Post

Developed with Codex. I saw exceptions from bulk_extractor’s winpe scanner and asked Codex to reproduce them, trace execution, find the cause, and prepare a tested fix. It did: github.com/simsong/bulk... A thread 🧵

Simson Garfinkel

@simson.net

13 Aug

The PE metadata implied an executable extent of 24,390,512 bytes—beyond the bytes available to this scanner invocation. The input-derived length reached sbuf_t, whose bounds check rejected the slice with a controlled exception.

Simson Garfinkel

@simson.net

This was not exploitable out-of-bounds access: reads and slices are mediated by sbuf_t. The fix preserves the recognized PE feature, skips an incomplete carve, safely hashes short buffers, and adds a real-fixture regression test.

13/8/26, 9:22 pm0 reposts0 likes

Simson Garfinkel

@simson.net

13 Aug

Why Codex could move quickly: bounded position-aware data, modular scanners, structured diagnostics, separate recorders, real fixtures, and focused tests. AI didn’t replace software engineering; it amplified excellent underlying structure.

Simson Garfinkel

@simson.net

13 Aug

PR #674 is merged. bulk_extractor 2.2.0beta1 is available now with a precompiled 64-bit Windows executable, source archive, and Snap packages: github.com/simsong/bulk...