Toward Partial Proofs of Vulnerabilities

With the adoption of compelling legislation regulating Product Security, quickly replicating or disproving the presence of publicly known vulnerabilities is becoming an essential part of the software life cycle. Moreover, third-party code is often integrated and shipped in binary form rather than source code. In this article, we present an original debugger named the Witchcraft Shell (WSH), aiming at helping software maintainers validate the existence of public vulnerabilities when source code is unavailable. By making C/C++ dynamically linked ELF executables scriptable and their internal functions callable with no or little context, we open the way to new heuristics: "partial proofs of vulnerabilities". This tool is published under a permissive dual BSD/MIT open-source license.