Beyond the bitmap
VULCAN reads C source code directly, reasons about dangerous data-flow patterns at the implementation level, and generates targeted inputs that find real vulnerabilities — without coverage instrumentation, SMT solvers, or symbolic state.
VULCAN requires no coverage instrumentation, no SMT solver, and no symbolic state. An LLM reasons about the code the way a human security researcher would.
C source files are split into per-function chunks with full context: signatures, callees, type definitions. For binary-only targets, Ghidra decompiles to pseudocode first.
The LLM traces data flow from user-controlled input fields to dangerous operations, recording the exact byte offset, data type, and triggering value range for each finding.
A Python mutation fuzzer is generated with a minimal valid seed and targeted mutation pools for each dangerous field. Only the targeted offsets are mutated.
Crash stack traces are fed back to the LLM for root cause analysis. All findings require ASAN or UBSan confirmation. False positives are retracted with documented reasoning.
A persistent store indexed by library name and version. When a new target includes a known library (ClipperLib, boost::filesystem, zlib), VULCAN retrieves prior patterns without re-analysis — reducing Phase 2 from 40 minutes to under 3 minutes on subsequent targets.
Three dominant paradigms all fail on real-world C codebases in documented ways. VULCAN addresses all three.
| Tool / approach | Reads source code | Works on crypto code | Targets specific fields | Core limitation |
|---|---|---|---|---|
| AFL++ / libFuzzer | No | Yes | No | Semantically blind — all bytes treated equally regardless of data-flow meaning |
| KLEE / angr | Yes | No | Yes | Path explosion and SMT solver timeouts on cryptographic constraints |
| ChatAFL | No | Yes | No | Protocol-level only — no visibility into the C implementation handling messages |
| VULCAN | Yes | Yes | Yes | No instrumentation, no solver, no symbolic state |
6 confirmed vulnerabilities across 8 targets. 4 retracted findings are documented with gate failure reasoning — all reported findings are ASAN confirmed.
Out-of-bounds memory access triggered via crafted media file. Assigned by MITRE.
Unhandled IEEE-754 special float values cause immediate crash on import. Unhandled function_clause exception in the Erlang OBJ parser.
Zero cryptographic verification before flashing firmware over USB. Attacker with physical access can permanently compromise affected devices across 12 USB Product IDs.
WAVE_FORMAT_EXTENSIBLE handler dereferences an uninitialized pointer when the fmt chunk is shorter than 22 bytes. Triggered in 12 iterations. Publicly disclosed at xiph.org GitLab.
User-controlled bitrate HTTP header feeds into burst_size arithmetic without overflow protection. Triggered with bitrate: 2147483647 in iteration 7.
CR/LF sequences within the job body are not sanitized, allowing injection of arbitrary commands into the protocol stream.
Crafted null byte in HTTP headers causes denial of service.
Both targets had undergone recent security rewrites — validating the target selection heuristic that old, unaudited C codebases yield results significantly faster than recently patched codebases.
Each pattern includes the source location, dangerous function, byte offset of the user-controlled field, and the triggering value range.
atoi() or strtol() result fed directly into malloc() or an array index without range validation. Classic heap overflow precursor.
strcpy() or sprintf() with a fixed destination buffer and a user-controlled source length. Destination overwrite if length exceeds buffer size.
Third-party library calls inside functions with no enclosing try/catch block where the library documentation indicates exception-throwing behavior.
Pointer initialized only on one branch of a conditional but dereferenced unconditionally after the branch. Format code dispatch is a common trigger.
CR/LF sequences in user-controlled string fields passed to network protocol parsers without sanitization, allowing command injection into the protocol stream.
Arithmetic on user-controlled values feeding allocation functions where overflow produces a smaller-than-expected allocation followed by an oversized write.
VULCAN: Beyond the Bitmap — LLM-Guided Semantic Mutation Fuzzing was accepted as a poster at ACM CODASPY 2026, Frankfurt am Main, Germany. The paper describes the full four-phase pipeline, Pattern Bank design, and preliminary evaluation results.
Request Paper DraftByteScan applies VULCAN as part of security audits for open-source C infrastructure, payment systems, and network daemons. All findings are responsibly disclosed before any public release.