Trail of Bits

Set up OSS-Fuzz for an open-source project and test it locally. Prepare configuration and build files, run fuzz tests that probe code with varied inputs, reproduce reported crashes, and inspect which code the tests reach.

中文简介正在准备中。当前显示英语简介。

• Preparing an open-source project for OSS-Fuzz enrollment
• Testing an OSS-Fuzz build locally before submission
• Reproducing crashes from OSS-Fuzz reports

Builds and improves C/C++ and Rust fuzzing harnesses, the entry points that feed generated test data into code. Helps structure inputs, reach more code paths, and address crashes caused by inconsistent test behavior.

中文简介正在准备中。当前显示英语简介。

• Writing a first fuzzing harness
• Building structured inputs for an API
• Investigating crashes that cannot be reproduced

Checks cryptographic code against known attacks and edge cases using Project Wycheproof test vectors, predefined inputs and expected results. Helps load cases, interpret failures, compare implementations, and integrate checks into automated testing.

中文简介正在准备中。当前显示英语简介。

• Testing cryptographic code against known attacks
• Comparing results across cryptographic libraries
• Investigating rejected or incorrectly accepted signatures

Evaluate vulnerability reports using seven practical criteria, including attacker capabilities, real usage, documented behavior, and remediation costs. Produce a reasoned decision to accept, dismiss, or request more evidence before committing to deeper investigation.

中文简介正在准备中。当前显示英语简介。

• Screening AI-generated security findings before human review
• Assessing whether a reported CVE warrants investigation
• Reviewing bug bounty submissions

Generates cryptographic test vectors, inputs with expected outcomes, by deliberately changing implementation code and finding changes existing tests miss. Verifies new vectors across independent implementations and compares detection rates before and after adding them.

中文简介正在准备中。当前显示英语简介。

• Finding coverage gaps in cryptographic test vectors
• Creating invalid inputs that exercise validation checks
• Building test vectors shared across independent implementations

Build a custom fuzzer, a tool that tests code with many generated inputs, using LibAFL in Rust. Combine input mutation, execution feedback, scheduling, and target execution components when standard fuzzers offer insufficient control.

中文简介正在准备中。当前显示英语简介。

• Build a fuzzer for a nonstandard target or architecture
• Implement custom input mutation and feedback strategies
• Prototype a new fuzzing research technique

Sets up AFL++ to test C/C++ programs with varied generated inputs, a technique called fuzzing. Covers running tests across CPU cores, monitoring progress, reducing input collections, and reproducing crashes for investigation.

中文简介正在准备中。当前显示英语简介。

• Running C/C++ fuzzing across multiple CPU cores
• Exploring further after libFuzzer progress stalls
• Monitoring fuzzing progress and stability

Test cryptographic code for timing side channels, where execution time can reveal secrets. Use dudect to detect statistical differences and Timecop with Valgrind to trace secret-dependent operations, then interpret results and retest changes.

中文简介正在准备中。当前显示英语简介。

• Checking cryptographic functions for secret-dependent timing
• Measuring timing differences in compiled binaries
• Tracing the cause of a suspected timing leak

Turn cryptographic code or specifications into sequence diagrams showing who sends each message, which cryptographic operations occur, and where failures stop the exchange. Outputs include Mermaid source, a plain text diagram, and a protocol summary.

中文简介正在准备中。当前显示英语简介。

• Visualizing handshake and key exchange steps
• Extracting message flows from RFCs and papers
• Diagramming ProVerif or Tamarin models

Identify checks and changing global state that block fuzzing, then adjust them in fuzzing builds. The skill covers targeted validation bypasses, repeatable behavior, coverage comparisons, and checks for false crash reports introduced by patches.

中文简介正在准备中。当前显示英语简介。

• Getting past checksum or hash checks during fuzzing
• Making time-seeded random behavior repeatable
• Comparing code coverage before and after a patch

Audit C/C++ and Rust code for secrets left in memory. It checks missing or incomplete wipes, examines compiler output for removed cleanup operations, and produces reports with evidence and suggested fixes.

中文简介正在准备中。当前显示英语简介。

• Auditing cryptographic key cleanup
• Checking password and token memory wipes
• Investigating cleanup removed by compiler optimization

Compares code relationships before and after a branch, pull request, or release change using Trailmark. Flags structural security regressions, such as removed authorization checks or newly reachable sensitive operations, and provides evidence for reviewers.

