# Vulnerability Audit

> Security audit — buffer overflows, format strings, integer issues, memory safety

- Skill: `buzzer-re/vulnerability-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add buzzer-re/vulnerability-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/buzzer-re/vulnerability-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: buzzer-re (https://skillmd.com/u/buzzer-re)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/buzzer-re/vulnerability-audit

---

Task: Security Vulnerability Audit. You are auditing a binary for exploitable vulnerabilities.

## Approach

Systematic, evidence-based. Every finding needs: location (address), root cause, impact assessment, and proof from the decompiled code.

## Phase 1: Attack Surface Mapping

1. `list_imports` — identify dangerous APIs:
   - **Memory**: memcpy, memmove, strcpy, strncpy, sprintf, vsprintf, gets
   - **Format strings**: printf, fprintf, syslog, snprintf with user-controlled format
   - **Heap**: malloc, free, realloc (use-after-free, double-free)
   - **File I/O**: fopen, CreateFile, read, write (path traversal)
   - **Network**: recv, recvfrom, WSARecv (remote input)
   - **Command**: system, popen, execve, ShellExecute (command injection)
2. `list_exports` — identify entry points accessible to attackers
3. `search_strings` — look for format strings, SQL patterns, command templates

## Phase 2: Input Tracing

For each dangerous API found:
1. `xrefs_to` on the import — find all call sites
2. `decompile_function` on each caller
3. Trace backwards: where does the buffer/size/format argument come from?
4. Is it user-controlled? (network input, file input, IPC, environment)
5. Are there bounds checks between input and dangerous API?

## Phase 3: Vulnerability Classes

**Buffer Overflow (Stack)**
- Fixed-size stack buffer + unbounded copy (strcpy, sprintf, gets)
- Size parameter larger than destination buffer
- Off-by-one in loop bounds writing to stack buffer

**Buffer Overflow (Heap)**
- malloc(user_size) without upper bound check
- memcpy into heap buffer with unchecked length
- Integer overflow in size calculation → small allocation, large copy

**Format String**
- printf(user_input) without format specifier
- syslog, fprintf with attacker-controlled first argument

**Integer Overflow/Underflow**
- Arithmetic on user-controlled sizes before allocation
- Signed/unsigned comparison mismatches in bounds checks
- Multiplication overflow in array index calculations

**Use-After-Free**
- free() followed by continued use of the pointer
- Dangling pointers in linked structures after partial cleanup
- Race conditions in multi-threaded free/use paths

**Command Injection**
- system() / popen() with string concatenation from user input
- ShellExecute with user-controlled arguments

**Type Confusion**
- Cast between incompatible struct types
- Virtual function table corruption paths
- Union member access after wrong variant initialization

## Phase 4: Report

For each finding:
```
[SEVERITY] Vulnerability Type at 0xADDRESS
Function: function_name
Root cause: <description>
Input path: <how attacker-controlled data reaches the vulnerable point>
Impact: <what an attacker can achieve>
Evidence: <relevant decompiled code snippet>
```

Severity levels: CRITICAL (remote code execution), HIGH (local code execution, info leak), MEDIUM (DoS, limited info leak), LOW (theoretical, requires unlikely conditions).