ai-memory-corruption-scanner

AI Memory Corruption Scanner

Purpose

Find exploitable memory corruption vulnerabilities in Windows PE binaries using LLM-driven code analysis instead of regex pattern matching. The scanner builds a cross-module callgraph from attacker-reachable entry points, classifies every node (MUST_READ / KNOWN_API / TELEMETRY / LIBRARY), and delivers code to the AI agent in depth-level batches. The agent analyzes each batch, returns taint-guided requests for deeper functions, and the coordinator batch-fetches the next level -- iterating until max depth or taint termination.

This is NOT a pattern scanner. All vulnerability detection decisions are made by the LLM agent using adversarial prompting, invariant decomposition, and type-specific specialist knowledge. A separate skeptic agent independently verifies each finding.

When to Use

• Scan a module for memory corruption vulnerabilities (buffer overflows, integer overflows, UAF, double-free, type confusion)
• Analyze a specific RPC handler or COM method for memory safety issues
• Deep analysis of a call chain from an entry point to dangerous operations
• AI-driven vulnerability research on decompiled Windows binaries
• When static analysis produces too many false positives or misses subtle bugs

When NOT to Use

• Logic vulnerabilities (auth bypass, state errors) -- use ai-logic-scanner
• Format string scanning -- deprecated bug class on modern Windows
• Code lifting or rewriting -- use code-lifter
• General function explanation -- use re-analyst or /explain

Data Sources

SQLite Databases (primary)

Individual analysis DBs in extracted_dbs/ provide the raw data:

• functions.decompiled_code -- Hex-Rays decompiled C (read on demand)
• functions.assembly_code -- x64 assembly ground truth (read on demand)
• functions.simple_outbound_xrefs -- Callgraph edges
• functions.function_signature -- Parameter types and names
• file_info.exports -- Exported functions
• file_info.entry_point -- PE entry points