Pr. Matthew Green, Cryptographer, Johns Hopkins University
14
15
OnceUponaTime...
2nd Congress of Mathematicians (Paris, 1900):
- 23 Problems (Lie algera, Zeros of the Riemann's Zeta
function, axiomatization of Physics...)
- Secret goal : Axiomatization of all branches of Mathematics
- Then deduce all possible theorems from those axioms
David Hilbert
HILBERT, David. Mathematische probleme. Nachrichten von der Koniglichen Gesellschaft der
Wissenschaften zu Gottingen, 1900.
16
Andthen...Gödelidentifieda"bug-class"…inMathematics!!
- First incompleteness theorem:
"Any consistent formal system F within which a certain
amount of elementary arithmetic can be carried out is
incomplete; i.e. there are statements of the language
of F which can neither be proved nor disproved in F."
(Raatikainen 2020)
- Second incompleteness theorem:
"If a mathematical system is powerful enough to express
regular arithmetic, it cannot use its own rules to
demonstrate that it is free from contradictions."
Kurt Gödel
GÖDEL, Kurt. On formally undecidable propositions of principia mathematica and related systems i 1 (1931).
In : Godel's Theorem in Focus. Routledge, 2012. p. 17-47.​
17
Algorithmicequivalents
PhD thesis (1953): Henry Gordon Rice
Any nontrivial semantic property about the language recognized by a
Turing machine is undecidable.
Corollary:
- Deciding if a piece of software contains malware is undecidable
- Deciding if a piece of software contains vulnerabilities is undecidable
RICE, Henry Gordon. Classes of recursively enumerable sets and their decision problems. Transactions
of the American Mathematical society, 1953, vol. 74, no 2, p. 358-366.
JudgementDay
Avarice
18
19
CandidTake
"There are many opportunities at the
intersections with different disciplines, and I
would say that’s where there is the most to
be found. It is also where there is the most
value to build, because we talk a lot about
artificial intelligence for health, artificial
intelligence for the climate—in a way, it's a
bit of greenwashing at this stage, because
today artificial intelligence mostly serves to
generate hype[*]." - January 14 2026
Arthur Mensch
https://youtu.be/boIiMLR37kA?si=jf9WSLuUmZgQzpjw&t=542
[*] "Ca sert surtout à faire de la Publicité"
20
"Extraordinary claims require extraordinary evidence"
Carl Sagan
21
ExtraordinaryClaimsrequireExtraordinaryEvidence–CarlSagan
Sam Altman
"We can build AGI. We can colonize space. We
can get fusion to work and solar to mass scale.
We can cure all human disease. We can build
new realities. We are only a few breakthroughs
away from abundance at a scale that is difficult
to imagine." - 4th of February 2026​
​
22
"In so far as a scientific statement speaks about reality, it must be
falsifiable: and in so far as it is not falsifiable, it does not speak about
reality."
Karl Popper
23
(If)itisnotFalsifiable,itdoesnotSpeakaboutReality–KarlPopper
"We are now, like, in the Singularity" - 25th of July 2026
Sam Altman
24
"Quod gratis asseritur, gratis negatur"
(What is asserted without proof can be refuted without proof)
Hitchens's Razor
25
Quodgratisasseritur,gratisnegatur–Hitchens'Razor
"In a review of our cybersecurity evaluation transcripts,
we found three incidents in which a Claude model
reached the internet from within or while interacting
with a third-party evaluation environment, and then
gained unauthorized access to the real systems of three
different organizations." - 30th of July 2026 Anthropic
26
"Pluralitas non est ponenda sine necessitate"
(The simplest explanation is usually true)
Occam's Razor
27
Thesimplestexplanationisusuallytrue–Occam'sRazor
On living in a Simulation:
"So then what are the odds that we're actually in base
reality? It's one in billions." - June 1st 2016
Why not nested Simulations ? A Simulation within a
Simulation within a Simulation ?
