# Vulnerability Research Workflow

## High-Risk Import Quick Reference

| Function | Risk |
|----------|------|
| `strcpy`, `strcat`, `gets` | Buffer overflow — no bounds check |
| `sprintf`, `vsprintf` | Buffer overflow — no output bounds |
| `scanf`/`sscanf` with `%s` | Buffer overflow — unbounded string read |
| `memcpy`, `memmove` | Buffer overflow if size is user-controlled |
| `system`, `popen`, `exec*` | Command injection if argument touches user input |
| `malloc` | Integer overflow if size expression wraps |
| `free` | UAF / double-free if pointer management is wrong |

## Workflow

1. **Find call sites** for each risky import:
   ```bash
   ghidra-rpc xrefs-to binary strcpy
   ```

2. **Decompile callers** — use `--timeout` for large or complex functions:
   ```bash
   ghidra-rpc decompile binary <caller> --timeout 120
   ```

3. **Trace backwards** through call chains until you reach an input source
   (`recv`, `read`, `fgets`, `argv`).  Use `--no-stack` on `xrefs-to` to
   keep the graph clean:
   ```bash
   ghidra-rpc xrefs-to binary <caller> --no-stack
   ```

4. **Annotate findings**:
   ```bash
   ghidra-rpc set-comment binary 0x401234 \
     --comment "VULN: strcpy with unchecked recv() data" --type pre
   ghidra-rpc rename-function binary FUN_00401100 handle_user_input_UNSAFE
   ```
