Sys
A static and symbolic analysis tool for finding memory safety bugs in browser code and other software.
What is Sys?
Sys is a static and symbolic analysis tool designed to find memory safety bugs in complex software, with a particular focus on browser code. It combines static analysis with symbolic execution to detect subtle vulnerabilities, such as uninitialized memory access or buffer overflows, that might be missed by other methods. The tool operates directly on LLVM intermediate representation, enabling analysis of optimized production builds.
Security researchers and software engineers working on memory safety, particularly those analyzing or developing complex, performance-critical systems like web browsers or similar large-scale C/C++ codebases. It is also suitable for developers needing to audit production-quality code for subtle security vulnerabilities.
Developers choose Sys for its ability to find 'good bugs in good code'—subtle, security-critical vulnerabilities in well-written, production-quality software where traditional testing might not be sufficient. Its integration of static and symbolic analysis, combined with support for multiple optimization levels, allows it to detect issues that other tools may overlook.
Overview
Sys: A Static/Symbolic Tool for Finding Good Bugs in Good (Browser) Code
Use Cases
Best For
- Detecting uninitialized memory accesses in optimized production builds of browser engines.
- Identifying heap out-of-bounds errors in complex C/C++ software like Firefox components.
- Finding array accesses with negative indices that cause out-of-bounds reads or writes.
- Analyzing how user input propagates through a program to uncover potential security vulnerabilities.
- Performing memory safety analysis on code compiled with various optimization flags (e.g., O0 to O3, Og, Os, Oz).
- Security auditing of large-scale, performance-critical systems where traditional testing methods are insufficient.
Not Ideal For
- Teams using Windows or macOS, as Sys is only tested on Arch Linux and requires manual porting efforts.
- Projects needing rapid, out-of-the-box security scanning in CI/CD pipelines, due to Sys's complex dependency setup and lack of pre-built binaries.
- Developers seeking general-purpose code quality or style checking, since Sys is narrowly focused on memory safety vulnerabilities in LLVM-based C/C++ code.
Pros & Cons
Pros
Specifically finds memory safety bugs like uninitialized memory and heap out-of-bounds errors, with concrete examples demonstrated in Firefox's Prio library code from the README.
Supports analysis across multiple optimization levels (O0 to O3, Og, Os, Oz), allowing it to inspect production builds without recompilation, as detailed in the -e option usage.
Combines static and symbolic execution to detect subtle vulnerabilities that might be missed by other methods, aligning with its philosophy of finding 'good bugs in good code'.
Cons
Only tested on Arch Linux, with the README explicitly stating that support for other OSes is untested and requires community patches, making deployment challenging.
Requires precise installation of LLVM-9, Boolector configured with shared libraries, and Haskell Stack, which can be error-prone and time-consuming, as highlighted in the install section.
Points to a 'very very very new reimplementation' (sys2), suggesting the current version might be less maintained, and the README lacks detailed tutorials or integration guides.
Frequently Asked Questions
Related Projects
PHP ParserA PHP parser written in PHP
TypeScript ESLint:sparkles: Monorepo for all the tooling which enables ESLint to support TypeScript
pyrightStatic Type Checker for Python
Reviewdog🐶 Automated code review tool integrated with any code analysis tools regardless of programming language
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.