DEF CON holds a special place in the world of cybersecurity.
For over thirty years, the conference has brought together security researchers, hackers, engineers and offensive security specialists in Las Vegas to present their discoveries, tools and work to a particularly discerning international community.
Being selected to present one’s research there is therefore a significant honour.
This year, Jonathan “endrazine” Brossard, CTO of MOABI, was once again a speaker at DEF CON, delivering a talk on his latest work:
Witchcraft Solver: Automated 0-day Discovery in Stripped Binaries.
Start with a binary and automatically scan for vulnerabilities
The problem that Witchcraft Solver tackles is simple to describe, but considerably more difficult to solve.
Let’s take a compiled piece of software for which we do not have the source code. The symbols have been stripped and no specific environment has been set up to facilitate its analysis.
How can we automatically search for vulnerabilities in this software and proceed until we obtain a proof of concept?
This is precisely the aim of the work presented by Jonathan at DEF CON.
Witchcraft Solver offers an automated pipeline combining several advanced cybersecurity research techniques.
The binary is first transformed to enable its analysis in an intermediate LLVM representation. An initial analysis then reduces the number of relevant targets before several formal verification engines are run in parallel.
The results obtained are then fed into directed fuzzing and concolic execution techniques to compare potential vulnerabilities with the programme’s actual behaviour and move towards concrete proofs of concept.
The challenge is therefore not simply to detect an anomaly.
It is to gradually narrow the gap between an unknown binary and the demonstration that vulnerable behaviour actually exists.
Comparing research with real-world software
Another important aspect of the work presented concerns its application to environments representative of real-world industrial settings.
According to the results presented by Jonathan, the multi-architecture approach studied was tested against a corpus of 39,364 production ELF binaries and supports various architectures, including ARM64, ARMv7, RISC-V and s390x.
The pipeline was also tested against a known vulnerability in libjpeg-turbo, CVE-2023-2804. In the experiment presented, the use of SymQEMU enabled the first crash to be achieved within 25 minutes from a stripped binary, without access to the source code.
This work thus explores a particularly important question for security research: to what extent can we automate tasks that have historically been the preserve of experts with advanced skills in reverse engineering and vulnerability analysis ?
An issue that goes far beyond academic research
This issue also has a clear industrial dimension.
Modern digital products are made up of numerous components. Proprietary software, open-source libraries, firmware, third-party components and vendor-specific developments coexist within systems whose complexity is constantly increasing.
And the company that uses or integrates these components does not necessarily have access to their source code.
Yet it must be able to assess their security.
This issue becomes particularly important in industrial, embedded or mission-critical environments, where certain equipment may remain in production for many years and incorporate components from multiple suppliers.
Analysing the software as it is actually delivered therefore becomes essential.
This is also what makes research into binary analysis particularly interesting: it allows researchers to work directly on the final artefact, without necessarily relying on the development environment that produced it.
A particularly significant return to DEF CON
This talk forms part of a long-standing relationship between Jonathan Brossard and DEF CON.
Jonathan previously presented his research on BitLocker and TrueCrypt in 2008, Rakshasa in 2012, and his work on the Witchcraft Compiler Collection in 2016.
His return in 2026 with Witchcraft Solver thus continues nearly twenty years of contributions and work in the fields of offensive security, reverse engineering and vulnerability research.
His career has also seen him present his research at several major international conferences in both the industry and academic sectors, including Black Hat, CCC, HITB, IEEE, USENIX and ACM. He is currently completing a PhD on reverse engineering at CNAM, where he has also taught for several years.
For MOABI, seeing our CTO return to present his research at DEF CON is naturally a source of great pride.
But beyond individual recognition, this presentation above all illustrates a conviction: developing advanced cybersecurity technologies requires maintaining a close link between research, experimentation and real-world industrial challenges.
Gaining a deep understanding of software, exploring new methods of analysis, automating what once seemed difficult to automate, and sharing the results with the international community are all part of this approach.
Research must not remain confined to laboratories or conferences.It really comes into its own when it gradually enables us to tackle specific security issues.
Having attended in 2008, 2012 and 2016, Jonathan Brossard was back at DEF CON in 2026.
This time, he posed a particularly ambitious question: to what extent can we automate the search for vulnerabilities when all we have is the binary ?
