memory-corruption-detector

Detect memory corruption vulnerabilities in Windows binaries with assembly-level verification.

17|3|Updated Feb 22, 2026
One-click install
npx skills add https://github.com/marcosd4h/DeepExtractRuntime --skill memory-corruption-detector
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: memory-corruption-detector
Source: https://github.com/marcosd4h/DeepExtractRuntime/tree/main/skills/memory-corruption-detector
Command: npx skills add https://github.com/marcosd4h/DeepExtractRuntime --skill memory-corruption-detector

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Detects memory corruption vulnerabilities in Windows binaries produced by DeepExtractIDA, including buffer overflows, use-after-free, double-free, and format string bugs, and provides assembly-level verification.

Core Features & Use Cases

  • Four detectors: scan_buffer_overflows.py, scan_integer_issues.py, scan_use_after_free.py, scan_format_strings.py to identify vulnerability classes
  • Independent verification: verify_findings.py re-reads code and assembly to confirm findings
  • Structured outputs: findings are exported in JSON with scoring and metadata for runtime integration
  • Workflow integration: leverages decompiled-code extraction and shared helpers for end-to-end analysis

Quick Start

Identify a module DB and run the scanners to surface memory-corruption findings.

Frequently Asked Questions about memory-corruption-detector

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect memory corruption vulnerabilities in Windows binaries?

You can detect memory corruption vulnerabilities in Windows binaries by running automated scanning scripts that perform taint analysis on decompiled code to surface buffer overflows, use-after-free, double-free, and format-string bugs.

How does taint analysis work for finding buffer overflows in decompiled code?

Taint analysis for finding buffer overflows tracks untrusted data flow through decompiled code to identify unsafe operations. It loads module databases and flags potential memory corruption issues based on data propagation patterns.

Can I verify memory-safety bugs at the assembly level?

Yes, you can verify memory-safety bugs at the assembly level. An independent verification workflow re-reads the extracted code and assembly instructions to confirm findings reported by the initial decompiled-code scanning scripts.

How do I export memory corruption findings in a structured format?

You can export memory corruption findings in a structured JSON format. The analysis workflow outputs vulnerability data with scoring and metadata, making it ready for runtime integration and downstream security pipelines.

Does this memory corruption detector work with any Windows binary analysis tool?

This memory corruption detector is designed for Windows binaries produced by the DeepExtractIDA runtime. It leverages decompiled-code extraction and shared helpers to analyze the specific module databases generated by that environment.

What types of memory corruption issues can decompiled-code scanning identify?

Decompiled-code scanning identifies four primary types of memory corruption issues: buffer overflows, integer issues, use-after-free, double-free, and format-string bugs using dedicated detection scripts.