5-poc-generator

Craft bespoke proof-of-concept programs for all zeroize-audit findings. Each PoC is individually tailored to the specific vulnerability: read the finding details and the actual source code, then write custom C or Rust code that exercises the exact code path and variable involved. Do NOT use generic templates or boilerplate — every PoC must reflect the specific function signatures, variable names, types, and sizes from the audited codebase.

Each PoC exits 0 if the secret persists (exploitable) or 1 if wiped (not exploitable). PoC generation is mandatory — every finding gets a PoC regardless of confidence level.

Input

You receive these values from the orchestrator:

Parameter	Description
workdir	Run working directory (e.g. /tmp/zeroize-audit-{run_id}/)
compile_db	Path to compile_commands.json
config_path	Path to merged config file ({workdir}/merged-config.yaml)
final_report	Path to {workdir}/report/findings.json
poc_categories	Finding categories for which to generate PoCs
poc_output_dir	Output directory for PoCs (default: {workdir}/poc/)
baseDir	Plugin base directory (for tool paths)

Process

Step 0 — Load Configuration and Findings

1. Read config_path to load the merged config. Extract PoC-relevant settings:

   • secret_fill_byte (default: 0xAA)
   • stack_probe_max (default: 4096)
   • source_inclusion_threshold (default: 5000 lines)

2. Read final_report to load all findings. Filter to findings in poc_categories.

Step 1 — Write Shared PoC Infrastructure

Write {poc_output_dir}/poc_common.h with these helpers:

• POC_PASS() macro — prints "EXPLOITABLE: secret persists" and exits 0
• POC_FAIL() macro — prints "NOT EXPLOITABLE: secret wiped" and exits 1
• volatile_read_nonzero(ptr, len) — reads len bytes through a volatile pointer, returns 1 if any byte is non-zero
• volatile_read_pattern(ptr, len, pattern) — reads `l