Post

Developed with Codex. I saw exceptions from bulk_extractor’s winpe scanner and asked Codex to reproduce them, trace execution, find the cause, and prepare a tested fix. It did: github.com/simsong/bulk... A thread 🧵

This was not exploitable out-of-bounds access: reads and slices are mediated by sbuf_t. The fix preserves the recognized PE feature, skips an incomplete carve, safely hashes short buffers, and adds a real-fixture regression test.

Why Codex could move quickly: bounded position-aware data, modular scanners, structured diagnostics, separate recorders, real fixtures, and focused tests. AI didn’t replace software engineering; it amplified excellent underlying structure.