Witchcraft Solver Automated 0day Discovery in Stripped Binaries
Explore automated vulnerability discovery in stripped binaries, the undecidability of security problems, and the theoretical limits of AI through formal proofs and practical demonstrations at DEF CON 34.
11
WitchcraftCompiler:Unlinking+Relinking
# i nc l u d e < s t d i o . h>
# i n c l u d e < s t d l i b . h>
# i n c l u d e < u n i s t d . h>
# i n c l u d e < s t r i n g . h>
char * ap parse log level ( const char * str , int * val ) ;
i n t main ( i n t a r g c , c h a r ** a r g v ) {
i n t i = 0;
char * r e t = 0;
i f ( argc < 2) {
p r i n t f ( ” Usage : %s <l o g l e v e l >n ” , argv [ 0 ] ) ;
e x i t ( EXIT SUCCESS ) ;
}
r e t = a p p a r s e l o g l e v e l ( a r g v [ 1 ] , &i ) ;
if (! ret ) {
p r i n t f ( ” l o g l e v e l : %d n ” , i ) ;
} else {
p r i n t f (”% s n ” , r e t ) ;
}
return 0;
}
New Release, on the DEF CON website
"The models arevery intelligent and capable, they are getting
better at a fast clip. I can cite measurable and impressive
progress over just the past five months on specific types of
problem I’ve asked them to look at. If there’s a ceiling out
there, I don’t yet see evidence of it."
Pr. Matthew Green, Cryptographer, Johns Hopkins University
14
15.
15
OnceUponaTime...
2nd Congress ofMathematicians (Paris, 1900):
- 23 Problems (Lie algera, Zeros of the Riemann's Zeta
function, axiomatization of Physics...)
- Secret goal : Axiomatization of all branches of Mathematics
- Then deduce all possible theorems from those axioms
David Hilbert
HILBERT, David. Mathematische probleme. Nachrichten von der Koniglichen Gesellschaft der
Wissenschaften zu Gottingen, 1900.
16.
16
Andthen...Gödelidentifieda"bug-class"…inMathematics!!
- First incompletenesstheorem:
"Any consistent formal system F within which a certain
amount of elementary arithmetic can be carried out is
incomplete; i.e. there are statements of the language
of F which can neither be proved nor disproved in F."
(Raatikainen 2020)
- Second incompleteness theorem:
"If a mathematical system is powerful enough to express
regular arithmetic, it cannot use its own rules to
demonstrate that it is free from contradictions."
Kurt Gödel
GÖDEL, Kurt. On formally undecidable propositions of principia mathematica and related systems i 1 (1931).
In : Godel's Theorem in Focus. Routledge, 2012. p. 17-47.
17.
17
Algorithmicequivalents
PhD thesis (1953):Henry Gordon Rice
Any nontrivial semantic property about the language recognized by a
Turing machine is undecidable.
Corollary:
- Deciding if a piece of software contains malware is undecidable
- Deciding if a piece of software contains vulnerabilities is undecidable
RICE, Henry Gordon. Classes of recursively enumerable sets and their decision problems. Transactions
of the American Mathematical society, 1953, vol. 74, no 2, p. 358-366.
19
CandidTake
"There are manyopportunities at the
intersections with different disciplines, and I
would say that’s where there is the most to
be found. It is also where there is the most
value to build, because we talk a lot about
artificial intelligence for health, artificial
intelligence for the climate—in a way, it's a
bit of greenwashing at this stage, because
today artificial intelligence mostly serves to
generate hype[*]." - January 14 2026
Arthur Mensch
https://youtu.be/boIiMLR37kA?si=jf9WSLuUmZgQzpjw&t=542
[*] "Ca sert surtout à faire de la Publicité"
21
ExtraordinaryClaimsrequireExtraordinaryEvidence–CarlSagan
Sam Altman
"We canbuild AGI. We can colonize space. We
can get fusion to work and solar to mass scale.
We can cure all human disease. We can build
new realities. We are only a few breakthroughs
away from abundance at a scale that is difficult
to imagine." - 4th of February 2026
22.
22
"In so faras a scientific statement speaks about reality, it must be
falsifiable: and in so far as it is not falsifiable, it does not speak about
reality."
