Internship Projects
“Unstripping” binaries: Restoring debugging information in GDB with Pwndbg
By Jason An GDB loses significant functionality when debugging binaries that lack debugging symbols (also known as “stripped binaries”). Function and variable names become meaningless addresses; setting breakpoints requires tracking down relevant ...
Using benchmarks to speed up Echidna
By Ben Siraphob During my time as a Trail of Bits associate last summer, I worked on optimizing the performance of Echidna, Trail of Bits’ open-source smart contract fuzzer, written in Haskell ...
Catching OpenSSL misuse using CodeQL
By Damien Santiago I’ve created five CodeQL queries that catch potentially potent bugs in the OpenSSL libcrypto API, a widely adopted but often unforgiving API that can be misused to cause memory ...
Summer associates 2023 recap
This past summer at Trail of Bits was a season of inspiration, innovation, and growth thanks to the incredible contributions of our talented associates, who took on a diverse range of technical ...
A Winter’s Tale: Improving messages and types in GDB’s Python API
By Matheus Branco Borella, University of São Paulo As a winter associate at Trail of Bits, my goal was to make two improvements to the GNU Project Debugger (GDB): make it run ...
Harnessing the eBPF Verifier
By Laura Bauman During my internship at Trail of Bits, I prototyped a harness that improves the testability of the eBPF verifier, simplifying the testing of eBPF programs. My eBPF harness runs ...
Keeping the wolves out of wolfSSL
By Max Ammann Trail of Bits is publicly disclosing four vulnerabilities that affect wolfSSL: CVE-2022-38152, CVE-2022-38153, CVE-2022-39173, and CVE-2022-42905. The four issues, which have CVSS scores ranging from medium to critical, can ...
Look out! Divergent representations are everywhere!
By Andreas Kellas Trail of Bits recently published a blog post about a signed integer overflow in certain versions of SQLite that can enable arbitrary code execution and result in a denial ...
Stranger Strings: An exploitable flaw in SQLite
By Andreas Kellas Trail of Bits is publicly disclosing CVE-2022-35737, which affects applications that use the SQLite library API. CVE-2022-35737 was introduced in SQLite version 1.0.12 (released on October 17, 2000) and ...
Porting the Solana eBPF JIT compiler to ARM64
By Andrew Haberlandt During my summer internship at Trail of Bits, I worked on the fork of the RBPF JIT compiler that is used to execute Solana smart contracts. The RBPF JIT ...
