ai-taint-scanner

AI Taint Scanner

Purpose

Trace attacker-controlled data from entry points to dangerous sinks across module boundaries using LLM-driven analysis. The scanner builds a cross-module callgraph from attacker-reachable entry points, classifies every node (MUST_READ / KNOWN_API / TELEMETRY / LIBRARY), enriches each node with taint-specific metadata (sink density, parameter types, trust boundaries, assembly CFG summary), and delivers the enriched context to the AI agent in depth-level batches. The agent traces taint forward through each batch, returns requests for deeper functions, and reads deeper code itself via Shell -- iterating until max depth or taint termination.

This is NOT a pattern scanner. All taint propagation decisions are made by the LLM agent using the enriched callgraph context. A separate skeptic agent independently verifies each finding against assembly ground truth.

When to Use

• Trace attacker-controlled parameters from RPC/COM/export entry points to dangerous sinks (file writes, memory copies, privilege operations)
• Analyze cross-module data flow security across DLL boundaries
• Find where untrusted input reaches trust boundary crossings
• Identify parameter propagation chains from network-facing handlers to privileged operations
• AI-driven taint analysis on decompiled Windows binaries when deeper cross-module context is needed

When NOT to Use

• Memory corruption scanning (buffer overflows, UAF) -- use ai-memory-corruption-scanner
• Logic vulnerabilities (auth bypass, state errors) -- use ai-logic-scanner
• Code lifting or rewriting -- use code-lifter
• General function explanation -- use re-analyst or /explain

Data Sources

SQLite Databases (primary)

Individual analysis DBs in extracted_dbs/ provide the raw data:

• functions.decompiled_code -- Hex-Rays decompiled C (read on demand)
• functions.assembly_code -- x64 assembly ground truth (read on demand)
• functions.simple_outbound_xrefs -- Callgraph edges
• functions.function_signature -- Parameter types and names
• functions.global_var_accesses -- Global variable reads/writes
• functions.loop_analysis -- Loop structure and complexity
• file_info.exports -- Exported functions
• file_info.imports -- Imported APIs
• file_info.entry_point -- PE entry points