Karl Popper
24
"Quod gratis asseritur,gratis negatur"
(What is asserted without proof can be refuted without proof)
Hitchens's Razor
25.
25
Quodgratisasseritur,gratisnegatur–Hitchens'Razor
"In a reviewof our cybersecurity evaluation transcripts,
we found three incidents in which a Claude model
reached the internet from within or while interacting
with a third-party evaluation environment, and then
gained unauthorized access to the real systems of three
different organizations." - 30th of July 2026 Anthropic
26.
26
"Pluralitas non estponenda sine necessitate"
(The simplest explanation is usually true)
Occam's Razor
27.
27
Thesimplestexplanationisusuallytrue–Occam'sRazor
On living ina Simulation:
"So then what are the odds that we're actually in base
reality? It's one in billions." - June 1st 2016
Why not nested Simulations ? A Simulation within a
Simulation within a Simulation ?
Elon Musk
29
Let's build aC Program implementing a Problem that
a LLM (or any Static Analyzer)
will Provably NEVER be able to solve...
ExploitingaFundamental"Bug"inMathematics!!
36
AConstructiveProofofRice'sTheoremandtheHaltingProblemviaHilbert's10th
Problem (* ================================================================*)
(* 1. DIOPHANTINE INFRASTRUCTURE (k-ary Cantor encoding) *)
(* ================================================================ *)
Definition Monomial := (Z * list nat)%type.
Definition Poly := list Monomial.
Fixpoint pow (base exp : nat) : nat :=
match exp with
| O => 1%nat
| S e => (base * pow base e)%nat
end.
Definition eval_monomial (m : Monomial) (vars : list nat) : Z :=
let (coeff, exps) := m in
let term := fold_left
(fun acc p => (acc * Z.of_nat (pow (fst p) (snd p)))%Z)
(combine vars exps) 1%Z in
(coeff * term)%Z.
Definition eval_poly (p : Poly) (vars : list nat) : Z :=
fold_left (fun acc m => (acc + eval_monomial m vars)%Z) p 0%Z.
Definition cantor_w (n : nat) : nat :=
(Nat.sqrt (8 * n + 1) - 1) / 2.
Definition cantor_pair (a b : nat) := (a+b)*(a+b+1)/2 + b.
Definition cantor_unpair_fst (n : nat) : nat :=
let w := cantor_w n in
w - (n - w * (w + 1) / 2).
Excerpt of the Rocq proof.
Our Proof is 1911 lines long.
46
@inproceedings{mei2026arvo,
title = {{ARVO}:Atlas of Reproducible
Vulnerabilities for Open-Source Software},
author = {Mei, Xiang and Del Castillo, Jordi
and Singh Singaria, Pulkit and Xi, Haoran and
Benchikh, Abdelouahab and Bao, Tiffany and
Wang, Ruoyu and Shoshitaishvili, Yan and
Doup'{e}, Adam and Pearce, Hammond and
Dolan-Gavitt, Brendan},
booktitle = {IEEE European Symposium on
Security and Privacy (EuroS&P)},
year = {2026}
}
@inproceedings{unprompted.au,
title = {Autonomous n-day pipeline},
author = {Valentina Palmiotti},
date = { September 2026},
}
Downstream from OSS-Fuzz
Near Future
Buildingan-dayspipeline:ThePractice
•EAL 1 —Functionally tested: basic
independent testing that the product works as
claimed.
•EAL 2 — Structurally tested: adds developer
testing, vulnerability analysis, and basic design
documentation.
•EAL 3 — Methodically tested and checked:
thorough testing with good commercial
development practices and tamper evidence.
•EAL 4 — Methodically designed, tested and
reviewed: the most common commercial level;
adds low-level design and implementation
review. Maximum realistic retrofit level.
•EAL 5 — Semiformally designed and tested:
requires semiformal design specification and
covert channel analysis; specialist techniques
needed.
•EAL 6 — Semiformally verified design and
tested: adds semiformal verification of the
implementation; very few products worldwide
reach this level.
•EAL 7 — Formally verified design and tested:
full mathematical proof of correctness
Not currently
accepted methods
of evaluation
55
Parsing .eh_frame and.eh_frame_hdr sections is enough to
find all the functions in a binary that are not added by the
compiler directly (id est: runtime object files).
