DPTrace: Dual Purpose Trace for Exploitability Analysis of Program Crashes
summary
DPTrace is a semi‑automated crash analysis framework that combines backward and forward taint to map input bytes that reach a faulting instruction and then prototype exploitability by allocating fake objects and continuing execution. Implementation is a WinDbg plugin that single‑steps instructions (traces up to 10 million instructions, e.g. 5 hours in a VM) and uses VirtualAllocEx/VirtualProtect to inject controllable object chains. Worked on real bugs (libtiff in Adobe PDF, IE CVEs) and finds exploitable primitives but remains slow, x86‑centric and requires an analyst to guide constraints. Source is published on GitHub.
AI-written summary · about
chapters (16)
- 0:00Intro
- 1:04Agenda
- 1:54Objectives
- 3:00Current State of Affairs
- 3:59Taint Analysis for Program Crashes
- 5:35History and Lore
- 10:36State Transition for Memory Corruption
- 13:51Backward Taint Analysis
- 14:37Forward Taint Analysis
- 16:36Fake Memory Structure Sample
- 17:18Implementation Details
- 21:34Sample Analysis on dead bugs
- 22:35Sample Analysis 1
- 25:36Sample Analysis 2
- 33:03Sample Analysis 3
- 39:58Challenges & Limitations
related talks
28mPostmortem Program Analysis with Hardware-Enhanced Post-Crash Artifacts
24mTriaging Crashed With Backward Taint Analysis For Arm Architecture
34mTracing: The Bane of You Security Folks
45mTrace to Triage: How to Connect Product Vulnerabilities to Security Paths
16mHardTaint: Production-Run Dynamic Taint Analysis via Selective Hardware Tracing
46mFor The Win: The Art Of The Windows Kernel Fuzzing
17mDebuggers from scratch
37mDynamic tracing within a busybox environment