Elon Musk
Let'sDoSomeScienceinsteadofReligion
Hardcore Science
28
29
Let's build a C Program implementing a Problem that
a LLM (or any Static Analyzer)
will Provably NEVER be able to solve...
ExploitingaFundamental"Bug"inMathematics!!
30
ShowmeaCProgramthathasan
UndecidableSecurityProperty!
ExploitingaFundamental"Bug"inMathematics!!
TowardsaformalProofoftheRiceTheorem
Envy
31
32
TowardsaFormalProofinConstructivistTheory
ZFC set theory
Formal Proof : Lean or Rocq
Constructivist : No reductio ad absurdum
Correspondance Howard-Curry:
"There exists an isomorphism between
Algorithms and Mathematical Proofs"
33
The10thHilbertProblem(DiophantineEquations)isProvedUndecidable
whendegreeis≥3(MRDPwithaConstructiveProofinRocq)
Matiyasevich, Yuri Vladimirovich. "The Diophantineness of enumerable
sets." In Doklady Akademii Nauk, vol. 191, no. 2, pp. 279-282.
Russian Academy of Sciences, 1970.
Larchey-Wendling, D. and Forster, Y., 2022. Hilbert's Tenth
Problem in Coq (Extended Version). Logical Methods in
Computer Science, 18.
34
The10thHilbertProblem(DiophantineEquations)isProvedUndecidable
withadegree≥3
Given c in ℤ, find {x,y,z} in ℤ³ such that:
x³ + y³ + z³ = c
35
AConstructiveProofofRice'sTheoremandtheHaltingProblemviaHilbert's10th
Problem
Fully constructive Proof
34 Pages Proof in Rocq
Halting Point is a Corollary
Paper: https://arxiv.org/abs/2604.16477
Code: https://github.com/endrazine/rice-
constructive
36
AConstructiveProofofRice'sTheoremandtheHaltingProblemviaHilbert's10th
Problem (* ================================================================ *)
(* 1. DIOPHANTINE INFRASTRUCTURE (k-ary Cantor encoding) *)
(* ================================================================ *)
Definition Monomial := (Z * list nat)%type.
Definition Poly := list Monomial.
Fixpoint pow (base exp : nat) : nat :=
match exp with
| O => 1%nat
| S e => (base * pow base e)%nat
end.
Definition eval_monomial (m : Monomial) (vars : list nat) : Z :=
let (coeff, exps) := m in
let term := fold_left
(fun acc p => (acc * Z.of_nat (pow (fst p) (snd p)))%Z)
(combine vars exps) 1%Z in
(coeff * term)%Z.
Definition eval_poly (p : Poly) (vars : list nat) : Z :=
fold_left (fun acc m => (acc + eval_monomial m vars)%Z) p 0%Z.
Definition cantor_w (n : nat) : nat :=
(Nat.sqrt (8 * n + 1) - 1) / 2.
Definition cantor_pair (a b : nat) := (a+b)*(a+b+1)/2 + b.
Definition cantor_unpair_fst (n : nat) : nat :=
let w := cantor_w n in
w - (n - w * (w + 1) / 2).
Excerpt of the Rocq proof.
Our Proof is 1911 lines long.
37
Consequence:ThefirstPrograminC,whoseterminationcannotbedeterminedbyaStatic
Analyzer(FormalProofinRocq)
https://raw.githubusercontent.com/endrazine/rice-
constructive/refs/heads/main/undecidable.c
38
OurfinalCProgram("theAIShowStopper:ExploitingabuginMathematics"):
undecidable.c
For each i in [0 ; 2⁶⁴ − 1], find {xᵢ,yᵢ,zᵢ} in ℤ³ such that:
xᵢ³ + yᵢ³ + zᵢ³ = i
The Question : Given a C program that bruteforces a
solution for each i, "will this algorithm stop ?"
is undecidable
39
𝕯𝕰𝕸𝕺
A Practical implementation of the "Halting Point" Problem in C,
based on the 10th Hilbert Problem
TheAISecurityPrayer(aka"SolvingSecurity"):BelievinginAI
If you believe in AI,
Clap your hands 👏👏
If you believe in Mythos,
Clap your hands 👏👏
If you believe in AI,
If you believe in Mythos,
And believe in AGI,
Clap your hands 👏👏
Buildingan-dayPipeline
Envy
41
42
ProvingExploitability:The"ReachabilityProblem"
Entry point
Vulnerable function
The "reachability problem" is
undecidable.