0000036 c 1 c 00000370 FDE c i e =0 pc =7 e a 0 . . 7 e c 5
DW CFA advance loc : 5 t o 7 e a 5
D W C F A d e f c f a o f f s e t : 16
DW CFA offset : r 6 ( r b p ) a t c f a −16
DW CFA advance loc : 3 t o 7 e a 8
DW CFA def cfa register : r6 ( rbp )
DW CFA advance loc : 1 t o 7 e a 9
DW CFA offset : r 3 ( r b x ) a t c f a −24
64
LLVM-BasedAnalyzers:Comparison(1/2)
Technique, output, soundness,solver backend, and origin
KLEE SeaHorn SMACK IKOS
Technique Dynamic symbolic execution Model checking (PDR/IC3) + abstract
interpretation
Bounded model checking (via
Boogie/Corral)
Abstract interpretation
What it does Explores paths, generates concrete
crashing test inputs
Proves safety properties or produces
counterexamples
Translates LLVM IR → Boogie IVL,
dispatches to verifiers
Proves absence of runtime errors via
fixpoint computation
Bug classes Assertion violations, memory errors, div-
by-zero
Buffer/integer overflows, user assertions,
reachability
Assertions, memory safety, concurrency
bugs
Buffer/integer overflows, null derefs, div-
by-zero, uninit vars
Sound? No (path exploration, may miss bugs) Yes (over-approximation, may have false
positives)
Yes, bounded (modulo solver limits) Yes (over-approximation, may have false
positives)
Solver backend STP, Z3 Spacer (PDR) + Z3, CRAB for numerical
invariants
Boogie → Corral → Z3 Built-in abstract domains (intervals,
octagons, Patricia trees)
Origin Stanford, 2008 CMU / Waterloo, 2015 University of Utah, 2014 NASA Ames, 2014
65.
65
LLVM-BasedAnalyzers:Comparison(2/2)
Strengths, weaknesses, license,and LLVM version in wsolver Docker image
KLEE SeaHorn SMACK IKOS
Strengths Generates real exploitable inputs; fuzzing-
like exploration at LLVM level
Interprocedural summaries; loop invariant
synthesis; can prove termination
Language-agnostic (C/C++/Rust/Go via
LLVM); handles concurrency; scales to 100
KLOC
Scalable; NASA-grade; DO-178C / DO-333
pedigree; fast on large codebases
Weaknesses Path explosion on large programs; no loop
invariant synthesis; needs environment
models
Research tool, not out-of-the-box; limited
community docs
Depends on Boogie+Corral stack; bounded
= may miss deep bugs
High false-positive rate without tuning;
limited to numerical properties; no test
generation
License UIUC / NCSA Modified BSD MIT NASA Open Source Agreement 1.3
LLVM version 13 (klee:3.0) 10 (seahorn-llvm10:nightly) 11 (smack:stable) 14 (hard requirement)
SV-COMP Yes (competitor) Yes (competitor) Yes (competitor) No
66.
66
Lifter→Analyzer:LLVMBytecodeCompatibility
The wsolver Dockerimage ships 4 LLVM versions (10, 11, 13, 14) because no two analyzers agree.
✓ native match ↓ downgrade (llvm-dis/llvm-as round-trip) ⚠ needs conversion (opaque pointer break)
Key challenge: LLVM 15 introduced opaque pointers (ptr replacing i8*, i32*), mandatory in LLVM 16. Bitcode from pre-15 and post-15 tools is
not directly interchangeable. wsolver works around this with per-tool llvm-dis/llvm-as and text-IR normalization.
