Every vulnerability leaves a trail.
We run Lachesis against vulnerable historical code, then show the path it found from attacker-controlled input to the unsafe operation.
“The CVE was already known. The question was whether Lachesis could reconstruct why it happened.”
Known vulnerabilities. Fresh runs. The evidence stays visible.
↓Start with a case.
rsync: Off-by-one out-of-bounds heap write
The argv pointer array is allocated with `maxargs` elements. argc is grown through the loop -- by direct argv[argc++] stores and by the interprocedural glob_expand paths -- while the only in-loop realloc guard fires on `argc == maxargs-1`. After the loop, `argv[argc] = NULL;` writes the trailing terminator; when argc has reached maxargs, that store lands one 8-byte pointer past the allocation, corrupting adjacent heap.
wolfssl: Stack-based buffer overflow
An attacker-sized ASN.1 OID length is copied straight into a small fixed stack buffer with no size check, overflowing the stack.
outline: Arbitrary file read via path traversal in JSON import
The attachment key from the imported JSON flows straight into path.join(rootPath, key) and is read by fs.readFile with no containment check, so ../ reads arbitrary files that are then imported.
History gives us the target.
Lachesis finds the path.
We choose a known vulnerable release, run Lachesis on that code, and preserve the queries, output, and source locations that form the result.
Each case clearly separates what was known from public history and what the Lachesis run established.