LLM-Driven Reasoning for Automated Vulnerability Discovery Behind Hall-of-Fame

Overview: This presentation introduces "Whisper," an automated vulnerability discovery framework that combines large language model (LLM) reasoning agents with reverse engineering tooling to discover zero-day vulnerabilities in stripped ARM64 mobile binaries. The speaker reviews the discovery and exploitation of CVE-2024-34587, a remote code execution flaw in Samsung mobile devices, to highlight the manual bottlenecks of binary auditing. The talk demonstrates how structured prompt engineering, decompiler intermediate representations, dynamic Frida tracing, and SAT-solver-style constraint modeling enable LLMs to analyze binary code without hallucination.

Key Topics: - Case study of CVE-2024-34587: Remote RTCP packet parsing memcpy overflow on Samsung devices - Challenges of auditing stripped ARM64 binaries: Missing symbols, classes, and indirect calls - Whisper pipeline architecture: Decompiler PAL code, Frida dynamic instrumentation, and LLM reasoning agents - Formulating vulnerability analysis as formal constraint satisfaction (SAT solving) to eliminate false positives

Technical Details: Auditing closed-source mobile binaries for memory corruption vulnerabilities is exceptionally labor-intensive. The speaker highlights CVE-2024-34587, a zero-click Remote Code Execution flaw discovered in Samsung's s video engine service—a high-privilege system process running by default on Samsung smartphones. The vulnerability lies in an RTCP packet parsing routine that processes an incoming network packet: a single memcpy operation trusts a 16-bit word length parameter (up to 0xFFFF bytes) directly controlled by an attacker, overflowing both source and destination heap buffers. Proving and reaching this bug manually required tedious call-stack tracing, reverse engineering stripped data structures, and auditing complex class relationships across multiple shared libraries.

To automate this workflow, the authors developed "Whisper." Unlike Google Project Zero's Project Naptime—which operates on source code—Whisper directly targets stripped ARM64 binaries. The pipeline minimizes human involvement to two actions: selecting the initial target process and verifying final confirmed alerts. The automated architecture operates across four distinct phases: 1. Decompilation & Global Call Graph Generation: Decompiles binaries into readable pseudo-C (PAL code) and utilizes Frida on a real Android device to hook indirect call sites, resolving runtime jump targets from CPU registers. 2. Attack Surface Identification: LLM agents traverse the call graph to locate network receive and parsing functions, identifying patterns such as packet buffers, magic numbers, large switch statements, and nested conditionals. 3. Data Structure Reconstruction: Reconstructs object layouts by locating memory allocations (malloc, constructors) and mapping struct member offsets before memory operations occur. 4. Constraint-Driven LLM Reasoning: Instead of asking naive questions that produce ambiguous "maybe" answers, the framework supplies the LLM with concrete operational constraints (e.g., allocated buffer = 1,024 bytes, packet buffer = 1,600 bytes, length field = attacker-controlled 16-bit integer). Acting like a SAT solver under strict preconditions, the LLM analyzes memory operations deterministically, outputting high-confidence vulnerability proofs with zero false alarms.

Key Takeaways: Deploying LLMs for binary vulnerability research requires grounding models with concrete runtime data structures and call-graph constraints rather than relying on unconstrained prompts. Combining static decompilation with dynamic instrumentation (such as Frida) is essential to resolve indirect calls and reconstruct data layouts in stripped binaries. Structuring LLM prompts as formal constraint satisfaction problems allows reasoning models to deterministically flag memory bounds violations while eliminating hallucinations.

(AI summary — Gemini Flash)