Lifter Output LLVM KLEE (13) SeaHorn (10) SMACK (11) IKOS (14)
Anvill 14 ↓ downgrade ↓ downgrade ↓ downgrade ✓ native match
Rev.ng 16 ↓ downgrade ↓ downgrade ↓ downgrade ↓ downgrade
RetDec bundled (~15) ⚠ needs conversion ⚠ needs conversion ⚠ needs conversion ⚠ needs conversion
68
Attempt to liftto LLVM using all the Lifters
(Anvill/Retdec/Rev.ng)
Attempt all the Analyzers on all the LLVM
outputs
Preliminrary triage thanks to Ghidra CFG
(no sinks = no bug)
LLM triage : interprocedural (parametrable
depfth), optional
LLM triage : local (no information leak), or
remote (parametrable, using OAI REST API v1)
Wsolver:DesignDecisions
{
{
wsolve
wllm.py
78
TheResurrection
MAILING LISTS
BUGTRAQ
BUGTRAQ@SECURITYFOCUS.COM
CURATED VULNERABILITYDISCLOSURE AND SECURITY ADVISORY MAILING LIST. ALL
TARGETS — PROPRIETARY, OPEN SOURCE, HARDWARE, FIRMWARE, EMBEDDED.
MODERATED FOR QUALITY. THE CONTINUATION OF THE ORIGINAL BUGTRAQ.
BUGTRAQ AI
BUGTRAQ@BUGTRAQ.AI
VULNERABILITY DISCLOSURES AND SECURITY RESEARCH FOCUSED ON AI/ML
SYSTEMS — MODEL EXPLOITS, INFERENCE ATTACKS, TRAINING DATA POISONING,
FRAMEWORK VULNERABILITIES, AND ADVERSARIAL MACHINE LEARNING.
81
0=1:AFormalProofinLean
Lean 4 kernelvulnerability: allows to prove anything
First instance: https://github.com/xrchz/CollatzLean/
published as a "maths joke"...
This PoC: https://github.com/endrazine/lean-cve-poc
Temporary Vulnerability Identifier :
https://www.cve.org/cverecord?id=CAN-2026-
2035078
Perfect material for bugtraq@bugtraq.ai
83
Contributions
- An upperlimit to what AI can do
- A constructivist formal proof of the Rice theorem
- A C program (undecidable.c) that cannot be analyzed by static analyzers
- Heuristics to detect marketing in AI claims
- A new release of the Witchcraft Compiler Collection Framework (WCC)
- A methodology to fully find bounds of functions in ELF files using .eh_frame
and .eh_frame_hdr exception handling structures
- A benchmark of binary lifters to LLVM
- A Comparison of fuzzers to trigger CVE-2023-2804 (first public PoC)
- A methodology to perform binary translation in 2026
- An overview of a N-day exploits pipeline downstream from OSS-Fuzz using
ARVO
- An open-source tool (wsolver) to perform taint analysis, abstract
interpretation, symbolic execution on stripped binaries automatically
- A sink file downstream from OSS-Fuzz using ARVO
- A PoC for Lean (first Lean CVE requested)
- We resurected Bugtraq and SecurityFocus.com
85
Illustrations&Copyrights
Cover Page: Giomodica,Creative Commons Attribution
3.0 Unported license, https://web.archive.org/web/20161011041054/http://www.panoramio.com/photo/5820740
Logo: By Unknown author, CC BY-SA 4.0, https://commons.wikimedia.org/w/index.php?curid=69056451
Sad Gargoyle: WDWParksGal, Creative Commons Attribution 3.0 LicenseCreative Commons Attribution 3.0 License,
https://www.deviantart.com/wdwparksgal-stock/art/Gargoyle-Stock-Photo-IMG-1734-640555082
David Hilbert: Unknown Author, Public Domain, https://commons.wikimedia.org/wiki/File:Hilbert.jpg
Kurt Godel: Unknown Author, Public Domain,
https://commons.wikimedia.org/wiki/File:Young_Kurt_G%C3%B6del_as_a_student_in_1925.jpg
Clown: Linnaea Mallette, CC0 Public Domain, https://www.publicdomainpictures.net/en/view-
image.php?image=449753&picture=clown-zombie-face-and-teeth
Judgement Day: Nano Banana 2, Free to use with a backlink to Easy-Peasy.AI, https://easy-peasy.ai/ai-image-
generator/images/biblical-engraving-judgement-day-diverse-celestial-chaos
Arthur Mensch: Ecole polytechnique / Institut Polytechnique de Paris / Jérémy Barande, CC BY-NC-ND 4.0,
https://www.flickr.com/photos/117994717@N06/55061790354