The Cosmic Turtle of Code

The speaker, a code security reviewer, starts from the observation that people read code top to bottom, which makes it hard to hold the structure of many functions in mind. He compares a single function's control flow graph with a call graph and shows how the same logic becomes harder to follow once functions are reordered or split across files. These graph views are decades old and have long been built into reverse engineering tools such as IDA Pro and Binary Ninja, but they are most useful when they can be scripted.

To test this idea he wrote Ariadne, a Binary Ninja plugin built on NetworkX that renders a live call graph as the user navigates the binary. Applied to reachability, it traced a path from an entry point to a vulnerable function in an old CVE. For a data-flow question, intersecting the ancestor sets of two file-handling functions revealed a shared parent, main. Overlaying fuzzing coverage data showed that POST request handling was never reached, which pointed the fuzzer toward the string comparisons that gated it. He also tried patch analysis on a complex libwebp heap bug and found that static graphs struggled with allocation lifetimes and ordering, which are time-dependent.

He then surveyed time-based views, including instruction-address scatter plots, the DARPA filament view, flame graphs, and the tenant plugin, and showed an animated visualization of a live head-to-head CTF. His takeaway is that graphs supplement rather than replace find and cross-reference workflows, and that the designer should decide whether a view is for comparison or for interactive drill-down.