Trail of Bits

Compare code structure across two commits, tags, or directories to identify security-relevant changes. Produces a report on new attack paths, privilege boundaries, complexity, and how widely a change could affect other functions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Compare code structure before a release
• Investigate new attack paths after code changes
• Track untrusted data flows across a refactor

Writes and reviews Lean 4 proofs, machine-checked arguments for mathematics or specifications. Follows Mathlib conventions to organize definitions and lemmas, fill proof gaps, refactor lengthy proofs, and establish automated checks for unproved claims and style.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Formalizing mathematics or specifications in Lean 4
• Filling sorry placeholders in proofs
• Splitting long proofs into reusable lemmas

Write and review YARA-X rules, which identify malware through file patterns. Refine detection strings and conditions, check rule quality with included scripts, test against clean files, improve performance, and migrate rules from legacy YARA.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Write rules targeting a specific malware family
• Review false positives and slow detection rules
• Migrate existing YARA rules to YARA-X

Create Mermaid diagrams from code relationships parsed by Trailmark. Visualize function calls, class inheritance, module dependencies, class members, complexity hotspots, and paths from inputs to sensitive functions, with adjustable focus, depth, and layout.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping function calls around a selected function
• Visualizing class inheritance and members
• Drawing module dependency maps

Build a custom fuzzer, a tool that tests code with many generated inputs, using LibAFL in Rust. Combine input mutation, execution feedback, scheduling, and target execution components when standard fuzzers offer insufficient control.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Build a fuzzer for a nonstandard target or architecture
• Implement custom input mutation and feedback strategies
• Prototype a new fuzzing research technique

Set up Atheris to test Python code and C extensions with automatically varied inputs. It guides test harness creation, coverage tracking to explore more code, and AddressSanitizer setup for finding memory errors.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Fuzzing a Python package or parser
• Investigating memory corruption in Python C extensions
• Turning raw bytes into typed test arguments

Find other occurrences of a known bug across a codebase by tracing its root cause. Gradually broaden search patterns, assess matching candidates, assign severity, and document findings with rules to help prevent recurrence.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding similar issues after discovering a vulnerability
• Building CodeQL or Semgrep queries from a known bug
• Checking whether similar code shares the same root cause

Set up OSS-Fuzz for an open-source project and test it locally. Prepare configuration and build files, run fuzz tests that probe code with varied inputs, reproduce reported crashes, and inspect which code the tests reach.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing an open-source project for OSS-Fuzz enrollment
• Testing an OSS-Fuzz build locally before submission
• Reproducing crashes from OSS-Fuzz reports

Turn a Mermaid sequence diagram of a cryptographic protocol into a ProVerif model, a file for formal security checks. It includes queries for secrecy, authentication, replay resistance, and forward secrecy where applicable.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Converting a cryptographic protocol diagram into a .pv file
• Preparing session key secrecy checks
• Modeling authentication and replay resistance

Builds and improves C/C++ and Rust fuzzing harnesses, the entry points that feed generated test data into code. Helps structure inputs, reach more code paths, and address crashes caused by inconsistent test behavior.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Writing a first fuzzing harness
• Building structured inputs for an API
• Investigating crashes that cannot be reproduced

Measure which code fuzzing reaches as it tries many generated inputs. Use coverage reports to find unreachable areas, compare progress, and guide improvements to test harnesses, starting inputs, or dictionaries of useful input values.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Establish initial coverage for a fuzzing run
• Investigate why fuzzing stops reaching new code
• Compare coverage before and after harness changes

Assess a single suspected security issue using Trailmark's graph of code relationships. Gather evidence about reachable paths, input flow, and potential impact, then receive a priority verdict and a list of remaining manual checks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Prioritizing a static analysis finding before proof-of-concept work
• Checking whether entry points can reach a suspicious function
• Preparing code evidence for exploit validation

Analyze code structure with Trailmark to identify complex functions, trace input flow, assess impact across connected code, and locate privilege boundaries. The resulting JSON provides detailed evidence for deciding where to focus a code audit.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Prioritizing code audit targets
• Tracing input flow and assessing impact
• Inspecting unresolved calls and type references

Turn Trail of Bits Testing Handbook content into Claude Code skills for security testing. Creates or refreshes SKILL.md files using templates for tools, fuzzers, techniques, and subject areas, then validates structure and links between skills.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Generate security testing skills from handbook sections
• Refresh a skill after handbook updates
• Create multiple skills from handbook content

Set up libFuzzer to test C/C++ code with varied inputs guided by which code paths run. Build test harnesses, manage sample inputs and dictionaries, enable error detectors, and reproduce crashes or investigate stalled coverage.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Starting fuzz testing for a C/C++ library
• Writing or debugging an LLVMFuzzerTestOneInput harness
• Investigating runs that find no crashes or new code paths

Helps set up and run cargo-fuzz for Rust projects using Cargo. Guides fuzz testing, which tries varied inputs, from writing test harnesses to detecting memory errors, reproducing crashes, and checking which code was exercised.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Adding fuzz tests to a Rust crate
• Generating structured test inputs
• Testing unsafe blocks or foreign-function calls

Guides fuzz testing for Ruby libraries and gems with Ruzzy, using varied inputs to find failures. Covers pure Ruby and C extensions, including test harnesses, memory error detection, environment setup, and crash reproduction.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Adding fuzz tests to a Ruby library
• Testing memory safety in a gem's C extension
• Preparing tracer and harness scripts for pure Ruby

Build a graph of functions and calls across multiple programming languages to investigate entry points, paths to sensitive operations, and potential impact. Use the results to prioritize security reviews and connect external findings with source code.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing call paths from entry points to sensitive functions
• Prioritizing code for a security audit
• Connecting calls across language and RPC boundaries

Uses a known or suspected vulnerability to find related code through Trailmark's graph of calls, types, and implementations. Produces ranked review targets with reasons and limitations for follow-up security analysis.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding variants of a known vulnerability
• Prioritizing code that shares sensitive operations
• Preparing candidates for Semgrep or CodeQL review

Get a quick structural overview of a codebase with Trailmark. The skill identifies programming languages, counts entry points where execution begins, and returns dependency information to support orientation before deeper analysis.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Getting oriented in an unfamiliar codebase
• Checking languages and entry point counts before analysis
• Preparing a structural overview for Vivisect or Galvanize

Turn cryptographic code or specifications into sequence diagrams showing who sends each message, which cryptographic operations occur, and where failures stop the exchange. Outputs include Mermaid source, a plain text diagram, and a protocol summary.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Visualizing handshake and key exchange steps
• Extracting message flows from RFCs and papers
• Diagramming ProVerif or Tamarin models

Select relevant code using Trailmark's map of function relationships, then delegate explanation, review, or edit proposals to a smaller model. Limit the supplied source, check cited evidence, and verify proposed changes before applying them.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Asking a small model to explain a function
• Tracing callers and paths from entrypoints
• Requesting edit proposals for a specific line range

Inspects compiled instructions and bytecode to identify timing risks in cryptographic code. Helps trace flagged operations back to secret data, distinguish false positives, and review fixes across compiler settings and target architectures.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing signing and encryption routines
• Checking division involving secret values
• Inspecting authentication tag comparisons

Run repeated code reviews and fixes using an installed reviewer chosen by the user. The workflow tracks findings across rounds, checks that edits stay within scope, and reports whether blocking issues were resolved or further decisions are needed.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Repeat reviews and fixes for a module
• Improve code using a specific installed reviewer
• Keep automated edits within an agreed file scope