Reverse Taint Analysis Using Binary Ninja

Summary: Trail of Bits open-sourced KRFAnalysis, a set of static analysis tools that triage output from its KRF syscall fault injection fuzzer, using a technique the author calls Reverse Taint Analysis implemented with the Binary Ninja API. The script traces tainted arguments backward through Static Single Assignment Medium Level IL to produce a short list of possible crash causes, and the repository also includes three LLVM passes for detecting time-of-check/time-of-use race conditions, unchecked standard library errors, and a reimplementation of reverse taint analysis.
Why it matters: KRF can fault hundreds of syscalls in a single run, and manually tracing which one caused a crash through source or disassembly is slow and error-prone - the tooling exists to cut that list down before an analyst spends hours on it.

Read the original at Trail of Bits Blog ↗