43
Re-FuzzingCVE-2023-2804:HeapBasedOverflowinLibjpeg-turbo
44
Re-FuzzingCVE-2023-2804:HeapBasedOverflowinLibjpeg-turbo
Tool Throughput First CVE crash Notes
AFL++ 728 exec/s 66 s Requires custom harness + seed corpus
AFLGo 7.96 exec/s 336 s Directed fuzzing; call-graph reachability undecidable
SymQEMU ~ 2 exec/s 25 min Binary-only concolic; 605 crashes after 1,530 s
Fuzzers + Dataset + PoC: https://doi.org/10.5281/zenodo.19136269
45
𝕯𝕰𝕸𝕺
46
@inproceedings{mei2026arvo,
title = {{ARVO}: Atlas of Reproducible
Vulnerabilities for Open-Source Software},
author = {Mei, Xiang and Del Castillo, Jordi
and Singh Singaria, Pulkit and Xi, Haoran and
Benchikh, Abdelouahab and Bao, Tiffany and
Wang, Ruoyu and Shoshitaishvili, Yan and
Doup'{e}, Adam and Pearce, Hammond and
Dolan-Gavitt, Brendan},
booktitle = {IEEE European Symposium on
Security and Privacy (EuroS&P)},
year = {2026}
}
@inproceedings{unprompted.au,
title = {Autonomous n-day pipeline},
author = {Valentina Palmiotti},
date = { September 2026},
}
Downstream from OSS-Fuzz
Near Future
Buildingan-dayspipeline:ThePractice
47
Buildingan-dayspipeline:aPipelineDownstreamfromOSS-Fuzz
OSS-Fuzz ARVO N-day Repo
Processing Processing
Pipeline Pipeline
Raw data: repro + metadata Docker reproducers, no CVEs Docker reproducers with CVEs
48
Buildingan-dayspipeline:ThePractice
49
Vulnerabilities:InformationEvanescence
Index Links Domain Comment
1 174,961 Github.com Live
2 165,340 SecurityFocus.com Bugtraq (⭐⭐⭐⭐⭐)
3 119,516 Secunia.com Redirect (dead)
4 78,497 Git.ketnel.org Live
5 74,800 Xforce.ibmcloud.com Live
6 59,513 Securitytracker.com Squatted
7 50,491 Vulndb.com Live
8 42,726 Opensuse.org Live
9 42,712 Osvdb.org Squatted
10 41,617 Vupen.com Squatted
Top 10 reference domains across all NVD CVEs
Buildinga0dayPipeline
Wrath
50
•EAL 1 — Functionally tested: basic
independent testing that the product works as
claimed.
•EAL 2 — Structurally tested: adds developer
testing, vulnerability analysis, and basic design
documentation.
•EAL 3 — Methodically tested and checked:
thorough testing with good commercial
development practices and tamper evidence.
•EAL 4 — Methodically designed, tested and
reviewed: the most common commercial level;
adds low-level design and implementation
review. Maximum realistic retrofit level.
•EAL 5 — Semiformally designed and tested:
requires semiformal design specification and
covert channel analysis; specialist techniques
needed.
•EAL 6 — Semiformally verified design and
tested: adds semiformal verification of the
implementation; very few products worldwide
reach this level.
•EAL 7 — Formally verified design and tested:
full mathematical proof of correctness
Not currently
accepted methods
of evaluation
LiftingtoLLVM
Lust
52
53
LiftingtoLLVMforBinaryTranslation
54
Lifters
55
Parsing .eh_frame and .eh_frame_hdr sections is enough to
find all the functions in a binary that are not added by the
compiler directly (id est: runtime object files).