中文简介正在准备中。当前显示英语简介。

• Checking structural security changes before merging a PR
• Reviewing call paths after a security fix
• Assessing attack surface changes in a release

Assess a single suspected security issue using Trailmark's graph of code relationships. Gather evidence about reachable paths, input flow, and potential impact, then receive a priority verdict and a list of remaining manual checks.

中文简介正在准备中。当前显示英语简介。

• Prioritizing a static analysis finding before proof-of-concept work
• Checking whether entry points can reach a suspicious function
• Preparing code evidence for exploit validation

Set up libFuzzer to test C/C++ code with varied inputs guided by which code paths run. Build test harnesses, manage sample inputs and dictionaries, enable error detectors, and reproduce crashes or investigate stalled coverage.

中文简介正在准备中。当前显示英语简介。

• Starting fuzz testing for a C/C++ library
• Writing or debugging an LLVMFuzzerTestOneInput harness
• Investigating runs that find no crashes or new code paths

Compare code structure across two commits, tags, or directories to identify security-relevant changes. Produces a report on new attack paths, privilege boundaries, complexity, and how widely a change could affect other functions.

中文简介正在准备中。当前显示英语简介。

• Compare code structure before a release
• Investigate new attack paths after code changes
• Track untrusted data flows across a refactor

Select relevant code using Trailmark's map of function relationships, then delegate explanation, review, or edit proposals to a smaller model. Limit the supplied source, check cited evidence, and verify proposed changes before applying them.

中文简介正在准备中。当前显示英语简介。

• Asking a small model to explain a function
• Tracing callers and paths from entrypoints
• Requesting edit proposals for a specific line range

Turn Trail of Bits Testing Handbook content into Claude Code skills for security testing. Creates or refreshes SKILL.md files using templates for tools, fuzzers, techniques, and subject areas, then validates structure and links between skills.

中文简介正在准备中。当前显示英语简介。

• Generate security testing skills from handbook sections
• Refresh a skill after handbook updates
• Create multiple skills from handbook content

Helps set up and run cargo-fuzz for Rust projects using Cargo. Guides fuzz testing, which tries varied inputs, from writing test harnesses to detecting memory errors, reproducing crashes, and checking which code was exercised.

中文简介正在准备中。当前显示英语简介。

• Adding fuzz tests to a Rust crate
• Generating structured test inputs
• Testing unsafe blocks or foreign-function calls

Measure which code fuzzing reaches as it tries many generated inputs. Use coverage reports to find unreachable areas, compare progress, and guide improvements to test harnesses, starting inputs, or dictionaries of useful input values.

中文简介正在准备中。当前显示英语简介。

• Establish initial coverage for a fuzzing run
• Investigate why fuzzing stops reaching new code
• Compare coverage before and after harness changes

Create Mermaid diagrams from code relationships parsed by Trailmark. Visualize function calls, class inheritance, module dependencies, class members, complexity hotspots, and paths from inputs to sensitive functions, with adjustable focus, depth, and layout.

中文简介正在准备中。当前显示英语简介。

• Mapping function calls around a selected function
• Visualizing class inheritance and members
• Drawing module dependency maps

Analyze code structure with Trailmark to identify complex functions, trace input flow, assess impact across connected code, and locate privilege boundaries. The resulting JSON provides detailed evidence for deciding where to focus a code audit.

中文简介正在准备中。当前显示英语简介。

• Prioritizing code audit targets
• Tracing input flow and assessing impact
• Inspecting unresolved calls and type references

Guides fuzz testing for Ruby libraries and gems with Ruzzy, using varied inputs to find failures. Covers pure Ruby and C extensions, including test harnesses, memory error detection, environment setup, and crash reproduction.

中文简介正在准备中。当前显示英语简介。

• Adding fuzz tests to a Ruby library
• Testing memory safety in a gem's C extension
• Preparing tracer and harness scripts for pure Ruby

Process SARIF files, a standard format for static analysis results, to filter alerts, remove duplicates, combine findings from multiple tools, and produce reports. It also supports comparing runs and integrating result checks into CI/CD pipelines.

中文简介正在准备中。当前显示英语简介。

• Combine findings from multiple security scanners
• Filter alerts by severity and remove duplicates
• Compare earlier and current results for new issues

Review token contracts and the protocols that accept them for ERC20/ERC721 compliance, privileged controls, and unusual transfer behavior. Produces evidence-based risk assessments and prioritized fixes, with supply and holder analysis when deployed contract details are provided.

中文简介正在准备中。当前显示英语简介。

• Checking ERC20/ERC721 implementations against their standards
• Reviewing support for tokens with unusual transfer behavior
• Assessing administrator powers and upgrade risks