zeroize-audit

To detect missing zeroization of secrets in C/C++ and Rust code, you can audit the codebase to identify sensitive data retained on the stack or in registers, and find secrets copied insecurely. This process scans source code for vulnerabilities related to memory safety.

Compiler optimizations like Dead Store Elimination (DSE) or loop unrolling often remove memory zeroization routines because they view wiping unused variables as unnecessary operations. Analyzing LLVM IR and assembly reveals when these security measures are eliminated during the build process.

You audit LLVM IR and assembly for dead store elimination of wipe routines by analyzing the compiled intermediate representations rather than just the source code. This approach detects when compiler optimizations silently remove security measures meant to zeroize secrets from memory.

Yes, you can use this memory safety audit for Rust MIR and LLVM IR analysis. It includes specific checks tailored for Rust's memory management and zeroization patterns, ensuring that sensitive data handling vulnerabilities are detected across Rust's intermediate representations.

The best way to scan a cryptographic library for secret memory leaks is to perform a comprehensive audit that checks for missing zeroization of API keys, passwords, and encryption keys. This ensures secrets are properly wiped from memory before they can be leaked.