0000036 c 1 c 00000370 FDE c i e =0 pc =7 e a 0 . . 7 e c 5
DW CFA advance loc : 5 t o 7 e a 5
D W C F A d e f c f a o f f s e t : 16
DW CFA offset : r 6 ( r b p ) a t c f a −16
DW CFA advance loc : 3 t o 7 e a 8
DW CFA def cfa register : r6 ( rbp )
DW CFA advance loc : 1 t o 7 e a 9
DW CFA offset : r 3 ( r b x ) a t c f a −24
56
57
58
59
Wsolver:aFull0dayPipeline
Glutony
60
61
What we'd like in terms of Semantic Analysis:
- Taint Analysis
- Abstract Interpretation
- Symbolic Execution
Scale to real world programs
Fully Automated (pipeline)
Input: Stripped binaries:
- no source code
- no debug sections
Wsolver:ProjectGoals(Find0daysinBinaries,Automatically)
62
ObtainingWorldClassSinks:APipelineDownstreamfromOSS-Fuzz
Targeting the world top software
OSS-Fuzz ARVO
Taint Analysis
Sinks
Processing Processing
Pipeline Pipeline
Raw data: repro + metadata ASAN/UBSAN Backtraces 10 years of sinks against
the internet top projects
covered by OSS-Fuzz
63
ObtainingWorldClassSinks:APipelineDownstreamfromOSS-Fuzz
Targeting the world top software
ClickHouse · FreeRDP · LibRaw · Little-CMS · MapServer · PcapPlusPlus · S2OPC · Simd · WasmEdge · aac · alembic · aom · arduinojson · arrow ·
aspell · assimp · astc-encoder · bind9 · binutils-gdb · binutils-preconditions · bitcoin-core · bloaty · boost · boringssl · botan · brunsli · c-ares · c-
blosc · c-blosc2 · capstonemaster · capstonenext · centipede · clamav · coturn · cpython3 · croaring · crow · cryptofuzz · cryptsetup · cups · curl ·
cyclonedds · dav1d · dnsmasq · dovecot · draco · dropbear · duckdb · e2fsprogs · edk2 · elfutils · envoy · espeak-ng · exiv2 · expat · extra-cmake-
modules · faad2 · ffmpeg · file · fio · flac · flatbuffers · fluent-bit · fmt · freeimage-svn · freeradius-server · freetype · freetype2 · fribidi · fuzzing ·
fwupd · gdal · gdbm · geos · ghostpdl · glaze · glib · glog · glslang · gnupg · gnutls · gpac · gpsd · graphicsmagick · grok · grpc · gstreamer · h2o · h3 ·
haproxy · harfbuzz · hdf5 · hermes · highway · hiredis · hoextdown · hostap · htslib · httpd · hunspell · icu · igraph · imagemagick · immer · inchi ·
irssi · janus-gateway · jbig2dec · jq · json · json-c · jsoncons · jsoncpp · kamailio · karchive · kimageformats · knot-dns · krb5 · lcms · leptonica ·
libarchive · libass · libavc · libavif · libbpf · libcoap · libconfig · libcups · libdwarf · libexif · libgd · libgit2 · libheif · libhevc · libical · libidn2 ·
libiec61850 · libjpeg-turbo · libjpeg-turbo.2.0.x · libjpeg-turbo.2.1.x · libjpeg-turbo.dev · libjpeg-turbo.main · libjxl · liblouis · libmpeg2 · libpcap ·
libplist · libpng · libprotobuf-mutator · libpsl · librabbitmq · libraw · librawspeed · libredwg · libreoffice · libsass · libsndfile · libspdm · libspectre ·
libspng · libsrtp · libssh · libssh2 · libteken · libtiff · libtpms · libucl · libultrahdr · libusb · libvips · libvpx · libwebp · libwebsockets · libxaac · libxml2 ·
libxslt · libyaml · libzip · libzmq · llama.cpp · lldpd · llvm-project · lua · lwan · lxc · lz4 · matio · mbedtls · mcl · md4c · mdbtools · miniz · moddable ·
mongoose · mosquitto · mpv · mruby · msquic · muparser · mupdf · nccl · ndpi · net-snmp · netcdf-c · nginx · ninja · njs · node · nss · ntopng ·
ntpsec · oatpp · oniguruma · open5gs · open62541 · openbabel · opencv · openexr · openh264 · openjpeg · opensc · opensips · openssl ·
openthread · openvswitch · opus · osquery · oss-fuzz-bloat · oss-fuzz-example · ostree · ots · p11-kit · pacemaker · pcl · pcre2 · perfetto · php-src ·
picotls · pjsip · poco · poppler · proj.4 · qemu · qpdf · qpid-proton · qt · qt/qtqa · qtbase · qtqa · quickjs · radare2 · rdkit · re2 · readstat · relic ·
resiprocate · rnp · rtpproxy · samba · selinux · serenity · simdjson · simdutf · skcms · skia · sleuthkit · speex · spice-usbredir · spirv-cross · stb · sudo ·
systemd · tarantool · tcmalloc · tesseract · tidy-html5 · tint · tinygltf · tinysparql · tinyusb · tinyxml2 · tmux · tor · tpm2 · trafficserver ·
uWebSockets · unicorn · unit · unrar · upx · uriparser · usrsctp · util-linux · valijson · vlc · vulkan-loader · wabt · wamr · wasm3 · wavpack · wget2 ·
wireshark · wolfmqtt · wolfssl · wpantund · wt · xz · yara · zeek · zlib · zstd
64
LLVM-BasedAnalyzers:Comparison(1/2)
Technique, output, soundness, solver backend, and origin
KLEE SeaHorn SMACK IKOS
Technique Dynamic symbolic execution Model checking (PDR/IC3) + abstract
interpretation
Bounded model checking (via
Boogie/Corral)
Abstract interpretation
What it does Explores paths, generates concrete
crashing test inputs
Proves safety properties or produces
counterexamples
Translates LLVM IR → Boogie IVL,
dispatches to verifiers
Proves absence of runtime errors via
fixpoint computation
Bug classes Assertion violations, memory errors, div-
by-zero
Buffer/integer overflows, user assertions,
reachability
Assertions, memory safety, concurrency
bugs
Buffer/integer overflows, null derefs, div-
by-zero, uninit vars
Sound? No (path exploration, may miss bugs) Yes (over-approximation, may have false
positives)
Yes, bounded (modulo solver limits) Yes (over-approximation, may have false
positives)
Solver backend STP, Z3 Spacer (PDR) + Z3, CRAB for numerical
invariants
Boogie → Corral → Z3 Built-in abstract domains (intervals,
octagons, Patricia trees)
Origin Stanford, 2008 CMU / Waterloo, 2015 University of Utah, 2014 NASA Ames, 2014
65
LLVM-BasedAnalyzers:Comparison(2/2)
Strengths, weaknesses, license, and LLVM version in wsolver Docker image
KLEE SeaHorn SMACK IKOS
Strengths Generates real exploitable inputs; fuzzing-
like exploration at LLVM level
Interprocedural summaries; loop invariant
synthesis; can prove termination
Language-agnostic (C/C++/Rust/Go via
LLVM); handles concurrency; scales to 100
KLOC
Scalable; NASA-grade; DO-178C / DO-333
pedigree; fast on large codebases
Weaknesses Path explosion on large programs; no loop
invariant synthesis; needs environment
models
Research tool, not out-of-the-box; limited
community docs
Depends on Boogie+Corral stack; bounded
= may miss deep bugs
High false-positive rate without tuning;
limited to numerical properties; no test
generation
License UIUC / NCSA Modified BSD MIT NASA Open Source Agreement 1.3
LLVM version 13 (klee:3.0) 10 (seahorn-llvm10:nightly) 11 (smack:stable) 14 (hard requirement)
SV-COMP Yes (competitor) Yes (competitor) Yes (competitor) No
66
Lifter→Analyzer:LLVMBytecodeCompatibility
The wsolver Docker image ships 4 LLVM versions (10, 11, 13, 14) because no two analyzers agree.
✓ native match ↓ downgrade (llvm-dis/llvm-as round-trip) ⚠ needs conversion (opaque pointer break)
Key challenge: LLVM 15 introduced opaque pointers (ptr replacing i8*, i32*), mandatory in LLVM 16. Bitcode from pre-15 and post-15 tools is
not directly interchangeable. wsolver works around this with per-tool llvm-dis/llvm-as and text-IR normalization.
Lifter Output LLVM KLEE (13) SeaHorn (10) SMACK (11) IKOS (14)
Anvill 14 ↓ downgrade ↓ downgrade ↓ downgrade ✓ native match
Rev.ng 16 ↓ downgrade ↓ downgrade ↓ downgrade ↓ downgrade
RetDec bundled (~15) ⚠ needs conversion ⚠ needs conversion ⚠ needs conversion ⚠ needs conversion
67
Unstripping (wunstrip)
+ Control Flow Graph
(Ghidra)
+ Lifting
(Anvill/Retdec/REv.ng)
Intra-procedural
Analysis
Inter-procedural
Analysis
+
Triage/Priorization
Pre-Processing Analysis Triage
68
Attempt to lift to LLVM using all the Lifters
(Anvill/Retdec/Rev.ng)
Attempt all the Analyzers on all the LLVM
outputs
Preliminrary triage thanks to Ghidra CFG
(no sinks = no bug)
LLM triage : interprocedural (parametrable
depfth), optional
LLM triage : local (no information leak), or
remote (parametrable, using OAI REST API v1)
Wsolver:DesignDecisions
{
{
wsolve
wllm.py
69
𝕯𝕰𝕸𝕺
Wsolver:FutureWork
Glutony
70
71
FutureWork:IntegrationwithVellvm(TowardsFormalProofs)
Formal Prover
Unstripping (wunstrip)
+ Control Flow Graph
(Ghidra)
+ Lifting
(Anvill/Retdec/REv.ng)
Intra-procedural
Analysis
Inter-procedural
Analysis
+
Triage/Priorization
Pre-Processing Analysis Triage
Vellvm
Verified
LLVM IR
Using Rocq
https://github.com/vellvm/vellvm
University of Pennsylvania/INRIA
PerformingaResurrection
Sloth
72
73
Vulnerabilities:InformationEvanescence
Index Links Domain Comment
1 174,961 Github.com Live
2 165,340 SecurityFocus.com Bugtraq (⭐⭐⭐⭐⭐)
3 119,516 Secunia.com Redirect (dead)
4 78,497 Git.ketnel.org Live
5 74,800 Xforce.ibmcloud.com Live
6 59,513 Securitytracker.com Squatted
7 50,491 Vulndb.com Live
8 42,726 Opensuse.org Live
9 42,712 Osvdb.org Squatted
10 41,617 Vupen.com Squatted
Top 10 reference domains across all NVD CVEs
74
RisefromtheDeads
75
Vulnerabilities:InformationEvanescence
jonathan@blackbox:~$ whois securityfocus.com
…
The Registry database contains ONLY .COM, .NET, .EDU domains and
Registrars.
Domain Name: securityfocus.com
Registry Domain ID: 5068534_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.brandsight.com
Registrar URL: https://gcd.com
Updated Date: 2025-12-30T15:26:27Z
Creation Date: 1999-01-30T05:00:00Z
Registrar Registration Expiration Date: 2027-01-30T05:00:00Z
Registrar: GoDaddy Corporate Domains, LLC
Registrar IANA ID: 3786
Registrar Abuse Contact Email: abuse@gcd.com
Registrar Abuse Contact Phone: +1.5188315864
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Registrant Organization: Accenture Global Services Limited
Registrant State/Province: IE
Registrant Country: IE
…
jonathan@blackbox:~$
76
TheResurrection
77
TheResurrection
78
TheResurrection
MAILING LISTS
BUGTRAQ
BUGTRAQ@SECURITYFOCUS.COM
CURATED VULNERABILITY DISCLOSURE AND SECURITY ADVISORY MAILING LIST. ALL
TARGETS — PROPRIETARY, OPEN SOURCE, HARDWARE, FIRMWARE, EMBEDDED.
MODERATED FOR QUALITY. THE CONTINUATION OF THE ORIGINAL BUGTRAQ.
BUGTRAQ AI
BUGTRAQ@BUGTRAQ.AI
VULNERABILITY DISCLOSURES AND SECURITY RESEARCH FOCUSED ON AI/ML
SYSTEMS — MODEL EXPLOITS, INFERENCE ATTACKS, TRAINING DATA POISONING,
FRAMEWORK VULNERABILITIES, AND ADVERSARIAL MACHINE LEARNING.
0=1
A Formal Proof
79
80
𝕯𝕰𝕸𝕺
81
0=1:AFormalProofinLean
Lean 4 kernel vulnerability: allows to prove anything
First instance: https://github.com/xrchz/CollatzLean/
published as a "maths joke"...
This PoC: https://github.com/endrazine/lean-cve-poc
Temporary Vulnerability Identifier :
https://www.cve.org/cverecord?id=CAN-2026-
2035078
Perfect material for bugtraq@bugtraq.ai
Conclusion
Contributions
82
83
Contributions
- An upper limit to what AI can do
- A constructivist formal proof of the Rice theorem
- A C program (undecidable.c) that cannot be analyzed by static analyzers
- Heuristics to detect marketing in AI claims
- A new release of the Witchcraft Compiler Collection Framework (WCC)
- A methodology to fully find bounds of functions in ELF files using .eh_frame
and .eh_frame_hdr exception handling structures
- A benchmark of binary lifters to LLVM
- A Comparison of fuzzers to trigger CVE-2023-2804 (first public PoC)
- A methodology to perform binary translation in 2026
- An overview of a N-day exploits pipeline downstream from OSS-Fuzz using
ARVO
- An open-source tool (wsolver) to perform taint analysis, abstract
interpretation, symbolic execution on stripped binaries automatically
- A sink file downstream from OSS-Fuzz using ARVO
- A PoC for Lean (first Lean CVE requested)
- We resurected Bugtraq and SecurityFocus.com
84
Thanksforyourattention
85
Illustrations&Copyrights
Cover Page: Giomodica, Creative Commons Attribution
3.0 Unported license, https://web.archive.org/web/20161011041054/http://www.panoramio.com/photo/5820740
Logo: By Unknown author, CC BY-SA 4.0, https://commons.wikimedia.org/w/index.php?curid=69056451
Sad Gargoyle: WDWParksGal, Creative Commons Attribution 3.0 LicenseCreative Commons Attribution 3.0 License,
https://www.deviantart.com/wdwparksgal-stock/art/Gargoyle-Stock-Photo-IMG-1734-640555082
David Hilbert: Unknown Author, Public Domain, https://commons.wikimedia.org/wiki/File:Hilbert.jpg
Kurt Godel: Unknown Author, Public Domain,
https://commons.wikimedia.org/wiki/File:Young_Kurt_G%C3%B6del_as_a_student_in_1925.jpg
Clown: Linnaea Mallette, CC0 Public Domain, https://www.publicdomainpictures.net/en/view-
image.php?image=449753&picture=clown-zombie-face-and-teeth
Judgement Day: Nano Banana 2, Free to use with a backlink to Easy-Peasy.AI, https://easy-peasy.ai/ai-image-
generator/images/biblical-engraving-judgement-day-diverse-celestial-chaos
Arthur Mensch: Ecole polytechnique / Institut Polytechnique de Paris / Jérémy Barande, CC BY-NC-ND 4.0,
https://www.flickr.com/photos/117994717@N06/55061790354